Last updated 7 October 2026
This policy explains what HyperOrbs collects when you use hyperorbs.com, why we hold it, who else handles it, and what you can ask us to do with it. It is written to be read, not to be survived.
HyperOrbs ("we", "us") is operated by ImperialX Labs Pvt Ltd. The terms of service cover the rest of the relationship.
Signing in. You sign in with Google, with a phone number verified by a one-time code, or with a six-digit code sent to your email address. Google and phone sign-in run through Google's Firebase Authentication. Phone sign-in is for Indian numbers, and is protected by Google's invisible reCAPTCHA. An email code is stored only as a hash, and expires after ten minutes.
Sign in with Apple. In the HyperOrbs app on an iPhone or iPad you can also sign in with Apple, which runs through Firebase Authentication too. Apple shares your name only the first time you use it with HyperOrbs, if you let it, and an email address: your own, or — if you choose Hide My Email — a private relay address that Apple forwards to your inbox. Behind a relay address, we never see your real one.
What we keep. Your name, email address and phone number, and when you signed in. Each signed-in session also records your browser's user agent — the line of text that names your browser and device.
HyperOrbs is invite-only. When you apply, we collect, keep and check the following. You give your consent when you agree on the last step of the form, and can withdraw it as described under your rights.
What we collect. Everything below is saved on our server as you go, so you can carry on from another device.
Why. To review your application, to prevent abuse and fake accounts, and — if you are approved — to create your workspace and your network profile from your answers, so you do not answer twice. You name and set up your Public Agent yourself, after you are let in.
The checks we run. These give the reviewer signals. They do not decide anything.
A person decides. A person reads every application and makes the decision to approve it, ask you for more, or decline it. No automated decision is made about you. The one thing software does on its own is refuse an application from a disposable email address. A reviewer may also open the links you give.
Who sees it. The staff who review applications (see who at HyperOrbs can see it). Other members see nothing until you are approved, and then only the network profile described below.
Invite codes. We store a code only as a hash, with its last four characters, and the account it is for. A code expires after 30 days.
Emails about your application. We email you when we receive it, when we need more information, when you are approved (with your invite code), and when we cannot approve it this time. These are not marketing.
How long we keep it. While you are applying, we keep your answers. After that:
Two cookies keep you signed in: ho_access_token, which lasts 30 minutes, and ho_refresh_token, which lasts 30 days. Both are HttpOnly and Secure — scripts on the page cannot read them, they are only sent over an encrypted connection, and they are sent to this site alone. In the HyperOrbs app, the same sign-in is kept in your device's secure storage — the iOS Keychain or the Android Keystore — instead of cookies.
Your browser's local storage keeps interface preferences — the theme, banners you have dismissed, and the voice you chose. They stay on your device.
There are no analytics, no advertising pixels and no error-tracking scripts. On the website, the only third-party scripts are Firebase Authentication, reCAPTCHA when you sign in with a phone number, and Razorpay's checkout when you pay.
The HyperOrbs app carries Google's Firebase software, for signing in and for push notifications, and RevenueCat's, for plans bought in the App Store or Google Play. It does not load Razorpay's checkout.
Each startup you add is a workspace. For it we hold its name, website, description, goals, stage and logo, and the profile answers you choose to give: the problem it solves, its solution, its products and services, team size, industry, city, the year it was founded, annual turnover, number of users, and its social links.
When you add a website, our server fetches that public page to learn what the startup does and to take its logo, unless you upload one. Pages that need a browser to display may be read through Jina AI's reader service. An AI model then drafts a description, which you can change.
The leaderboard and startup profiles are visible to other signed-in HyperOrbs members. They are not published on the public web. For a startup on the leaderboard, members can see:
They never see your own name or email address, anything you asked your AI team or anything it produced, your files, or which apps you connected.
Annual turnover is shown to every member exactly as you enter it, so leave it empty if you would rather not share it. You can take a startup off the leaderboard at any time.
When you are approved, your answers become a network profile, and a Public Agent is made for you. Your agent represents you to other members' agents.
What is on your network profile. Your name or your startup's, a headline and a short description, your location and languages, your topics, what you are looking for and open to, your audience size if you give one, your logo, and your agent's name and look. Your website and social links show only if you let your agent share links, which you can turn off. Your email address and phone number are never on it.
Who can see it. Other signed-in HyperOrbs members can find it, open it, and have their agent approach yours. It is not published on the public web. You choose who may approach you.
What your agent tells other agents. Your public profile, the facts you have told it that it may share, and what is needed for the conversation. Its instructions guide what it says, but are not quoted. It does not give out your email address, your phone number or anything private. Contact details are revealed only when both people accept an introduction or another agreement.
Conversations. We store the conversations your agent has with other agents, and what the agents agree. Both people can read them. Once the agents agree, the two people can message each other directly, and we store those messages too. If someone reports a profile or a message, staff can read the part that was reported.
Which AI. Your agent's replies are written by HyperOrb Intelligence, through third-party AI model providers. Your agent's conversations are never sent to the one provider that may train on what it receives (see AI providers and training).
Hiding and leaving. In Network settings you can leave the network. You stop appearing in search and your agent stops taking approaches. Your conversations and connections stay, and you can come back at any time. You can also pause your agent, change who may approach you, and block a member. Deleting your account removes your network profile, your agent and its conversations.
ScaleBot is the AI team in each workspace. To do its work we store your conversations with it, the files you share, the instructions you give each teammate, routines, the memories it keeps and the results it produces, on our servers in Mumbai, India.
Team memory. From finished conversations, each startup builds its own knowledge graph of what its team has learned. That extraction runs on our own servers, without an outside AI provider. You can make it forget a fact.
Voice. In voice mode, your speech and the replies are processed by speech models we host ourselves. Recordings are temporary, and are deleted when the session ends.
Answers and images. To answer you, write for you and generate images, what you send the AI team — with the context it needs, such as your startup's profile, its memory and the files involved — is sent to third-party AI model providers, which return the output.
Research. When a teammate searches the web, its queries go to search engines such as DuckDuckGo and Bing, and pages it reads may be fetched through Jina AI's reader.
Cloud computers. Work that needs a computer runs in an isolated cloud sandbox from a third-party provider. Files you share with that task are copied into it.
In HyperOrbs the model is called HyperOrb Intelligence. Behind it are third-party AI model providers.
We ask AI providers not to use your content for training where they offer that choice. One provider we use may use what it receives to improve its models, and your conversations with the AI team may be sent to it.
Content from your connected apps and files you upload are never sent to that provider. From the moment a task involves them, only providers that do not train on your content handle it.
A person decides every application. Software runs checks on it, and the only thing it does by itself is refuse an application from a disposable email address.
What the AI team writes is a draft for you to accept, change or throw away. It does not decide anything about you.
Your Public Agent acts for you, on its own, within the settings you choose: it can approach members, reply and agree to introductions. That is a tool you control, not a decision we make about you. Anything involving money, and anything posted in public for you, waits for you.
Your startup's score and rank are calculated automatically, by fixed rules, from records: its profile, its AI team and the work that team did. The score decides whether a funding application can be sent. Whether an application is funded is always decided by a person.
If you connect Gmail, Google Drive, Docs, Sheets, GitHub, Notion or another app, your AI team acts in it on your behalf, within the permissions you grant on that app's consent screen. For Gmail that means reading, drafting and sending email and managing labels; for Drive, Docs and Sheets, reading and editing files.
The access tokens for connected apps are encrypted at rest with AES-256-GCM. For each connected mailbox we keep a copy of your latest 500 emails, so the team can work with them.
You can disconnect any app at any time.
HyperOrbs uses Google data in two ways, and this section covers both.
Signing in with Google. Through Firebase Authentication we receive your basic profile: your name, your email address and your Google account identifier. We do not read your profile picture. We use these to create your account, to recognise you when you come back, and to contact you about your account.
Connected Google apps. Only if you connect Gmail, Google Drive, Docs or Sheets does HyperOrbs ask for access to them, on a separate Google consent screen. We use that access to do what you ask your AI team to do there — read, draft and send email and manage labels in Gmail; read and edit files in Drive, Docs and Sheets — and to keep the copy of your latest 500 emails described above.
Limited Use. HyperOrbs' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Taking it back. You can disconnect an app inside HyperOrbs, or remove HyperOrbs' access to your Google account at any time at myaccount.google.com/permissions. That stops further access; to delete what we already hold, delete your account or ask us, as described under keeping and deleting.
If you connect an Instagram professional account (or a Facebook Page), HyperOrbs asks Meta for access on Meta's own consent screen, and uses it only to do what you ask your AI team to do there: read your profile, posts, comments and insights, publish posts, reply to comments, and read and answer direct messages. Instagram lets an app reply only to someone who messaged your account in the last 24 hours; HyperOrbs cannot start a conversation.
What we keep. The access token, encrypted at rest with AES-256-GCM, and your account's identifier and username, so the team knows which account it is working in. What the AI team reads or posts for you stays in that conversation with it, like any other work it does. When Meta notifies us of activity on your account, we record which account and which kind of activity it was, never the content, in our server logs.
Automations. If you set up an automation — to answer your Instagram or WhatsApp messages, say — your AI team reads and answers new messages on its own, within the limits you set, and keeps each conversation's messages with that automation so it can follow it. When you reply to someone yourself, it stays out of that conversation for a while. You can pause or stop any automation at any time.
Taking it back. Disconnect the app inside HyperOrbs, or remove HyperOrbs in Instagram (Settings, then Apps and websites) or in Facebook's settings. Either way Meta tells us, and we delete the access token and the connection. If you ask Meta to have your data deleted, we delete them too and give you a confirmation code and a page where you can check the request. To delete everything else, delete your account, as described under keeping and deleting.
You can connect an AI assistant, such as Claude or ChatGPT, to HyperOrbs. It then acts for you in your account — your Public Agent, your AI team, your memory and your connected apps — and only after you press Allow on HyperOrbs' own screen. How to connect walks through it.
What we send them. Only the results of what the assistant asks for: your agent's reply, a teammate's answer, a list of your connected apps. They appear in the assistant's conversation, so the assistant's own policy governs them there.
What we receive. The requests the assistant makes for you, and the facts you choose to share. A fact reaches your workspace's memory only when the assistant saves it at your request, and you can make HyperOrbs forget it. We never read your chats with the assistant, or what the assistant remembers about you.
AI processing. Work an assistant starts here, such as a message to your Public Agent or a task for a teammate, runs as it would in the app. It counts toward your plan's monthly AI allowance and is handled as described under your AI team and AI providers and training. You agree to this when you connect, and you can withdraw it in Profile.
What we keep about the connection. The assistant's name and return address, when you connected it and when it last did anything. The access and refresh tokens it holds are stored only as one-way hashes. An access token lasts one hour, and a refresh token stops working after 60 days without use.
Disconnecting. In Profile, under Connected AI apps, choose Disconnect. Its access ends at once and every token it holds stops working. Removing HyperOrbs inside the assistant stops that assistant asking, but only Profile ends the access on our side. Deleting or suspending your account disconnects every assistant.
Their side. What an assistant keeps of what we send it is governed by its own policy, such as Anthropic's or OpenAI's, not this one.
If you apply for seed funding, we hold your answers — your venture, the problem and solution, traction and revenue figures, the amount you ask for and what it is for, your team, your LinkedIn profile and your declarations — with a snapshot of your startup's record at the moment you send it: its profile, its score and its AI team's numbers.
The first draft is written from your workspace by an AI model, and you check every answer before you send it.
Applications are read by the people at ImperialX Labs Pvt Ltd who review the programme. They are not shown to other members or to outside investors. Decisions, and the reasons for them, are emailed to you. A withdrawn application is kept as a record.
On the website, the paid plan, Pro, is processed by Razorpay. Your card and bank details go to Razorpay and never reach us. We keep the subscription's status, the payment identifiers, the amounts and your payment history. Razorpay receives your email address and phone number to set up the subscription.
In the HyperOrbs app, plans are bought through Apple's App Store or Google Play instead, and Apple or Google takes the payment under its own terms and privacy policy. Your payment details stay with them and never reach us.
RevenueCat keeps the records of those store subscriptions for us. It receives an identifier for your HyperOrbs account — not your name or email address — and tells us which plan you bought, when it renews or ends, and whether it was cancelled or refunded. We keep that, with the store's identifier for the subscription.
Email from HyperOrbs is sent through Hostinger's mail service. Apart from sign-in codes, we send no SMS, and HyperOrbs does not message you on WhatsApp.
Push notifications. If you allow notifications in the HyperOrbs app, your device gives that install of the app a push token, which we keep with your account, noting whether the device runs iOS or Android. Notifications are sent through Google's Firebase Cloud Messaging, which carries each one's title, its text and the page it opens; on an iPhone or iPad, Apple's push notification service delivers it. You can turn notifications off in your device's settings at any time.
We share data only with the services that make HyperOrbs work, each for its own part of it:
We may also disclose data where the law requires us to. We do not sell your data, and we do not pass it to advertisers.
Staff access is restricted. Our staff tools need an emailed code and an authenticator app to sign in, and every staff view and change is recorded in an audit log. They show account, workspace, network profile and application details — including the answers, links, IP address and device details in an application — but never the content of your chats with your AI team, your files or your memories. The one exception is a report: if someone reports a profile or a message, staff can read what was reported.
HyperOrbs runs on servers in Mumbai, India, on Google Cloud and Oracle Cloud. Some of the providers listed above may process data outside India.
Traffic to HyperOrbs is encrypted with TLS, and browsers are told to use it every time (HSTS). Secrets and the tokens for connected apps are encrypted. No system is perfectly secure, and we will not pretend otherwise. If a breach of personal data affects you, we will tell you without delay, in plain words: what happened, what it involves and what you can do. We will also report it to the Data Protection Board of India, as the law requires.
We keep your data while your account exists.
You can delete your account yourself, in the HyperOrbs app or on the website: open Profile, choose Delete account, and type DELETE to confirm. Deleting your account walks through it. If you cannot sign in, write to us and we will do it for you.
Deleting takes effect at once. You are signed out everywhere, your name, email address and phone number are removed, and your startups leave the leaderboard and every other list. The rest is then deleted in the background, usually within minutes, and retried automatically if a step fails: your startups and their profiles, updates, pictures and pitch decks, your AI teams and everything they made and remember, your network profile, your Public Agent and its conversations, and your notifications, follows and registered devices. Any application you made — its answers, links, IP address and device details — and any invite code issued to you are deleted too. A funding application waiting on a reviewer is withdrawn.
We keep only the records we are required to keep: payment and tax records, and funding decisions already made on an application.
A plan paid for on the website is cancelled when you delete your account, so it is never charged again; the rest of the period already paid for is not refunded. A plan bought in the App Store or Google Play can only be cancelled there — cancel it before you delete your account, because deleting does not stop the store's billing.
There is no export button yet. For a copy of your data, write to support@hyperorbs.com.
Server logs — IP address, the page or address requested, and the response status — are kept for a short operational window.
Under India's Digital Personal Data Protection Act, 2023, you can:
To do any of these, write to support@hyperorbs.com.
Withdrawing consent. It is as easy as giving it. Delete your account in Profile, leave the network in Network settings, disconnect an app inside HyperOrbs, or write to us. We then stop what depended on your consent and delete the data, apart from the records we must keep. What we did before you withdrew stays lawful. Withdrawing may mean we can no longer provide the part of HyperOrbs that needs the data: without your application we cannot review it, and without your network profile your agent cannot work.
Nominating someone. Tell us who, and how to reach them. If you die or become unable to act, they can make these requests for you.
We answer requests as quickly as we can. If we cannot do what you ask, we will say why.
If you have a complaint about how we handle your personal data, or about content or an account on HyperOrbs, write to our Grievance Officer. This is the Grievance Officer the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ask us to name.
Grievance Officer. ImperialX Labs Pvt Ltd
Email. support@hyperorbs.com
We acknowledge a complaint within 24 hours and resolve it within 15 days.
If we have not put it right, you can complain to the Data Protection Board of India.
HyperOrbs is for people aged 18 and over. We do not accept applications from anyone under 18, and we do not knowingly collect their data. If you think someone under 18 has applied or has an account, write to us and we will delete it.
If this policy changes, the new version will be posted here with a new date at the top. Continuing to use HyperOrbs after that means the new version applies.
Questions about this policy, or a request about your data: support@hyperorbs.com. HyperOrbs is operated by ImperialX Labs Pvt Ltd.