Privacy Policy

Toxic AI Labs, LLC ("Toxic AI Labs," "Company," "we," "us," or "our"), based in Las Vegas, Nevada, respects your privacy and is committed to protecting it through this Privacy Policy.

This Privacy Policy describes how we collect, use, disclose, and safeguard information when you: (a) visit our websites; (b) use our software products; (c) use Orbit, our customer relationship management platform for sales, marketing, social media management, and customer service; or (d) interact as a customer, lead, or contact of a brand within the Toxic AI Labs portfolio that uses Orbit to communicate with you.

This Privacy Policy is incorporated into and subject to our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

If you have questions about this Privacy Policy, contact us at info@toxicailabs.com.

Toxic AI Labs occupies two different roles depending on the context, and your rights and our obligations differ accordingly:

As a Business (Controller)

When you visit our websites, register for an Orbit account, or otherwise interact directly with Toxic AI Labs, we act as the "business" or "controller" of your personal information and are responsible for determining how and why it is processed.

As a Service Provider (Processor)

When a portfolio brand uses Orbit to manage its own customers, leads, or contacts, that brand is the business/controller for its customers' data, and Toxic AI Labs acts only as a service provider or processor, processing that data on the brand's behalf and instructions. If you are a customer of a portfolio brand and have questions about how your data is used, you should also contact that brand directly; we will direct such inquiries accordingly where required.

3.1 Information You Provide Directly

• Account and Registration Information: name, email address, phone number, company name, job title, billing address, and password.
• Payment Information: billing details processed via our third-party payment processor (we do not store full payment card numbers on our own servers).
• Customer and Contact Data Entered Into Orbit: names, email addresses, phone numbers, physical addresses, purchase history, communication history, notes, tags, and other information that Orbit users (including portfolio brands) upload or enter about their own customers and leads.
• Communications: information you provide when you contact us for support, sales inquiries, or feedback, including the content of any messages.
• Social Media Content: posts, messages, comments, and account credentials or access tokens you connect to Orbit for social media management purposes.

3.2 Information Collected Automatically

• Usage Data: pages visited, features used, timestamps, clickstream data, and referring URLs.
• Device and Log Data: IP address, browser type, operating system, device identifiers, and crash/error logs.
• Cookies and Similar Technologies: as described in Section 9 below.

3.3 Information from Third Parties

• Integrated Platforms: when you connect third-party services (e.g., email providers, social media platforms, payment processors, e-commerce platforms) to Orbit, we receive information from those platforms as authorized by you or the connecting account holder.
• Marketing and Data Enrichment Partners: we may receive supplemental contact or firmographic information from third-party data providers to enrich CRM records, where permitted by applicable law.

3.4 Categories of Data Subjects

This Privacy Policy applies to: (a) individuals who register for or administer Orbit or other Toxic AI Labs accounts; (b) end customers, leads, and contacts of portfolio brands whose data is processed through Orbit; and (c) visitors to our websites.

We use the information we collect for the following purposes:

• To provide, operate, maintain, and improve the Services, including Orbit's sales, marketing, social media management, and service functions;
• To process transactions and send related information, including confirmations and invoices;
• To send administrative communications, such as updates to our policies or Services;
• To send marketing communications, where you have opted in or as otherwise permitted by law, and to allow portfolio brands to send their own marketing communications to their customers through Orbit;
• To respond to inquiries, provide customer support, and manage service requests;
• To personalize and improve user experience;
• To monitor and analyze usage trends and effectiveness of the Services;
• To detect, investigate, and prevent fraudulent transactions, unauthorized access, and other illegal or policy-violating activity;
• To comply with legal obligations and enforce our Terms of Service;
• To facilitate a merger, acquisition, financing, or sale of assets involving Toxic AI Labs or a portfolio brand, consistent with our business model of developing and transferring software products.

We do not use content you enter into Orbit on behalf of a portfolio brand's customers for our own independent marketing purposes, except as necessary to provide, maintain, and improve the Services.

We may share information as follows:

• With Portfolio Brands: if you are a customer, lead, or contact of a brand in our portfolio, your information is shared with and accessible to that brand for its own sales, marketing, and service purposes.
• With Service Providers: we share information with third-party vendors who perform services on our behalf, such as hosting, payment processing, analytics, email/SMS delivery, and customer support tooling, under contractual confidentiality and data protection obligations.
• With Integrated Third-Party Platforms: where you or a portfolio brand connects a third-party platform (e.g., a social media network) to Orbit, information may be shared with that platform as necessary to provide the connected functionality, subject to that platform's own privacy practices.
• For Legal Reasons: where required to comply with applicable law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Toxic AI Labs, our users, or others.
• In Connection with Business Transfers: in connection with, or during negotiations of, any merger, sale of company assets, financing, acquisition, or sale or transfer of all or a portion of our business to another company, consistent with our business model of building and transferring software products and brands.
• With Your Consent: for any other purpose disclosed to you at the time information is collected, or with your consent.

We do not sell personal information for money. To the extent certain data sharing (such as with data enrichment or advertising partners) may constitute a "sale" or "share" under applicable state law (e.g., the CCPA), we describe your rights with respect to such activity in Section 8.

6.1 Data Processed on Behalf of Portfolio Brands

Where Orbit is used by a portfolio brand to manage its own customer relationships, we process personal data strictly according to that brand's instructions and configuration within the platform, and only for as long as necessary to provide the Services or as instructed.

6.2 Social Media Management

When Orbit is used to manage social media accounts, we may access and process content, messages, and analytics from connected social media accounts solely to provide scheduling, publishing, monitoring, and response functionality. Access tokens are stored securely and used only for authorized purposes.

6.3 Communications Sent Through Orbit

Marketing, transactional, and service communications sent via Orbit on behalf of a portfolio brand are sent under that brand's name and at its direction. Recipients seeking to unsubscribe or exercise privacy rights with respect to such communications may do so via the unsubscribe mechanism in the communication itself, or by contacting the sending brand directly; we will assist in fulfilling such requests as required by applicable law.

We retain personal information for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Data entered into Orbit by a portfolio brand is generally retained for the duration of that brand's account and for a reasonable period thereafter for backup, legal, and archival purposes, after which it is deleted or de-identified, subject to any longer retention period required by law or requested by the applicable brand.

Depending on your location, you may have some or all of the following rights regarding your personal information:

• Access: the right to request a copy of the personal information we hold about you.
• Correction: the right to request correction of inaccurate or incomplete information.
• Deletion: the right to request deletion of your personal information, subject to certain exceptions.
• Portability: the right to receive a copy of your information in a portable format.
• Opt-Out of Marketing: the right to opt out of receiving marketing communications at any time via the unsubscribe link provided or by contacting us directly.
• Opt-Out of Sale/Sharing/Targeted Advertising: to the extent applicable under laws such as the California Consumer Privacy Act (CCPA/CPRA), the right to opt out of the "sale" or "sharing" of personal information or its use for cross-context behavioral advertising.
• Non-Discrimination: the right not to receive discriminatory treatment for exercising your privacy rights.

How to Exercise Your Rights

Submit a request to info@toxicailabs.com. If your request concerns data held by us on behalf of a portfolio brand as a processor/service provider, we may direct your request to that brand or assist the brand in responding, consistent with our contractual obligations and applicable law. We will verify your identity before fulfilling applicable requests.

Authorized Agents

You may designate an authorized agent to submit requests on your behalf, subject to our ability to verify the agent's authority and your identity.

Response Time

We will respond to verifiable requests within the timeframe required by applicable law (e.g., generally 45 days under the CCPA, extendable as permitted).

8.1 Nevada Residents

Nevada law permits residents to opt out of certain sales of "covered information" as defined under Nevada Revised Statutes Chapter 603A. We do not currently sell covered information as defined under Nevada law; you may still submit a request to info@toxicailabs.com.

8.2 California Residents

If you are a California resident, please see Section 8 above regarding your CCPA/CPRA rights. In the preceding 12 months, we may have collected the categories of personal information described in Section 3 for the business purposes described in Section 4. We have not sold personal information for monetary consideration; certain third-party integrations described in Section 5 may constitute "sharing" for cross-context behavioral advertising purposes, which you may opt out of by contacting us.

8.3 Other Jurisdictions

If you are located in the European Economic Area, United Kingdom, Canada, or another jurisdiction with its own data protection framework, you may have additional or different rights under applicable law (such as the GDPR or PIPEDA). Contact us at info@toxicailabs.com to make a request, and we will respond in accordance with applicable law.

We and our service providers use cookies, web beacons, pixels, and similar technologies to operate and improve the Services, remember preferences, analyze usage, and support marketing and advertising features within Orbit and our websites. You can control cookies through your browser settings; disabling cookies may affect the functionality of the Services. Where required by applicable law, we will present a cookie consent banner allowing you to manage preferences.

We implement commercially reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, disclosure, alteration, or destruction. These measures include access controls, encryption in transit, and routine security assessments. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

We are based in the United States, and information we collect is processed and stored in the United States and other jurisdictions where our service providers operate. If you access the Services from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States and other countries, which may have data protection laws different from those in your jurisdiction. Where required, we implement appropriate safeguards for such transfers (such as standard contractual clauses).

The Services are not directed to individuals under the age of 18, and we do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child under 18, we will take steps to delete such information promptly. If you believe we have collected information from a child, please contact us at info@toxicailabs.com.

The Services may contain links to third-party websites or allow integration with third-party platforms (e.g., social media networks, payment processors). This Privacy Policy does not apply to those third parties, and we encourage you to review their privacy policies before providing information to them.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the revised policy with an updated "Last Updated" date and, for material changes, provide additional notice as required by applicable law (such as through the Services or by email). Your continued use of the Services after the effective date of the revised policy constitutes acceptance of the changes.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: