Privacy Policy — Orbi

Last updated: September 2026

Orbi is a CRM and real estate website platform operated by Dabliu Studio Ltda (“Orbi”, “we”), company registration (CNPJ) 35.088.174/0001-32, headquartered in Campina Grande, Paraíba, Brazil. This policy describes how we collect, use, store and protect the personal data processed through our platform, including data obtained through integrations with third-party platforms such as Meta (Facebook and Instagram).

1. Who we are and who this policy applies to

This policy applies to:

• Orbi subscribers (real estate agents and agencies who contract our services);
• Leads and end customers who interact with websites, forms and ads connected to the Orbi platform;
• Visitors of the public websites hosted by Orbi.

2. Data we collect

2.1 Data provided directly

Name, email, phone/WhatsApp, company, real estate license number (CRECI), city/state, password (encrypted) and other information provided at sign-up or in contact forms.

2.2 Data obtained through the Meta (Facebook/Instagram) integration

When a subscriber connects their Meta ad account to the Orbi platform, we automatically collect, exclusively for the leads generated by that subscriber's lead ad forms:

• Name, email and phone number submitted in the lead form (Lead Ads);
• Answers to the form's custom questions;
• Technical identifiers of the ad, form and source page (leadgen_id, form_id, page_id, ad_id), used only to track the lead's origin and correctly attribute the campaign.

This data is obtained through Meta's Webhook and Graph API, upon explicit authorization from the subscriber (the owner of the Page/ad account), granted directly in Meta Business Suite.

2.3 Browsing data

Cookies, IP address, device and pages visited, collected through Google Analytics, Google Tag Manager and Meta Pixel, in order to measure website and campaign performance.

3. Purpose of processing

The data collected — including data obtained through the Meta integration — is used exclusively to:

• Create and organize the lead record in the corresponding subscriber's CRM;
• Automatically distribute the lead to the responsible agent (round-robin mechanism or direct link to a property);
• Allow the subscriber to contact the lead for commercial purposes related to real estate brokerage;
• Measure the origin and performance of the subscriber's own advertising campaigns;
• Comply with applicable legal and regulatory obligations.

We do not use data obtained through Meta for any other purpose, including Orbi's own advertising, training of third-party models, or any use outside the real estate CRM context for which the subscriber authorized access.

4. Data sharing

We do not sell, rent or share personal data with third parties for marketing purposes.

A lead's data is visible only to:

• The subscriber (agency/agent) responsible for the campaign or website that originated that lead;
• The agents on that subscriber's team, according to the permissions configured by the subscriber;
• Service providers strictly necessary to operate the platform (hosting, database, WhatsApp and email delivery), under a contractual confidentiality obligation, and never for those providers' own purposes.

Each Orbi subscriber accesses only their own leads' data — the platform architecture prevents one subscriber from viewing another subscriber's data.

5. Retention and deletion

Data is retained for as long as the relationship between the lead and the subscriber lasts, or until the data subject requests deletion. Data obtained through the Meta integration is processed and stored in our database at the moment the webhook is received — we do not rely on Meta's storage beyond the window needed for the initial capture.

Upon request, personal data is deleted within 15 business days, except where legal retention obligations apply (e.g. tax obligations).

6. Security

We use encryption in transit (HTTPS/TLS) and at rest, access control through authentication, per-subscriber data isolation policies (Row Level Security) and access monitoring. Access tokens for third-party APIs (including Meta) are stored securely and never publicly exposed.

7. Data subject rights (LGPD)

Under the Brazilian General Data Protection Law (Law No. 13.709/2018), the data subject may request at any time:

• Confirmation that processing exists;
• Access to, correction or update of the data;
• Anonymization, blocking or deletion of unnecessary or excessive data;
• Data portability;
• Deletion of data processed based on consent;
• Information about sharing with third parties;
• Withdrawal of consent.

Requests can be made by email: contato@dabliustudio.com.br

8. Integration with the Meta platform

This integration complies with the Meta Platform Terms and the Meta Platform Policies. The use of data obtained through Meta is limited to the purpose declared in this policy and in the permissions requested by our app (leads_retrieval, pages_show_list, pages_read_engagement, ads_management, pages_manage_metadata, business_management), used exclusively to capture and organize lead form leads inside the respective subscriber's CRM.

The subscriber may revoke Orbi's access to their ad account at any time, directly in Meta Business Suite, under Settings → Integrations → Leads Access.

9. Cookies

We use first-party and third-party cookies (Google Analytics, Google Tag Manager, Meta Pixel) to measure traffic and campaign performance. Users can manage cookie preferences in their browser settings.

10. Minors

The Orbi platform is not directed at people under 18 years of age and we do not knowingly collect data from minors.

11. Changes to this policy

This policy may be updated from time to time. The date of the last update is shown at the top of the document. Material changes will be communicated to subscribers.

12. Contact

Dabliu Studio Ltda
Email: contato@dabliustudio.com.br | Website: crmorbi.com
Campina Grande, Paraíba, Brazil