Privacy Policy

We collect personal information only when you actively provide it, primarily through contact or sign-up forms. This may include:

• Your name and email address
• Your company name and role
• The content of your enquiry or message
• Target scope details and IP ranges (for assessment configuration)

We do not collect sensitive information (such as health information, financial details, or government identifiers) via our website forms.

We use the information you provide to:

• Respond to your enquiry and onboard you to our platform
• Deliver the security assessment services you requested
• Send transactional communications related to your account
• Communicate about product updates if you have indicated interest

We will not use your information for unrelated marketing without your consent. We will not sell, rent, or trade your personal information to third parties.

CyberOrbit uses AI language models to generate assessment findings summaries, plain-English explanations, remediation recommendations, and attack scenario analysis. This processing occurs during report generation and is used solely to improve the clarity and usefulness of your security assessment report.

AI providers process data as sub-processors on our behalf under their own data processing agreements. Key providers include:

• Anthropic (Claude) : used for AI-generated report content. See anthropic.com/privacy.

We use the following third-party services to operate our platform:

• Railway: website hosting and infrastructure
• PostgreSQL / Redis : data storage and job queuing
• Anthropic: AI-generated report content
• PostHog: anonymised usage analytics
• Stripe: payment processing
• Google Workspace (Gmail) : transactional email delivery

Each provider has their own privacy policy. We select providers who process data only as needed to deliver their services.

Our website uses PostHog analytics configured to anonymise IP addresses. We do not use advertising cookies or cross-site tracking. You can disable cookies in your browser settings, though this may affect some functionality.

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure. Infrastructure is hosted on Railway, with data processed in Australia or the United States depending on the service provider.

We retain information for as long as reasonably necessary to manage the business relationship or as required by law. If you request deletion of your information, we will do so promptly subject to any legal obligations.

Under the Australian Privacy Act 1988, you have the right to:

• Request access to the personal information we hold about you
• Request that we correct information that is inaccurate, out-of-date, or incomplete
• Request that we delete your personal information (subject to legal obligations)
• Make a complaint about how we have handled your personal information

To exercise any of these rights, use the legal inquiry form at the bottom of this page. We will respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

We may update this Privacy Policy from time to time. When we do, we will update the 'Last updated' date at the top of this page. Continued use of our website after changes are posted constitutes your acceptance of the updated policy.

For any privacy-related questions or requests, use the legal inquiry form at the bottom of this page.