Privacy Policy.

Last updated: 21 October 2026 · Provided in English

Orbitrio Pty Ltd ("Orbitrio", "we", "us", "our") operates the Orbitrio website, applications, AI-assisted migration tools, document services and migration-professional workspace. We understand that the information people share about their migration journeys can be personal and sensitive. This policy explains what we collect, why we use it, how AI and our suppliers handle it, where it is processed, and how you can access or delete it.

1. Who is responsible for your information

Orbitrio Pty Ltd is responsible for the personal information it collects and uses to provide Orbitrio's own services. Our contact details are at the end of this policy.

When you separately engage a registered migration agent, Australian legal practitioner or other authorised migration professional ("migration professional"), that professional or practice may be independently responsible for information collected for their professional services. Where we process professional client records on a practice's instructions, we may act as that practice's service provider. Their separate privacy notices, professional obligations and record-retention requirements may also apply.

2. What information we collect

The information we collect depends on the services you choose. It may include:

• Account and contact information: your name, email address, sign-in details, notification choices, language preferences and account settings. For professionals, we may also collect practice details, staff roles and registration information.
• Identity and migration information: date of birth or age, nationality, current location, identity or passport details, migration goals, current and previous visas, refusals, cancellations and travel history where relevant.
• Eligibility and supporting information: education, qualifications, employment and skills history, English-language results, financial information, family circumstances and other details relevant to possible visa pathways.
• Sensitive and family information: details about a partner, child or other family member, and health or criminal-history information, but only where relevant, lawful and subject to any required permissions or consent.
• Your content and our results: assessment answers, uploaded files, photographs, chats, voice recordings and transcripts if you use voice features, document extracts, calculated points, AI explanations, pathway reports, drafts and case notes.
• Payment and technical information: subscription and credit transactions, invoices or billing status, support interactions, device and browser information, approximate location derived from usage, sign-in history, audit events, security records and cookie preferences. Payment-card information may be handled directly by our payment processor rather than stored by Orbitrio.

We receive information from you, your authorised representative, an independent migration professional you have chosen, and your interactions with our services. We also create calculations, summaries and reports from the information supplied. Submitting an assessment or receiving an assessment invitation may create an account associated with your email address.

3. Why we use your information

We use information only for relevant purposes, including to:

• register, authenticate and manage accounts, subscriptions and credits;
• explain possible migration pathways, perform eligibility and points calculations and generate reports;
• read, extract, compare and check documents, identify inconsistencies, and assist with forms and administrative preparation;
• support communications, authorised case sharing, referrals and professional practice workflows;
• provide support, account notifications, security controls, fraud prevention and incident response;
• comply with legal obligations and address complaints or disputes; and
• measure service reliability and feature usage, using less identifiable information where practical.

You may choose not to supply optional information. If information is necessary for a requested feature, leaving it out may limit that feature or make its result less reliable. We do not sell your personal information to data brokers or advertisers or use case documents, visa answers or private chats for unrelated advertising.

Where applicable law requires a legal basis for processing, it may be performance of a requested service or contract, compliance with a legal duty, legitimate interests balanced against your rights, or consent. Sensitive information and information concerning other people may require additional legal conditions or specific consent. Accepting our Terms of Service does not replace consent required for a particular sensitive use or disclosure.

4. How we use AI and automated analysis

Orbitrio uses commercial AI services, including services from OpenAI, Anthropic and Google, where enabled for a feature. These services help us extract and compare documents, transcribe or summarise information, identify inconsistencies, explain possible visa requirements, generate reports and assist users or migration professionals with administrative work.

No AI training on your personal case content. Orbitrio does not use your assessment answers, prompts, documents, chats, audio, case files or identifiable personal information to train or fine-tune Orbitrio AI models. We use selected commercial API products and contractual non-training arrangements under which customer content is not used to train the providers' AI models. We do not opt case content into voluntary provider-training or model-improvement programmes. This commitment applies to our use of customer case content for model training; it does not prevent operational processing necessary to supply the requested service.

We minimise personal information but do not promise full redaction. We limit AI inputs to the information reasonably needed for the specific task. When identifiers are unnecessary, we omit or reduce them where practical. Some tasks, especially document comparisons and checks for inconsistent names, dates, passport details or family information, require personally identifiable information. We may provide those necessary identifiers to the AI system performing the task. We do not represent every AI request as anonymous or fully redacted.

Automated analysis is not a government decision. Orbitrio may use personal information and computer programs to calculate points, evaluate answers against eligibility criteria, produce pathway indicators, identify missing documents, flag discrepancies and select or order information shown to you. These programs may use identity and migration history, qualifications, work experience, language results, family circumstances, assessment answers and supporting evidence. Fully automated results can include preliminary scores, eligibility indicators, inconsistency flags, suggested pathways and follow-up questions. Where a migration professional is involved, that professional may use the same automated outputs as an input to a separate professional assessment. These automated outcomes can influence what options you explore or discuss with a professional, and errors can affect your understanding of your position. They do not themselves approve or refuse a visa, grant migration status, or replace legally required professional judgment. You may ask us to review or correct your underlying data or an output. We provide additional explanation or human review where required by applicable law.

5. Where information is stored and processed

Orbitrio's primary application infrastructure operates in Australian cloud data centres, including Amazon Web Services in Sydney. Our policy is that original case documents, identifiable case records, document extraction and processing involving personally identifiable case content, including LLM workloads that require such content, are stored or processed in Australian cloud regions. We use Australia-hosted model deployments for those identifiable LLM workloads.

For tasks that do not require identifiable case content, contracted non-training AI services may process a limited, minimised input using other regions. Supporting services such as payments, email, technical support, fraud prevention and supplier security monitoring may handle limited account, transaction or operational information in countries outside Australia, including the United States or other countries where the relevant suppliers operate. Where reasonably practicable, we can provide further information about the suppliers and locations relevant to your service.

An Australian inference or application region does not necessarily mean that every supplier's account metadata, technical logs, support access or legally required security records remain in Australia. We assess relevant overseas disclosures and use applicable contractual, organisational and technical safeguards. We do not transfer full raw case documents overseas merely for general-purpose AI model training.

6. Who may receive information

We disclose information where reasonably needed to provide the service, including to hosting, AI, payment, communication, support and security providers operating under appropriate arrangements; staff or contractors with a legitimate need for access; and regulators or other parties where disclosure is legally required or necessary to address fraud, security incidents or legal claims.

Orbitrio also connects customers with independent migration professionals and provides those professionals with practice-management tools and potential client leads. Before sharing your case with a professional at your request, we identify who will receive it and explain the categories of information to be shared. This may include contact details, assessments, reports and specific documents you choose to share. Authorised practice staff may see the cases assigned to them.

A migration professional or practice may keep separately held copies in accordance with their own legal and professional duties. Removing the practice's Orbitrio access or deleting your Orbitrio account cannot necessarily delete records already lawfully held by that independent practice.

7. Family information and children

Orbitrio consumer accounts are intended for adults aged 18 or over. A parent, guardian or other authorised person may submit a child's relevant information for a family migration matter. You should provide another adult's information only if authorised, and should inform them and obtain their consent where required. Please provide only information needed for the requested service.

Where a registered migration agent enters client information into AI-enabled features, the agent or practice is responsible for obtaining any prior client consent required by law or professional rules, including written consent where required.

8. Subscriptions, credits and account retention

Cancelling a subscription is different from deleting your account. Subscription cancellation stops future renewals but does not automatically remove saved information. Credits are handled under a single system: credits added through an initial subscription, a renewal or a separate purchase each expire 12 months after the date they are added to your account. You may use or purchase credits without an active subscription and can access credit-based features while you have sufficient valid credits.

While you have an active paid subscription or unused, unexpired credits, your account and relevant saved case information remain available, subject to any deletion request and applicable law. A failed-payment grace period or temporary billing suspension is governed by our Terms of Service; a temporary recovery window does not itself trigger automatic case deletion.

When you have neither an active subscription nor usable, unexpired credits, an eight-month retention period begins. We preserve your account-linked case material during that period to allow you to return without losing your work. If a subscription is renewed or new valid credits are added before the period ends, normal active-account retention resumes. If neither occurs for eight consecutive months, we begin automatic account deactivation and deletion under the timelines below. We aim to give advance notice before scheduled inactivity deletion where a working contact channel is available. You may ask us to delete your account earlier.

9. Deleting your account

You may request permanent account deletion through the account controls made available to you or by emailing our privacy contact. Once we verify the request, we deactivate account access immediately. We remove account-linked personal case content, including profiles, answers, chats, uploaded documents and reports, from active Orbitrio systems within 30 calendar days after verification. Routine backup copies expire within a further 90 calendar days after deletion from active systems.

If automatic deletion begins following the eight-month inactivity period, the same active-system and backup timetable applies from the start of the deletion process. Once deleted, case information may not be recoverable. Deleting your account also removes access to any remaining credits, which are forfeited under our Terms of Service except where the law provides otherwise.

Certain information may be retained for longer where required for tax, accounting, regulatory compliance, fraud prevention, a genuine legal dispute or a legal hold. Such records are limited to what is necessary, access is restricted and retention is periodically reviewed. Independent migration practices and some suppliers may hold records under separate lawful obligations or operational security schedules. Deleting an Orbitrio account does not itself cancel a separate professional engagement or require a professional to erase records it must lawfully keep.

10. Other retention periods

• Active user case material: kept while necessary for an active subscription, usable credits or the eight-month return period, subject to earlier deletion and lawful exceptions.
• Routine chats and service/security logs: normally retained for up to 12 months where needed for operations or security. Chats saved in a case follow that case's retention rules; verified deletion requests take priority where legally possible.
• Voice recordings: if stored, retained only as long as reasonably needed for transcription or a technical issue, unless a lawful exception applies. Saved transcripts follow the relevant chat or case period.
• Professional workspaces: practice-specific export and deletion arrangements may be set out in a separate agreement. A practice may independently be required to keep its professional files.
• Financial and compliance records: payment, tax, consent, complaint and necessary legal records may be retained for longer periods required by law. Some financial records may need to be kept for seven years.
• AI-provider operational records: technical, abuse-prevention, security or legal records may follow supplier-specific arrangements; those periods can differ from Orbitrio's customer-account deletion schedule.

We take reasonable steps to destroy or de-identify information when it is no longer needed and there is no lawful basis to keep it.

11. Security

We use technical and organisational measures appropriate to the sensitivity of migration records, including access restrictions, role-based permissions for professional workspaces, secure processing, monitoring and controls over service-provider access. Only authorised people who need information for their work should access it. No online system can eliminate every security risk. Where required by applicable law, we notify affected individuals and regulators about eligible data breaches.

12. Cookies, analytics and communications

Essential cookies support sign-in, account security and basic service functions. Before you choose, selected public pages may send limited cookieless analytics signals to Google. If you decline analytics, we stop sending analytics signals; signals already sent cannot be recalled. With your permission, public pages also use an OpenAI advertising measurement pixel and its first-party cookies to measure page views. You can adjust your cookie preferences at any time. Optional analytics are not intended to receive your private visa answers, case documents or chat content. We do not use advertising trackers or screen-session replay tools inside sensitive assessments or professional case workspaces.

Marketing messages are optional, and you can unsubscribe using the mechanism provided in the message. We aim to process marketing opt-outs within five working days. Necessary account, service, security and billing communications may continue.

13. Your privacy choices and rights

You may ask to access or correct your information, delete your account, withdraw optional consent for future processing, change optional case-sharing choices or raise an issue about an automated output. Where applicable, you may also have rights to restrict or object to processing, obtain certain information in a portable format and seek human review of decisions subject to automated-decision protections. Withdrawing consent does not reverse earlier lawful processing.

Please contact support@xponix.ai, identifying your account and briefly explaining your request. Do not send a passport copy or sensitive documents in your first email. We will verify identity through a suitable secure process if required. We aim to acknowledge privacy requests and complaints within three business days and provide a substantive response within 30 calendar days, unless a shorter legal deadline applies. Where EU or UK data-protection law applies, the ordinary response period for rights requests is one month, subject to lawful extensions.

If we cannot fulfil a request, we will explain the reason and how to raise a complaint. Australian privacy complaints may be referred to the Office of the Australian Information Commissioner at oaic.gov.au, generally after you have complained to us and allowed time for a response. Where EU or UK law applies, you may also contact your local supervisory authority or the UK Information Commissioner's Office at ico.org.uk.

14. Changes to this policy

We update this policy as our services, suppliers and legal obligations change. We publish the current version and provide appropriate notice of important changes, seeking fresh consent where required.

15. Contact