Privacy Policy
Effective date: 22 June 2026 · Last updated: 22 June 2026 · Version 1.4
This policy explains how Ortopylot handles personal information when you visit ortopylot.com, contact us through the website form, engage the brand-foundation setup service, or use the separate legacy assessment tool at assess.ortopylot.com. It is written to comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), and to give visitors from the EU, the UK, and the United States the rights they would expect under their own privacy laws.
If anything in this policy is unclear, contact us through the contact form on our website.
1. Who we are
Ortopylot is an Australian business operating from Western Australia. It provides a one-off brand-foundation setup service that puts a company's brand into the documents its team produces with Claude. It also operates a separate, legacy commercial-assessment tool at assess.ortopylot.com, which is no longer promoted but remains live and is covered by this policy.
Business details:
• Business name: Ortopylot
• Legal entity: Gary Douglas, sole trader, trading as Ortopylot
• ABN: 77 692 744 053
• Operating from: Perth, Western Australia
• Contact: the contact form on our website
If you are visiting from the EU or the UK, Ortopylot acts as the "data controller" for the personal information described in this policy. Ortopylot does not have a designated EU representative because it does not target the EU market as its primary audience, but it will respond to requests from EU and UK visitors under the rights set out in section 10.
2. Who this policy applies to
This policy applies to anyone who:
• Visits ortopylot.com
• Contacts us through the website form
• Engages the brand-foundation setup service
• Submits a business idea into the legacy assessment tool
• Otherwise interacts with the website or its tools
It applies regardless of where you are located. We extend GDPR-style rights to visitors from the EU and the UK, and CCPA-style rights to visitors from California, even though the Australian Privacy Act is our primary obligation.
3. What we collect and why
We collect only what we need to run the site, answer your enquiry, deliver the service, and meet our legal obligations.
The website contact form. When you fill in the contact form, we collect your name, email, company, and your message. The form is delivered to us so we can reply and discuss working together. We use these details only to respond to your enquiry and to provide the setup service if you engage us. We do not add you to a marketing email list from this form unless you separately opt in.
Brand material for the setup service. If you engage the setup service, you give us the brand material we need to build your foundation, such as brand guidelines, logos, written content, and examples of your documents. We use this only to build, install, and support your foundation, and we keep it confidential. Building the foundation involves processing some of this material with Claude, made by Anthropic, as described in section 4.
The legacy assessment. When you use the assessment tool at assess.ortopylot.com, you type a description of your business idea, and you may include a website address. This text is the input the AI model uses to generate your assessment. We store it so we can produce and, where you provide an email, send your result. We do not use it for anything else.
Technical data. When you visit the site, our systems automatically collect basic technical information: your IP address, your browser type, your device type, the pages you view, the time of your visit, and similar information. We use this for security, to prevent abuse, to monitor site performance, and to understand how visitors use the site.
Email engagement data. If you opt in to receive updates from us, our email platform records whether you opened an email, which links you clicked, and similar engagement signals. We use this to understand what is useful and to remove people from lists who are not interested.
Information you give us directly. If you reply to an email, send us a message, or otherwise contact us, we keep that correspondence so we can respond.
We do not collect sensitive information (as defined under the Privacy Act) such as health data, racial or ethnic origin, religious beliefs, or sexual orientation. If you choose to include sensitive information in what you send us, we will handle it under this policy, but we do not request it and recommend you do not provide it.
4. How we use Claude (Anthropic)
This section is important. Read it before you submit material to us or to the assessment.
To build your brand foundation, and to generate the legacy assessment, we process text with Claude, the AI model made by Anthropic.
What this means in practical terms:
• The material being processed leaves our systems and is processed by Anthropic, primarily in the United States.
• Anthropic is a separate company with its own privacy and data-handling commitments.
• For the setup service, we use Anthropic's commercial Claude for Work and API services, under terms where Anthropic acts as a data processor and does not use the material to train its models by default.
• For the legacy assessment, the input is processed through the Anthropic API, which by default does not use API inputs to train its models.
• An AI model generates output automatically. We may review or sample output internally for quality and safety.
You can read Anthropic's privacy policy at https://www.anthropic.com/legal/privacy.
If you do not want your material processed by a third-party AI model, do not submit it.
5. The legal basis for processing your information
If you are in the EU or the UK, the General Data Protection Regulation (GDPR) requires us to tell you the legal basis on which we process your personal information. The bases we rely on are:
Contract. When you engage the setup service, we process your information to deliver what you have paid for. The legal basis is the contract between you and us.
Consent. When you opt in to receive updates, the legal basis is your consent. You can withdraw it at any time by using the unsubscribe link in any email or by contacting us.
Legitimate interests. We process technical data (IP address, browser type, and similar) for security, abuse prevention, and basic site analytics. The legal basis is our legitimate interest in operating a secure, functional website. You can object to this processing, although doing so may limit your ability to use the site.
Legal obligation. We retain certain records, such as payment and tax records, to meet our accounting and other legal obligations.
For visitors outside the EU and the UK, we rely on equivalent legal bases under the relevant local law.
6. Who we share your information with
We share personal information with the service providers below, each of whom processes the information on our behalf and under their own privacy policy. Most are based outside Australia.
Anthropic (https://www.anthropic.com/legal/privacy). Purpose: processes text with Claude to build the brand foundation and to generate the legacy assessment. Data shared: the brand material or assessment input being processed. Location: United States.
Framer (https://www.framer.com/legal/privacy/). Purpose: hosts the ortopylot.com website. Data shared: your IP address, browser type, and technical request data when you visit the site. Location: Netherlands, with global infrastructure.
Cloudflare (https://www.cloudflare.com/privacypolicy/). Purpose: provides bot protection, security, and content delivery. Data shared: your IP address, browser type, and request data. Location: United States, with global presence.
Klaviyo (https://www.klaviyo.com/legal/privacy/privacy-notice). Purpose: holds your email address and sends updates, if you opt in, and records email engagement. Data shared: your email, your name if provided, and engagement signals. Location: United States.
For the legacy assessment only, we also use Supabase (https://supabase.com/privacy), to store the assessment input and result, with its primary database region in Sydney, Australia, and Vercel (https://vercel.com/legal/privacy-policy), to run the backend functions, in the United States with a global edge network.
We do not sell your personal information. We do not share it with advertisers. We do not share it with anyone else except where required by law, where we need to defend a legal claim, or where you have given us permission.
7. International transfers of personal information
Most of the service providers listed above are located outside Australia, primarily in the United States. When we share your personal information with them, that information is transferred overseas.
Under the Australian Privacy Principles (APP 8), we take reasonable steps to ensure that overseas recipients do not breach the APPs. We do this by using providers who offer contractual data-protection commitments and who are widely used by Australian businesses for similar purposes.
For visitors in the EU and the UK, transfers of your personal information to the United States are protected by Standard Contractual Clauses or equivalent transfer mechanisms entered into with each provider, in line with GDPR Articles 44 to 49.
By using the Ortopylot website or services, you acknowledge that your personal information will be processed in the locations listed in section 6.
8. How long we keep your information
We keep your personal information only for as long as we need it.
• Enquiries and correspondence: retained for as long as needed to handle the matter and for a reasonable period afterwards.
• Brand material for the setup service: retained for as long as you have an active relationship with Ortopylot, or until you ask us to delete it, subject to any legal requirement that we keep it.
• Assessment input and output: retained for as long as you have an active relationship with Ortopylot, or until you ask us to delete it.
• Email address and engagement data: retained for as long as you remain subscribed. If you unsubscribe, we keep a suppression record (your email address only) so we can honour your request and not contact you again.
• Payment and tax records: retained for at least seven years to meet Australian tax and accounting requirements.
• Technical and security logs: retained for up to 90 days unless we need them longer for a specific security investigation.
You can ask us to delete your personal information at any time. See section 10 for how to make a request.
9. How we keep your information secure
We take reasonable steps to protect your personal information from loss, misuse, and unauthorised access, modification, or disclosure. These steps include:
• Encryption of data in transit (HTTPS across the site)
• Access controls limiting who can see personal information
• Bot protection to prevent abuse
• Regular review of our service providers' security commitments
• Secure handling of credentials
No method of transmission over the internet or storage is completely secure. We cannot guarantee absolute security, but we take the risk seriously and respond promptly to any incident.
If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
10. Your rights
You have rights over your personal information. These rights vary slightly depending on where you are located, but we apply the strongest set of them to anyone who asks.
Everyone has the right to:
• Access the personal information we hold about you.
• Correct information that is inaccurate or out of date.
• Delete your personal information, subject to any legal requirement that we keep it.
• Withdraw consent to updates by unsubscribing from any email or contacting us.
• Complain to us about how we handle your personal information.
If you are in the EU or the UK, you also have the right to restrict how we process your personal information, object to processing based on legitimate interests, receive your personal information in a portable format, and lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office at https://ico.org.uk).
If you are in California, you also have the right to know what personal information we collect, use, and disclose, delete your personal information, opt out of the sale or sharing of personal information (we do not sell or share personal information for advertising), and not be discriminated against for exercising your rights.
To exercise any of these rights, contact us through the contact form on our website. We will respond within 30 days, or sooner where required by law.
You can also complain to the Office of the Australian Information Commissioner at any time:
• Website: https://www.oaic.gov.au
• Phone: 1300 363 992
11. Cookies and similar technologies
The Ortopylot site uses a small number of cookies and similar technologies. We do not use third-party advertising cookies, and we do not allow third parties to track you across other websites through cookies on our site.
The technologies we do use include essential cookies required for the site to function, security tokens set by Cloudflare to verify that you are a legitimate user and not a bot, and basic analytics to understand how people use the site. We use only privacy-respecting analytics that do not build profiles of individual users.
You can disable cookies in your browser settings. Some parts of the site may not work properly if you do.
12. Children
The Ortopylot service is not directed at children. We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, contact us and we will delete it.
13. Updates and marketing emails
When you opt in to receive updates from Ortopylot, you consent to receive emails from us. Under the Australian Spam Act 2003 we send marketing email only on the basis of your consent, and we keep a record of when and how that consent was given.
You can unsubscribe at any time. Every marketing email contains an unsubscribe link and identifies Ortopylot as the sender, as required by the Australian Spam Act 2003. If you unsubscribe, we will action your request within five business days, as required by the Act, and usually immediately. We may still send messages relating to a service you have engaged or a request you have made.
14. Automated processing and your rights
The legacy assessment tool produces a commercial readiness assessment of your business idea using an AI model. The assessment is generated automatically. It is informational, does not constitute financial, legal, or business advice, and does not make any decision that has legal or similarly significant effects on you.
For transparency about how it works: the input is the business idea text you submit and any website address you include; an AI model (Anthropic's Claude) generates the result; no human reviews it before it appears on screen, although we may sample results internally for quality and safety. The assessment is a structured opinion based on the limited information you provide. It is not a guarantee of success or failure, and the final decision is always yours. If you would like a human to review your result, contact us.
This section meets the spirit of the Australian Privacy Act's automated decision-making transparency requirements (APP 1.7, in effect from 10 December 2026) and Article 22 of the GDPR.
15. Changes to this policy
We may update this policy from time to time. If we make a material change, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or through a notice on the site. We recommend you review this page periodically.
16. How to contact us
For any question or request relating to your personal information, contact:
Ortopylot. Gary Douglas, sole trader, trading as Ortopylot. ABN 77 692 744 053. Operating from Perth, Western Australia. Contact: through the contact form on our website.
We will respond to all reasonable requests as quickly as we can, and in any case within the timeframes set out in this policy or applicable law.
Ortopylot Privacy Policy, Version 1.4, 22 June 2026.
© 2026 Ortopylot. Operating from Perth, Western Australia.