Privacy Policy

§ Who We Are

Orbit Prism Studio is an artificial-intelligence consultancy based in Toronto, Canada, providing AI workflow automation, custom AI hardware, IoT design and development, AI upskilling, and related professional services. For the purposes of applicable data-protection laws, Orbit Prism is the "data controller" responsible for personal information processed through our website and the "data processor" for personal information we handle on behalf of our clients under a written services agreement.

01 Information We Collect

We collect information in the following ways:

Information you provide to us

• Contact & identity data — your name, email address, phone number, company, role, and country when you complete a contact form, book a session, or email us.
• Project information — details you share about your business, workflows, systems, and the work you'd like us to perform.
• Communications — the content of messages, calls, and correspondence you exchange with us.

Information collected automatically

• Usage data — pages viewed, links clicked, time spent, and referring URLs.
• Device & technical data — IP address, browser type, operating system, and device identifiers.
• Cookies & similar technologies — as described in Section 6.

Information from third parties

• Scheduling & embedded services — when you book a call through our embedded scheduling provider, that provider shares the booking details you submit with us.
• Analytics & advertising partners — aggregated or pseudonymized data about how visitors find and use our website.

02 How We Use Your Information

We use personal information to:

• Provide, operate, and improve our website and services;
• Respond to your inquiries, schedule consultations, and deliver the work you engage us to perform;
• Send administrative messages, service updates, and — where you have opted in — marketing communications;
• Understand how our website is used so we can improve it;
• Detect, prevent, and address security incidents, fraud, and technical issues; and
• Comply with our legal and contractual obligations.

03 Legal Bases for Processing

Where the GDPR or similar laws apply, we rely on the following legal bases to process your personal information:

• Contract — to take steps at your request before entering into, and to perform, a contract with you.
• Legitimate interests — to operate and secure our business, communicate with prospects, and improve our services, provided those interests are not overridden by your rights.
• Consent — for marketing communications and non-essential cookies, which you may withdraw at any time.
• Legal obligation — to comply with applicable laws and regulatory requirements.

04 Sharing & Disclosure

We do not sell your personal information. We share it only in the following limited circumstances:

• Service providers — vendors who perform services on our behalf (e.g. hosting, scheduling, email, analytics) under contractual confidentiality and data-protection obligations.
• Professional advisers — lawyers, accountants, and auditors where reasonably necessary.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.
• Legal requirements — where required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Orbit Prism, our clients, or others.

05 AI & Client Data

When we build AI automations, hardware, or IoT systems for a client, we process data on that client's behalf strictly to deliver the engagement. The following principles apply:

• Client data is used only to scope, build, test, and operate the agreed solution.
• We do not use a client's confidential or proprietary data to train models for other clients.
• Where our solutions run on-device or on-premise, data may never leave the client's own environment.
• On project completion, ownership of the delivered code, configurations, and automations transfers to the client, and we return or securely delete client data in accordance with the engagement agreement.

06 Cookies & Tracking Technologies

We use cookies and similar technologies to operate our website, remember your preferences, and understand site usage. These fall into the following categories:

• Strictly necessary — required for the website to function.
• Performance & analytics — help us measure and improve site performance.
• Functional — remember choices you make.

You can control or disable cookies through your browser settings. Disabling some cookies may affect how the website functions.

07 Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described in this policy, including to satisfy legal, accounting, or reporting requirements. When information is no longer needed, we securely delete or anonymize it. Retention periods vary based on the nature of the information and the context in which it was collected.

08 Security

We implement appropriate technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit, access controls, and secure infrastructure. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

09 Your Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Request deletion of your personal information;
• Object to or restrict certain processing;
• Request portability of information you provided to us;
• Withdraw consent where processing is based on consent; and
• Lodge a complaint with a supervisory authority or, in Canada, the Office of the Privacy Commissioner.

To exercise any of these rights, contact us using the details in Section 13. We will respond within the timeframe required by applicable law.

10 International Data Transfers

Orbit Prism is based in Canada and may process information in Canada and other countries where we or our service providers operate. Where we transfer personal information across borders, we take steps to ensure it receives an adequate level of protection, including through appropriate safeguards such as standard contractual clauses where required.

11 Children's Privacy

Our website and services are intended for businesses and individuals aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.

12 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be communicated through our website or by other appropriate means. We encourage you to review this policy periodically.

13 Contact Us

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us: