Privacy Policy

2. Who we are

Orabo is operated by:

In this policy "we", "us", and "our" mean Oraboss Technologies LLC. We are the controller of the personal data described below, which means we decide why and how it is processed. You can reach our privacy contact at privacy@orabo.app.

3. What data we collect

We collect the following categories of data. These categories are drawn from a live inventory of our databases, so each one maps to data we actually hold.

• Account data: your email address, name, country of origin, and target country, held in your profile so we can run your account and personalise our tools.
• Profile customisation: your saved preferences, journey state, and quiz results. You control this data and can change or clear it from your dashboard.
• Eligibility and assessment inputs: the form answers you submit to our tools, including the EB-1A, EB-2 NIW, O-1A, UK Global Talent, CV, and statement-of-purpose tools. This is the material used to generate your documents.
• Purchase records: the item you bought, the amount, and the timestamp, held so we can confirm entitlements and meet our accounting obligations.
• Optional community content: if you choose to submit a success story or an opportunity, we collect the submitter name, email, and phone number you provide.
• Optional rewards data: if you join the Post and Earn programme, we hold your email, phone number, and payout totals.
• Usage analytics: session-level pageview data that is pseudonymous. It has no key that links it back to your account, so we cannot tie it to you as an individual.
• Communications: the transactional emails we send you (such as receipts and document delivery) and, only if you opt in, our newsletter.

Two tables in our system, used for a budget tracker and a timeline planner, are part of the schema but currently hold no data. They are out of scope until the features that use them launch, at which point this policy will be updated.

4. How we use your data

We use your data only for purposes you would expect from a service like ours:

• To deliver the service: running your account, saving your progress, and showing you the right tools.
• To generate your AI outputs: the EB-1A, EB-2 NIW, O-1A, and UK Global Talent assessments, CV and statement-of-purpose documents, document checklists, and readiness reports.
• To process payments and confirm what you have bought.
• To send transactional email, such as receipts and the documents you have paid for.
• To send our newsletter, but only if you have opted in, and you can unsubscribe at any time.
• To improve the product, using aggregate and pseudonymous usage data rather than your personal answers.

5. Who we share data with

We share data only with the processors that help us run Orabo. Each one is bound by a contract that limits what it can do with your data. We do not sell your data to anyone.

Anthropic, PBC provides the Claude AI models that generate your assessments and documents. See section 6 for the detail on AI processing. Anthropic privacy policy.

Stripe, Inc. processes payments and subscriptions. Orabo never sees or stores your card number. Stripe privacy policy.

Brevo SAS sends our transactional and marketing email. It holds the email address, name, and the attributes needed to reach you. Brevo privacy policy.

Cloudflare, Inc. serves the site through its content delivery network, runs our edge functions, and provides privacy-friendly web analytics. Cloudflare privacy policy.

PostHog, Inc. provides product analytics from its European Union instance (eu.posthog.com). IP collection is disabled, Do Not Track is respected, and the data is never used for marketing or advertising. PostHog privacy policy.

Supabase hosts our databases and handles authentication. Supabase privacy policy.

Google LLC distributes our app through Google Play, where that applies to you. Google privacy policy.

6. AI processing

The heart of Orabo is AI-generated guidance, so we are specific about how it works. When you use an AI tool, the answers you provide are sent to Anthropic, PBC, which runs the Claude models on our behalf. This processing takes place in the United States.

Anthropic retains the inputs and outputs for up to 30 days for safety and abuse monitoring, after which they are deleted. Anthropic does not use your data to train its models. The models in production use today are claude-sonnet-4-6, for petition generation, assessment scoring, and CV and statement-of-purpose outputs, and claude-haiku-4-5, for digest summarisation.

Looking ahead, an AI news contextualiser is in development for the Pro tier. When it launches it will use the same Anthropic API under the same 30-day retention limit and the same no-training guarantee.

If you would rather not send any input to an AI processor, you can use the free, non-AI parts of Orabo, such as the discovery pages and comparison tools, without your data reaching Anthropic. You can read more in the Anthropic privacy policy and the Anthropic acceptable use policy.

7. How long we keep your data

• Active accounts: we keep your data for as long as your account exists.
• Deleted accounts: when you delete your account there is a 14-day soft-delete window, after which we permanently purge the personal identifiers.
• Financial records: purchase and rewards records are anonymised when you delete your account. The anonymised records are kept for 7 years to meet tax obligations, then purged.
• Approved community content: if a story or opportunity you submitted has been published, your identifying details are anonymised on account deletion, while the published content itself remains as community content.
• Pending community submissions: anything you submitted that was not yet published is permanently deleted on account deletion.
• Anonymous analytics: pseudonymous session data is kept as aggregates indefinitely. It cannot be linked back to a deleted account.

8. Your rights

Wherever you live, you have the following rights over your data.

• Access: you can ask for a copy of the data we hold about you, available through the "Download my data" control in your dashboard privacy settings.
• Portability: you can take that copy in a structured, machine-readable format, also from the "Download my data" control.
• Erasure: you can delete your account and personal data through the "Delete my account" control in your dashboard privacy settings.
• Correction: you can correct inaccurate data from your profile, or by writing to us.
• Restriction: you can ask us to pause certain processing while a query is resolved, by writing to us.
• Objection: you can object to processing based on our legitimate interests, by writing to us.
• Complaint: you can complain to your local supervisory authority, listed by region in section 9.

To exercise any right that is not covered by a dashboard control, email privacy@orabo.app.

9. Your rights by region

The law that protects you depends on where you live. The rights in section 8 apply to everyone. The summary below names the framework and the authority you can complain to in your region. We treat every region with equal seriousness.

9.1 Nigeria

Your data is protected by the Nigeria Data Protection Act 2023. The supervisory authority is the Nigeria Data Protection Commission (NDPC). Any fee we may charge for a data subject access request is capped at the statutory limit.

9.2 Kenya

Your data is protected by the Kenya Data Protection Act 2019. The supervisory authority is the Office of the Data Protection Commissioner (ODPC).

9.3 Ghana

Your data is protected by the Ghana Data Protection Act 2012. The supervisory authority is the Data Protection Commission.

9.4 South Africa

Your data is protected by the Protection of Personal Information Act (POPIA). You may lodge a complaint with the Information Regulator.

9.5 Cameroon

Your data is protected by Law No. 2010/012 on Cybersecurity and Cybercrime together with sectoral protections. Oversight sits with the National Agency for Information and Communication Technologies (ANTIC).

9.6 European Union and EEA

Your data is protected by the General Data Protection Regulation (GDPR). Your supervisory authority is the data protection authority of your member state.

9.7 United Kingdom

Your data is protected by the UK GDPR. The supervisory authority is the Information Commissioner's Office (ICO).

9.8 Brazil

Your data is protected by the Lei Geral de Proteção de Dados (LGPD). The supervisory authority is the Autoridade Nacional de Proteção de Dados (ANPD).

9.9 California

Your data is protected by the California Consumer Privacy Act, as amended by the CPRA. The supervisory authority is the California Privacy Protection Agency.

9.10 Other regions

If you live elsewhere, you may have additional rights under your local law. Contact us and we will help you exercise them.

10. Cookies

We use cookies and similar technologies in three categories: essential cookies needed for sign-in and sessions, analytics cookies that help us understand pseudonymous usage, and marketing cookies used only with your consent. You can manage your choices through the Cookie Settings control reached from the footer. The cookie banner itself is the place to review and change each category in detail.

11. International transfers

Your data is processed in the United States, where our database region (Supabase, us-west-2) and Anthropic are based, and in the European Union, where Brevo is based. When data moves across borders we rely on standard contractual clauses or equivalent safeguards to keep your protection in place.

12. Children

Orabo is not intended for anyone under 18. We do not knowingly collect data from minors. If we discover that an account belongs to a minor, we delete it.

13. Changes to this policy

We may update this policy as our service and the law evolve. When we make a material change, we notify active subscribers by email.

14. Contact

For any privacy question or request, email privacy@orabo.app, or write to us at:

We aim to respond within 30 days of receiving your request.