Privacy Policy
Effective 8 November 2026
xMitos is a brand of Smart Stone Technology Pty Ltd (ABN 36 616 831 522) ("we", "us", "our"). This policy explains how we handle personal information on xmitos.ai and diagnose.xmitos.ai (including xmitos.io and fde.smartstone.ai, which lead to the same services), and in the free diagnostic, chat, client portal and related emails. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
1. What we collect
| When | What |
|---|---|
| You complete the free diagnostic | Business name, your email address, optional phone number and company website, and your answers about your business (industry, team size, how work is done, goals). |
| We generate your diagnosis | An AI-written summary and suggestions based on your answers, and scores we calculate from them. |
| You use the chat or the digital advisor | Your name, email and messages. For the video advisor, the audio and video session you choose to join, and its transcript. |
| You become a client | Project details, intake answers, proposals, quotes, contract acceptance details (name and date), milestone and payment status, and files or documents you choose to share with us. |
| You book a meeting | Your name, email and chosen time, handled by Calendly. |
| You pay | Payments are processed by Stripe. We do not see or store your card number. We keep payment references and amounts. |
| You open our links | Where you came from (the campaign or channel in the link, and the referring website's host name), your language choice, and when you first arrived. These are stored in your browser. |
| Our systems run | Basic technical logs kept by our hosting providers: IP address, browser type, pages requested and errors. |
We collect information from you directly. We do not buy contact lists. We do not knowingly collect information from children.
2. Why we use it
To give you the diagnostic and your results; to contact you about it; to prepare proposals and deliver services; to take payment; to answer your questions; to keep our services secure; to improve our services; to meet legal obligations; and, where the law allows and you have not opted out, to send you relevant information about xMitos (see section 7).
3. AI processing
We use artificial intelligence to write diagnoses, suggestions, proposals, drafts and chat replies. The text you enter into the diagnostic, chat or portal may be sent to our AI provider, Anthropic (United States), to produce the response. AI output is a starting point and may contain errors; a person at xMitos reviews anything that is sent to you as a proposal or quote. We do not use your information to train our own models. Under our provider's commercial terms, content sent through its business API is not used to train its models.
4. Who we share it with
We share personal information only with service providers who help us run the services, under their terms, and only as needed:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database | Cloud data centres, which may be outside Australia |
| Vercel | Hosting of the diagnostic site | Global network, including the United States |
| Cloudflare | DNS, security and hosting of the website | Global network |
| Anthropic | AI processing | United States |
| Stripe | Payments | Global, including the United States and Australia |
| Brevo | Email delivery | European Union and other regions |
| Tavus | Video digital advisor | United States |
| Calendly | Meeting booking | United States |
We may also disclose information where required by law, or to our professional advisers. We do not sell personal information.
5. Overseas disclosure
Several providers above store or process information outside Australia, including in the United States and the European Union. We take reasonable steps to make sure they handle it consistently with the Australian Privacy Principles, mainly through their contractual privacy and security commitments. By using the services you understand your information may be handled overseas.
6. Cookies and similar technologies
We use your browser's local storage to remember your language choice and the source of your first visit (for up to 30 days). The staff login uses a session token. We do not use advertising or tracking cookies and do not run third-party web analytics. You can clear this data in your browser at any time.
7. Marketing and email
We contact people who have given us their email address through the diagnostic, chat or a meeting booking. Our messages identify us and include an unsubscribe option. You can unsubscribe at any time or tell us at the address below. We follow the Spam Act 2003 (Cth).
8. Security
We use access controls so that only authorised staff can see client records, encrypted connections for all traffic, and providers with industry-standard security. No system is perfectly secure. If we suspect a serious data breach affecting you, we will assess it and notify you and the Office of the Australian Information Commissioner as the law requires.
9. How long we keep it
Records needed for tax, accounting and legal purposes are kept for at least five years. Other records are kept for as long as they are needed for the purposes in section 2, and are then deleted or de-identified. You can ask us to delete your information at any time (section 10).
10. Your rights
You can ask to access the personal information we hold about you, to correct it, or to delete it where we are not required to keep it. Write to us at the address below. We will respond within a reasonable time, normally 30 days, and may need to confirm your identity.
11. Complaints
Contact us first at the address below. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (www.oaic.gov.au, 1300 363 992).
12. Contact
Privacy contact: [email protected] Smart Stone Technology Pty Ltd, ABN 36 616 831 522, Australia
13. Changes
We may update this policy. The current version is always on our website with its effective date.