Privacy Policy

ilmVault is an AI-powered reading and publishing platform operated by ILMMIND PTY LTD.

In this Privacy Policy:

This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you use ilmVault as a reader, purchaser, creator, publisher, team member or visitor.

We handle personal information in accordance with applicable privacy laws, including the Australian Privacy Principles where they apply. Additional rights may apply depending on where you live.

This Privacy Policy does not form a blanket consent to every use of personal information. Where applicable law requires separate consent, we will request it at the appropriate time.

Our approach to privacy is based on the following principles:

• We collect the information reasonably needed to provide, secure and improve ilmVault.
• We do not sell or rent personal information.
• We do not use personal information for third-party behavioural advertising.
• We do not use your private books, manuscripts, highlights, notes, reflections or AI conversations to train foundation AI models.
• Private books you upload are not made available to other users.
• Private highlights, notes and AI conversations are not shared with creators or publishers.
• You can request access, correction or deletion of your personal information.
• Some information may need to be retained for legal, financial, fraud-prevention, security or contractual reasons.

This Privacy Policy applies when you:

• Visit the ilmVault website;
• Create or use a reader account;
• Upload, purchase, read or organise books;
• Create highlights, notes, tags, reflections or recall cards;
• Use the reading coach, Research Hub or similar AI features;
• Join or participate in a Reading Circle;
• Purchase a subscription, book or AI query package;
• Apply for or use a creator or publisher account;
• Publish or sell books through ilmVault;
• Invite team members, editors or co-authors;
• Contact us for support, privacy enquiries or other purposes; or
• Otherwise interact with ilmVault.

This policy does not govern third-party websites or services that are not controlled by us, even where ilmVault links to them.

The information we collect depends on how you use ilmVault.

4.1 Account and profile information

When you create an account, we may collect:

• Your email address;
• Your display name;
• Your username, where applicable;
• Your profile photograph or image;
• Your account preferences;
• Your language, country or region;
• Your authentication method;
• Records relating to account confirmation, password reset and account security; and
• Information received from a third-party sign-in provider, such as Google, when you choose to use that service.

When you use email and password authentication, authentication credentials are handled through our authentication provider. We do not store passwords in readable form.

4.2 Uploaded books and private content

When you upload an EPUB, PDF or other supported file, we may collect and store:

• The uploaded file;
• Book title, author and publisher information;
• File format, size and upload date;
• Cover image;
• Table of contents and chapter structure;
• Text extracted from the file;
• Document identifiers and storage information;
• Search indexes, text chunks and vector embeddings created from the file; and
• Processing status, errors and other technical metadata.

Uploaded books are private to your account unless you intentionally use a sharing feature that clearly indicates otherwise. You are responsible for ensuring that you have the right to upload and process the content.

4.3 Reading and learning activity

We may collect information about how you use books and reading features, including:

• Books added to your library;
• Reading position and progress;
• Pages, chapters or sections viewed;
• Reading time, sessions and streaks;
• Highlights and highlight colours;
• Notes, tags and annotations;
• Reflections and journal entries;
• Recall-card responses and review activity;
• Saved passages and collections;
• Search queries;
• Export activity;
• Book completion information; and
• Feature usage and preferences.

Some of this information may reveal personal interests, beliefs, opinions or areas of research. We treat it as private account information.

4.4 AI interactions

When you use the reading coach, Research Hub, recall-card generation or another AI feature, we may process:

• Your question, instruction, reflection or response;
• The passage you selected;
• Relevant sections retrieved from a book;
• Relevant highlights, notes or previous interactions;
• Book metadata needed to provide context;
• The AI-generated response;
• The selected coaching lens or mode;
• Feedback you give about a response; and
• Technical information about the request, such as date, model, token usage and processing status.

We may retain AI conversations so they remain available in your account and so we can operate, secure and troubleshoot the feature. We minimise the information sent to AI service providers where reasonably possible. We do not intentionally send your password or complete payment-card details to an AI provider.

4.5 Purchases, subscriptions and billing

When you purchase a subscription, book, bundle or query package, we may collect:

• Your name and contact information;
• Billing country and limited billing information;
• Product, plan and transaction details;
• Purchase date and amount;
• Currency, tax and invoice information;
• Subscription status and renewal date;
• Refund, dispute and chargeback information;
• Payment status;
• Payment-provider customer and transaction identifiers; and
• Limited payment-method information made available by the payment provider, such as card brand, expiry date and final four digits.

Complete payment-card numbers and CVV security codes are processed by our payment provider and are not stored directly by ilmVault.

4.6 Creator and publisher information

If you apply for or use a creator, author or publisher account, we may collect:

• Your legal name, pen name and display name;
• Email address, telephone number and business contact details;
• Organisation or publisher name;
• Business registration and tax information;
• Country of residence or business;
• Creator biography, photograph, logo and storefront details;
• Website and social-media information you provide;
• Information about your publishing rights and authority;
• Creator application and verification information;
• Identity, bank-account and payout verification status provided through our payment provider;
• Books, manuscripts, covers, descriptions, previews and other publishing material;
• Book prices, coupons, bundles and promotions;
• Sales, revenue, commission, refund and payout information;
• Creator subscription and billing information;
• Team-member, editor and co-author invitations;
• Communications with our creator-support or review teams; and
• Information relating to content reviews, complaints, rights claims, suspensions or investigations.

Our payment provider may collect additional identity, financial and tax information directly from creators for identity verification and payouts. That provider handles such information under its own privacy terms.

4.7 Bookstore and public information

Certain information is intended to be publicly displayed when a creator publishes content, including:

• Creator, author or publisher name;
• Pen name;
• Creator photograph, logo or biography;
• Storefront information;
• Book title, author, description and cover;
• Book category, price and publication information;
• Samples or previews;
• Public ratings, reviews or comments, where supported; and
• Other information the creator chooses to publish.

Information made public may be viewed, copied or indexed by other users and search engines. Removing it from ilmVault may not remove copies previously made or independently indexed by others.

4.8 Reading Circles and social features

If you join or participate in a Reading Circle or another collaborative feature, we may collect and display to relevant participants:

• Your display name and profile image;
• Circle membership;
• Messages, comments and discussion posts;
• Highlights, notes or passages you intentionally share;
• Reactions and responses;
• Reading progress or activity you choose to share; and
• Content submitted to an AI facilitator within the circle.

We do not share private highlights, notes, reading activity or AI conversations with a Reading Circle unless you deliberately share them or the feature clearly explains that they will be shared. Circle owners or administrators may be able to manage membership and view information necessary to administer the circle.

4.9 Creator engagement analytics

We may provide creators or publishers with aggregated or de-identified information about how readers engage with their published books, such as:

• Number of active readers;
• Overall completion rates;
• Chapter-level reading patterns;
• Average reading-session information;
• Aggregate highlight counts or density;
• Aggregate AI-coaching session counts; and
• General engagement trends.

We do not provide creators with the text of an individual reader's private highlights, notes, reflections or AI conversations. We also do not identify individual readers to creators through engagement analytics unless the reader has clearly chosen to participate in an identified community, course, organisational library or similar feature and has been informed of that sharing.

4.10 Technical and usage information

When you access ilmVault, we may automatically collect:

• Internet Protocol address;
• Browser and device type;
• Operating system;
• Language and time-zone settings;
• Pages or screens viewed;
• Referring page;
• Date and time of access;
• Session information;
• Device and application identifiers;
• Network and approximate location information derived from an IP address;
• Error, performance and diagnostic information;
• Security events and login attempts; and
• Records of interactions with platform features.

We use this information to provide the Service, diagnose problems, protect accounts, prevent abuse and understand how ilmVault performs.

4.11 Communications and support

When you contact us, we may collect:

• Your name and contact information;
• The content of your message;
• Attachments or screenshots you provide;
• Account and transaction details needed to assist you;
• Support history; and
• Records of how your enquiry or complaint was handled.

Please avoid sending sensitive or unnecessary personal information through support channels.

4.12 Information collected from third parties

We may receive information from:

• Authentication providers when you use social or federated sign-in;
• Payment providers regarding payments, subscriptions, verification and payouts;
• Creators, publishers or organisation administrators who invite you to an account, team, library or Reading Circle;
• Service providers that assist with fraud prevention, security or infrastructure;
• Public sources in connection with creator or rights verification; and
• Other users where they report content, conduct or a suspected violation.

5.1 Provide and operate ilmVault

This includes creating and authenticating accounts; storing and displaying books; synchronising reading progress; saving highlights, notes and preferences; operating search, recall and reinforcement features; providing the reading coach and Research Hub; operating Reading Circles; processing purchases and subscriptions; operating creator storefronts and publishing tools; delivering purchased books; processing creator payouts; and providing account and customer support.

5.2 Provide AI features

We use relevant book content and user instructions to retrieve relevant passages; generate coaching questions and responses; explain or analyse selected content; support reflection and critical thinking; generate recall cards and review prompts; search across a user's library; and facilitate Reading Circle discussions where requested.

5.3 Communicate with you

We may send account verification and security messages; password-reset communications; purchase and subscription confirmations; receipts, invoices and payout information; service and policy updates; reading reminders or recall-card notifications you enable; creator application and content-review updates; support responses; and marketing communications where you have consented or where otherwise permitted by law.

You can unsubscribe from marketing communications using the unsubscribe link in the message. You may continue to receive essential service, transactional and security communications.

5.4 Process payments and prevent fraud

We may use information to process and reconcile payments; manage subscriptions and renewals; issue refunds; process creator payouts; calculate commissions and taxes; investigate payment disputes and chargebacks; detect fraudulent or unauthorised transactions; and meet accounting and financial-record obligations.

5.5 Maintain security and enforce our terms

We may use information to protect user accounts and platform systems; detect suspicious logins, abuse, malware and unauthorised activity; investigate complaints or suspected violations; moderate published and shared content; enforce our Terms of Service and Creator Publishing Agreement; protect intellectual property and other legal rights; and respond to lawful requests and prevent harm.

5.6 Improve ilmVault

We may analyse product usage to identify technical problems; measure performance and reliability; understand which features are useful; improve accessibility and user experience; plan new features; and produce aggregated or de-identified statistics. Where reasonably possible, we use aggregated or de-identified information for product analysis.

We do not use private books, manuscripts, highlights, notes, reflections or AI conversations to train foundation AI models.

5.7 Meet legal and regulatory obligations

We may process information to maintain financial, tax and company records; respond to courts, regulators and law-enforcement authorities; handle privacy, consumer, copyright and other legal claims; establish, exercise or defend legal rights; and meet other obligations imposed by law.

Where the European Union General Data Protection Regulation, United Kingdom GDPR or similar law applies, we rely on one or more of the following legal bases.

Performance of a contract

We process information where necessary to provide the Service you requested, including account management, reading features, AI features, purchases, subscriptions, creator services and payouts.

Legitimate interests

We may process information where necessary for legitimate business interests, including securing ilmVault; preventing fraud and abuse; troubleshooting and improving the Service; understanding platform performance; enforcing our agreements; protecting users and legal rights; and communicating about the Service. We consider the potential impact on your rights before relying on legitimate interests.

Consent

We rely on consent where required, including for certain marketing communications, optional cookies or particular information-sharing features. You may withdraw consent at any time. Withdrawal does not affect processing carried out before consent was withdrawn.

Legal obligation

We process information where necessary to comply with tax, accounting, company, consumer, privacy or other legal requirements.

Legal claims and vital interests

In limited circumstances, we may process information to establish, exercise or defend legal claims, protect a person's safety or respond to an emergency.

7.1 How AI processing works

ilmVault may retrieve relevant text from your books, highlights or notes and send the information needed to a third-party AI service provider to generate a response. Depending on the feature, the information processed may include a passage selected by you; relevant text retrieved from the same book; relevant text retrieved from other books in your library; your question, instruction or reflection; relevant highlights or notes; previous messages needed to maintain the conversation; and limited metadata required to operate the feature.

We seek to limit AI requests to information relevant to the requested function. The AI service providers we use are listed on our Subprocessors page.

7.2 No foundation-model training

We do not use your private books, manuscripts, highlights, notes, reflections or AI conversations to train our own foundation model. We use commercial AI services under terms intended for business or API customers. We do not authorise those providers to use ilmVault customer content to train their general foundation models. AI providers may temporarily retain or process request data for service delivery, security and abuse prevention in accordance with their applicable commercial terms and our configuration.

7.3 AI output

AI-generated responses may be inaccurate, incomplete or unsuitable. They should not be treated as professional medical, legal, financial or other expert advice. The reading coach is intended to support reading and thinking. It is not used to make decisions that produce legal or similarly significant effects about users.

7.4 Published books

Books published through the creator platform may be indexed and processed to provide AI-supported reading features to authorised readers. Published content is not used to train general foundation AI models unless the creator gives separate, explicit permission under a distinct agreement.

8.1 Service providers

We use third-party providers to operate ilmVault. These providers fall into categories including cloud hosting and application infrastructure; database services; authentication; file and object storage; content delivery and network security; AI generation and embedding services; vector search and indexing; payment processing and creator payouts; identity and fraud verification; email delivery; background-job processing; customer support; error monitoring and diagnostics; and professional legal, accounting or advisory services.

Providers are given only the information reasonably necessary for their function. We seek to use contractual, security and organisational safeguards appropriate to the service and applicable law.

8.2 Named subprocessors

A current list of the specific third-party providers (subprocessors) we use to operate ilmVault — including their function and the categories of information they may process — is maintained at ilmvault.ai/subprocessors. We may add, replace or remove subprocessors as the Service evolves.

8.3 Creators and publishers

We may provide creators and publishers with sales and transaction information relating to their books; information required to administer refunds or rights claims; aggregated or de-identified reader-engagement analytics; and information a reader has intentionally made public or shared with that creator. We do not provide creators with private reader highlights, notes, reflections or AI conversation text.

8.4 Reading Circles and collaborative features

Information you intentionally post or share in a Reading Circle may be disclosed to other members, administrators or invited participants. The feature will indicate when information is shared rather than private.

8.5 Organisation or team administrators

If your account is provided or managed by an organisation, publisher, educational institution or team, the administrator may be able to view account-administration information such as your name and email address; membership and licence status; invitations and role; general service usage; and information necessary to administer the organisation's account. We will not provide administrators with private reading content or AI conversations unless the relevant service clearly provides for such access and you have been informed.

8.6 Legal and safety disclosures

We may disclose information where we reasonably believe it is necessary to comply with applicable law, regulation, legal process or governmental request; protect the rights, property or safety of ilmMind, our users or another person; investigate fraud, abuse, security incidents or unlawful conduct; enforce our agreements; respond to intellectual-property or content complaints; or establish, exercise or defend legal claims.

8.7 Business transactions

If ilmMind is involved in a merger, acquisition, financing, restructuring, sale of assets or similar transaction, personal information may be disclosed to advisers and relevant parties subject to appropriate confidentiality safeguards. If control of ilmVault changes, we will take reasonable steps to ensure that personal information remains protected and notify users where required.

ILMMIND PTY LTD is based in Australia, but ilmVault uses service providers operating internationally. Personal information may therefore be stored, accessed or processed outside Australia, including in the United States and countries within the European Economic Area, as well as other countries in which our providers or their approved subprocessors operate.

When we disclose personal information to an overseas recipient, we take reasonable steps appropriate to the circumstances to protect the information. Where European or United Kingdom data-transfer requirements apply, safeguards may include approved standard contractual clauses, recognised data-transfer agreements, adequacy decisions or another lawful transfer mechanism.

Privacy protections and government-access laws may differ between countries. You may contact [email protected] for more information about relevant international transfers and safeguards.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, to provide the Service, meet legal obligations, resolve disputes and protect ilmVault and its users.

Account and profile information

We generally retain account information while the account remains active and for a limited period after closure to complete deletion, resolve support issues and prevent fraud.

Private uploaded books and reading information

Private uploaded books, reading progress, highlights, notes, tags, reflections, recall cards and associated indexes are generally retained while your account is active. When you delete a book or close your account, we aim to remove the relevant information from active systems within 30 days, unless retention is required for legal, security or dispute-resolution purposes. Residual copies may remain temporarily in protected backups until those backups are overwritten through the normal backup cycle.

AI conversations

AI conversations are generally retained while your account is active so that your conversation history remains available. You may delete supported conversations through account controls or request deletion. Associated information will then be deleted in accordance with our deletion process, subject to limited legal and security exceptions.

Technical and security logs

Technical, diagnostic and security records are retained for a limited period appropriate to troubleshooting, fraud prevention, security monitoring and legal requirements. Some security records may be retained for longer where they relate to suspected abuse, an investigation or an unresolved incident.

Billing and financial records

Transaction, invoice, commission, payout and related financial records may be retained for at least seven years where required for company, accounting, tax, audit or legal purposes. Deletion of an account does not require us to delete records that we are legally required to retain.

Creator records and published books

Creator application, verification, sales, payout, rights and contractual records may be retained after a creator account closes where needed to complete payments; meet financial or legal obligations; handle complaints, disputes or rights claims; prevent fraud; enforce agreements; or preserve access for readers who previously purchased a book. Books already purchased may remain available to those purchasers in accordance with the Creator Publishing Agreement.

Support and complaints

Support messages, privacy requests and complaints may be retained for as long as reasonably necessary to resolve the matter, maintain an appropriate record and meet legal obligations.

Aggregated or de-identified information

Information that has been effectively aggregated or de-identified so that it no longer identifies an individual may be retained for research, reporting, security and product-improvement purposes.

We use reasonable technical and organisational safeguards designed to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These safeguards may include:

• Encryption of information in transit;
• Encryption provided by our storage and infrastructure providers;
• Managed and securely hashed authentication credentials;
• Role-based access controls;
• Private storage locations and time-limited access links;
• Separation of customer information;
• Secure management of passwords, tokens and service credentials;
• Logging, monitoring and abuse detection;
• Restricted administrative access;
• Software updates and vulnerability management;
• Backup and recovery measures;
• Provider security reviews; and
• Incident-response procedures.

Access to personal information is limited to people and providers that reasonably require it for an authorised purpose. No internet service or storage system can be guaranteed to be completely secure. Users should use a strong, unique password and notify us promptly if they suspect unauthorised access.

Where a data breach is likely to cause serious harm or otherwise meets a legal notification threshold, we will notify affected individuals and relevant regulators as required by applicable law.

ilmVault uses cookies, browser storage and similar technologies for purposes such as keeping users signed in; maintaining account sessions; remembering reader, theme and interface preferences; supporting security and fraud prevention; processing payments; maintaining shopping or subscription flows; and understanding basic platform performance.

We do not use third-party advertising cookies or sell information collected through cookies for behavioural advertising. Third-party payment, authentication or security services may use their own cookies when you interact with their services.

You can control or remove cookies through your browser settings. Blocking necessary cookies may prevent sign-in, payments or other parts of ilmVault from working properly. If we introduce optional analytics, advertising or other non-essential cookies, we will update this policy and request consent where required.

We may send marketing emails where you have requested them; you have provided consent; or applicable law otherwise permits us to do so. You may unsubscribe at any time using the unsubscribe link in the email or by contacting us.

Unsubscribing from marketing will not stop essential messages relating to account security; purchases and subscriptions; creator payouts; service changes; legal notices; or support requests.

Depending on your location and applicable law, you may have rights to:

• Obtain information about how we process your personal information;
• Request access to personal information we hold about you;
• Request correction of inaccurate, incomplete or outdated information;
• Request deletion of personal information;
• Request restriction of certain processing;
• Object to processing based on legitimate interests;
• Receive certain information in a portable, machine-readable format;
• Withdraw consent where processing is based on consent;
• Object to or opt out of certain marketing;
• Complain about how we have handled personal information; and
• Lodge a complaint with an applicable privacy regulator.

These rights may be subject to legal exceptions. For example, we may need to retain financial records, information relating to fraud or security, or information needed to establish or defend a legal claim.

How to make a request

You may use available account controls or contact [email protected]. Please describe your request and identify the account involved. We may need to verify your identity before providing access, making a correction or deleting information. We will request only the information reasonably necessary for verification. We will generally acknowledge and respond within 30 days. We will not discriminate against you for exercising an applicable privacy right.

You may make a privacy complaint by emailing [email protected] with the subject line: Privacy Complaint.

Please provide:

• Your name and contact details;
• A description of the issue;
• Relevant dates and account information; and
• The outcome you are seeking.

We will acknowledge the complaint; review the circumstances; request additional information where reasonably necessary; investigate the complaint; and provide a written response within a reasonable period.

If you are not satisfied with our response and Australian privacy law applies, you may contact the Office of the Australian Information Commissioner.

Where the GDPR or UK GDPR applies, ILMMIND PTY LTD acts as the controller of personal information described in this policy, except where another party is identified as the controller.

You may have the right to:

• Access your personal data;
• Correct inaccurate personal data;
• Request erasure;
• Restrict processing;
• Object to processing;
• Receive portable data;
• Withdraw consent;
• Object to direct marketing; and
• Complain to the data-protection authority in the country where you live, work or believe an infringement occurred.

Where we rely on legitimate interests, you may request information about those interests and object to the processing. ilmVault does not use solely automated decision-making that produces legal or similarly significant effects about readers.

Where an applicable United States state privacy law applies to ilmMind and to your information, you may have rights such as the right to know or access; the right to correct; the right to delete; the right to obtain portable information; and the right to opt out of certain sales, sharing or targeted advertising.

ilmMind does not sell personal information for money. ilmMind does not share personal information for cross-context behavioural advertising and does not use personal information for third-party targeted advertising.

You may submit an applicable request through [email protected].

ilmVault is not directed to children under 13. We do not knowingly collect personal information from a child under 13. If we become aware that such information has been collected without valid parental or guardian authorisation, we will take reasonable steps to delete it.

Some countries set a higher minimum age for consenting to online data processing — for example, up to 16 in parts of the European Economic Area. Where a higher age applies, the user must meet that requirement or have valid parental or guardian authorisation.

Creator and publisher accounts are limited to individuals who are at least 18 years old or the applicable age of majority, whichever is higher.

A parent or guardian who believes that a child has provided personal information inappropriately may contact [email protected].

ilmVault may link to external websites, books, creator pages, payment pages or other third-party services. We are not responsible for the privacy, security or content practices of services we do not control. You should review the applicable third party's privacy information before providing personal information to it.

You may browse some public parts of ilmVault without creating an account. An account is required for features such as maintaining a library, synchronising reading progress, making purchases, using creator tools and receiving payouts.

You may be able to use a display name or pen name publicly. However, we may still require your legal name and other accurate information for payment, creator verification, tax, legal, security or fraud-prevention purposes.

We may update this Privacy Policy to reflect changes to ilmVault; new features or business practices; changes to service providers; legal or regulatory developments; or security and operational requirements. The “Last updated” date at the top will show when the policy was most recently revised.

Where a change materially affects how we use personal information, we will provide reasonable notice through email, the Service or another appropriate method before the change takes effect where required. We will not rely solely on continued use of ilmVault as consent where applicable law requires express consent.

For privacy questions, requests or complaints, contact: