Privacy Policy

1. Introduction

This Privacy Policy explains how IIMAGINE.AI (“we,” “us,” “our,” or the “Platform”) collects, uses, stores, shares, and protects your personal information when you use our Services, including the website at iimagine.ai, app.iimagine.ai, api.iimagine.ai, desktop applications, embeddable widgets, and APIs.

We are committed to protecting your privacy and handling your data responsibly. However, as described in this Policy, our Services rely on multiple third-party providers, and we cannot guarantee absolute data privacy or security. By using our Services, you acknowledge and accept the inherent risks described in this Policy.

We comply with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) and, where applicable, the General Data Protection Regulation (GDPR) for users in the European Economic Area.

2. Information We Collect

Account Information

When you create an account, we collect: full name, email address, password (hashed and salted — never stored in plain text), profile image (optional), and organisation name and details (if creating an organisation workspace).

Billing Information

Payment card details are processed and stored by Stripe (our payment processor) — we do not store card numbers on our servers. We retain billing address, transaction history, and Stripe customer ID.

Data You Provide to the Platform

The core function of our Platform is to process your data to provide AI-powered advice. This includes: chat messages, uploaded files (documents, spreadsheets, PDFs, images), structured data (goals, projects, tasks, SCOPED modules), agent configurations (instructions, tools, skills, settings), and marketplace content (templates, descriptions, reviews you publish).

Data Processed by UCE (Unified Context Engine)

When you use data import features, the Platform processes your data through our Unified Context Engine: text extraction from uploaded files, vector embeddings for semantic search, entity extraction (people, organisations, concepts, goals, metrics), relationship mapping, and metadata cataloguing (file names, column names, headings, structural information).

Connected Platform Data

When you connect third-party services: encrypted OAuth refresh tokens are stored to maintain your connection; data accessed from connected platforms is processed by AI agents on your behalf; and access is limited to the permissions you explicitly approve during OAuth consent.

Usage and Technical Data

We automatically collect: token usage (AI model consumption per request), feature usage patterns, error logs, IP address, browser type/version, device type, session duration, page views, and API request logs.

Content Monetization Visitor Data

If you interact with an IIMAGINE-powered chat widget on a third-party website, we may collect: email address (if provided), chat messages and interactions, payment information (processed by Stripe), and IP address/device information.

3. How We Use Your Information

• Providing the Services (AI chat, agents, data processing)
• Processing payments and managing subscriptions
• Sending service-related communications (billing alerts, security notices)
• Improving the Platform (bug fixes, performance optimisation)
• Preventing fraud, abuse, and enforcing Terms of Use
• Responding to support requests
• Platform analytics (aggregated, non-identifying)
• Complying with legal obligations

We do NOT use your data to: train AI models, sell to third parties, build advertising profiles, or target you with third-party ads.

4. Third-Party Service Providers

We use third-party services across the following categories (specific providers may change over time):

• Cloud hosting and infrastructure
• Database services
• AI model providers (for processing chat messages, agent prompts, and data)
• Payment processing
• Email delivery
• GPU compute (for generating vector embeddings)
• Rate limiting and caching
• Authentication

AI Model Providers — Special Notice

When you use the Platform for chat, agents, or data processing, your prompts and data are sent to third-party AI model providers for processing. We use API-tier access with data processing agreements where available. We cannot independently verify that providers comply with their stated policies at all times. Provider policies may change, and different models come from different providers with their own data handling policies.

Your Acknowledgement

By using the Platform, you acknowledge that: your data will be processed by multiple third-party services; we implement best practices (encryption, access controls, DPAs) but cannot guarantee the actions of third parties; complete data privacy cannot be assured when data is transmitted to external services; and you should not input data into the Platform that you cannot accept being processed by third-party infrastructure and AI providers.

5. AI Training and Your Data

We do not use your data to train AI models. Your uploaded content, chat messages, and workspace data are not used by IIMAGINE to train or fine-tune any AI model.

We access AI models via their API tiers, which typically include contractual commitments that API data will not be used for model training. We review provider data handling policies regularly and select providers whose API terms include these commitments.

Vector embeddings generated from your data are stored in our database and are not shared with or accessible to other users or AI providers.

We cannot guarantee third-party compliance. While we select providers with appropriate data handling commitments, we have no ability to audit their internal systems. If this is a concern for highly sensitive data, we recommend using the Desktop Companion (when available) for local-only processing.

6. Data Security

Security Measures

• Encryption at rest: sensitive tokens encrypted with AES-256-GCM
• Encryption in transit: all connections use HTTPS/TLS 1.2+
• Access controls: workspace-scoped data isolation (every query filtered by workspace_id)
• Authentication: HTTP-only session cookies with CSRF protection; passwords hashed with bcrypt
• Token security: OAuth refresh tokens encrypted; access tokens cached in-memory only with 1-hour expiry
• API security: external API keys SHA-256 hashed before storage
• Rate limiting: per-user request limits to prevent abuse
• Infrastructure: hosted on SOC 2 compliant providers

What We Cannot Guarantee

No system is perfectly secure. Breaches can occur at any layer. We rely on third-party infrastructure we do not fully control. Zero-day vulnerabilities could expose data before patches are available. We cannot prevent all forms of social engineering or account compromise.

Breach Notification

In the event of a data breach, we will notify affected users within 72 hours of becoming aware, notify the relevant data protection authority where required, and provide details of what data was affected and remediation steps.

7. Cookie Policy

Cookies We Use

Cookies We Do NOT Use

We do not use: third-party advertising or retargeting cookies, third-party analytics cookies, cross-site tracking cookies, fingerprinting or supercookies, or any cookies that track you across other websites.

Third-Party Cookies

When you interact with payment forms, our payment processor may set cookies necessary for fraud prevention. These are governed by their own cookie policy.

Managing Cookies

Essential cookies cannot be disabled without breaking Platform functionality. Functional cookies can be managed through your browser settings. We respect “Do Not Track” browser signals — since we do not track users across third-party websites, our behaviour does not change based on DNT settings.

8. Data Isolation and Multi-Tenancy

The Platform operates on a multi-tenant architecture with strict workspace-level data isolation. All data is scoped to a workspace; database queries are structurally filtered so one workspace cannot access another's data; and agents can only access data and connections belonging to their workspace.

Within an organisation workspace, all members can see all data in that workspace. Personal workspaces are visible only to the account owner.

IIMAGINE administrators may access anonymised, aggregated analytics data for Platform operations. We do not routinely access individual workspace content except where required for support (with your consent) or legal compliance.

9. Data Retention

When you delete your account: personal data is deleted within 30 days; workspace data (if sole owner) is deleted within 30 days; backups may retain data for up to 30 additional days; and data required for legal compliance is retained as specified above.

10. Your Rights

Under Australian Privacy Law

You have the right to: access the personal information we hold about you; request correction of inaccurate information; request deletion (subject to legal retention); and complain to the Office of the Australian Information Commissioner (OAIC).

Under GDPR (EU/EEA Users)

You additionally have the right to: data portability; object to processing based on legitimate interest; restrict processing; withdraw consent; and lodge a complaint with your local data protection authority.

Exercising Your Rights

Contact us at privacy@iimagine.ai. We will respond within 30 days. You can export your data at any time through the Platform settings.

11. International Data Transfers

Our infrastructure is primarily hosted in the United States (US East region). Your data may be transferred to and processed in the United States regardless of your location. AI model providers may process data in various jurisdictions.

For EU/EEA users: international transfers are conducted under appropriate safeguards, including Standard Contractual Clauses (SCCs) where applicable.

12. Children's Privacy

The Platform is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected information from a person under 18, we will delete that information promptly.

13. Content Monetization — Visitor Privacy

If you interact with an IIMAGINE-powered chat widget on a third-party website: the website owner who embedded the widget is the data controller; IIMAGINE acts as a data processor on their behalf; and you may contact the website owner or us at privacy@iimagine.ai to exercise your rights.

14. Desktop Companion (Future)

The Desktop Companion processes data locally on your device using local AI models. Data processed locally does not leave your device unless you explicitly sync it to the cloud Platform. Local-only mode provides maximum privacy — data never touches our servers or third-party AI providers.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email and in-platform notification at least 14 days before taking effect. Continued use after changes constitutes acceptance.

16. Contact Us

For privacy-related questions, concerns, or to exercise your rights:

• Email: privacy@iimagine.ai
• Platform: app.iimagine.ai (support tickets)

Australian Information Commissioner: Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au — 1300 363 992