Privacy Policy
Effective 2 September 2026
This policy explains what information Illium AI, Inc. (“Illium”, “we”) collects, why, who sees it, and how long we keep it. It covers our website, the Illium console, and the Illium platform (together, the “Service”).
1. Two kinds of information, kept apart
This policy distinguishes two kinds of information, because our obligations for each differ:
- Account information is information about the people and organisations who use the Service — our customers and their staff. We are the controller of this information and this policy governs it.
- Platform Data is information the Service handles in connection with a customer’s use of it. What that involves varies by customer and by site, and rights and responsibilities for it are set by our agreement with that customer. If you are asking about a specific site, the operator of that site is the party to ask.
2. Account information we collect
- Identity and contact details — name, work email address, organisation, and the identity provider you sign in with. We use federated sign-in, so we do not hold your password.
- Mobile telephone number, if and only if you provide one to receive operational alerts. See section 6.
- Usage and diagnostic records — the actions you take in the console, API requests, error and audit logs, and the IP address and browser the request came from. These exist so that we can operate the Service, attribute administrative actions, and investigate faults and abuse.
- Correspondence — what you send us in support requests.
- Billing information — what your organisation used and what it owes. Card details, where applicable, are handled by our payment processor and are not stored by us.
We do not use advertising or third-party tracking cookies. The cookies and local storage the console sets are what keep you signed in and remember your interface preferences.
3. Platform Data
What the Service handles for any particular customer varies by customer and by site, and is governed by our agreement with that customer. We are not in a position to tell you what a particular site involves; the operator of that site is.
Where a customer’s use involves information relating to identifiable individuals, our agreement requires that customer to have the legal basis for it and to give the notices their jurisdiction demands. If you believe a site is using the Service unlawfully, contact us and we will refer it to the operator and act as the law requires of us.
4. Why we use account information
- To provide, secure and support the Service.
- To authenticate you and enforce the permissions your organisation grants you.
- To notify you about the operation of your account, including the alerts in section 6.
- To bill for usage.
- To detect, investigate and prevent abuse, fraud and security incidents.
- To improve the Service and to satisfy legal obligations.
We do not use account information for advertising, and we do not share it for cross-context behavioural advertising. Where we make information derived from the Service available to others, we do so only as permitted by the agreement with the customer whose deployment produced it, and subject to the notices and choices the applicable law requires at that time. Mobile telephone numbers are outside this entirely and are never made available — see section 6.
5. Who we share it with
We share account information only with the following, and only as far as each needs:
- Infrastructure and service providers who process data on our behalf under contract — cloud hosting and databases, our identity provider, our messaging provider (for the alerts in section 6), our payment processor, and error-monitoring tooling.
- Your own organisation. An administrator of your organisation can see your account within it, the roles you hold, and your activity in its audit records.
- Legal and safety — where we are required by law, or where it is necessary to protect rights, safety or the integrity of the Service. We will tell you unless we are prohibited from doing so.
- A successor in a merger, acquisition or sale of assets, subject to this policy.
6. Text messages
If you give us a mobile number to receive operational alerts, we use it to send you those alerts and to send the one-time code that confirms the number is yours. We use it for nothing else.
We do not sell mobile telephone numbers. We do not share mobile numbers, or the fact that you consented to receive text messages, with third parties or affiliates for their own marketing purposes. Numbers are disclosed only to the messaging provider that delivers the message on our behalf, which may not use them for any other purpose.
Reply STOP to any message to end alerts to that number, or HELP for help. Message and data rates may apply. Full program details are on the Illium Operational Alerts page.
7. How long we keep it
Account information is kept while your account is active and for as long afterwards as we need it to meet legal, tax and audit obligations, then deleted or anonymised. Audit and security records are retained for a fixed period and are not edited or selectively deleted. Platform Data is retained, and on termination deleted, returned or otherwise handled, as the applicable customer agreement provides.
8. Security
The Service runs on managed cloud infrastructure. Data is encrypted in transit and at rest. Access is limited to the personnel who need it, is authenticated through our identity provider, and administrative actions are logged. Equipment and systems authenticate with individually revocable credentials. No system is perfectly secure; we will notify affected parties of a breach as the law requires.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, to withdraw consent, and — where we sell or share personal information as those terms are defined by the law that applies to you — to direct us not to. We will not discriminate against you for exercising any of these. Write to us at the address in section 12 and we will respond within the period the law allows.
Where the information is Platform Data, we will refer your request to the customer whose agreement governs it, and assist in answering it.
10. International transfers
We operate from the United States and process information there. If you are elsewhere, using the Service involves transferring your information to the United States, under the safeguards the applicable law requires.
11. Children
The Service is a business product, not directed to children, and we do not knowingly collect personal information from anyone under 16 as an account holder.
12. Changes and contact
If we change this policy materially we will post the new version here with a new effective date and, where the change warrants it, tell account holders directly.
Illium AI, Inc.
2443 Fillmore St #380-6466
San Francisco, CA 94115
privacy@illium.ai
illium.ai