Privacy policy
Last updated 3 October 2026
This policy explains what personal data ilumd collects, why, who we share it with, and the choices you have. It covers the ilumd website and the ilumd service. Questions or requests go to support@ilumd.com, and we answer directly.
Who this covers
Two groups use ilumd. Customers are the organisations that sign up, connect repositories, and decide who sees each doc; for the content they bring, they are in charge of it and we process it on their instructions. Readers are the people a customer shares docs with, such as their team, their clients, named people, or the public. If you are a reader with a question about a particular organisation’s docs, that organisation is usually the right first contact, and we will help them answer you.
What we collect
- Account details: your email address, and your name if you give it. We sign people in with a one-time code or link sent to their email, so we don’t store passwords.
- Organisation and workspace details: names, members, roles, which audiences people belong to, and portal settings such as a title, logo, and brand colours.
- Content from tools you connect: when you connect a code host such as GitHub or GitLab, we read the documentation files in the repositories you choose, with their paths and change history, and details of related code changes so we can tell when a doc may be out of date. We keep a synced copy of those docs so we can serve, search, and protect them. If you connect other tools, such as issue trackers or publishing tools, we exchange only what the feature needs, such as creating an issue or updating a page.
- What people do in ilumd: suggested edits, requests for updates, questions asked of your docs, sharing choices, and activity records such as who changed what and when.
- Billing details: the plan, the workspaces billed, and who pays. Card details are collected and held by our payment processor; we never see or store full card numbers.
- Website and technical data: on this marketing site we use analytics to understand which pages are read. The service uses cookies that are needed to keep you signed in, and records basic technical information such as IP address and browser type to keep the service secure and working.
How we use it
- to provide the service: inventory, access control, portals, search, freshness, edits, and integrations;
- to answer questions about your docs with our AI features, using only the docs the person asking is allowed to see;
- to bill you and run your account;
- to send service emails, such as sign-in codes, invitations, review requests, trial and billing notices, and changes to these policies;
- to send product updates, which you can unsubscribe from at any time;
- to keep the service secure, prevent abuse, and fix problems; and
- to meet our legal obligations.
We do not sell personal data, we do not share it with advertisers, and we do not use your content to train AI models.
AI features
When someone uses an AI feature, such as asking a question of your docs, we send the question and the relevant passages from the docs that person is allowed to see to our AI provider to produce the answer. Our provider processes this under commercial terms that do not allow it to train its models on the data. AI output is generated automatically and can be wrong; answers cite their sources so they can be checked.
Who we share it with
We use trusted service providers to run ilumd, and share only what each needs. Today these cover hosting and our database, email delivery, payments, AI processing, and analytics for this website. Examples include Vercel, Supabase, Resend, Stripe, Anthropic, and Google Analytics. When you connect a third-party tool, such as GitHub, GitLab, Jira, Linear, Notion, or Confluence, data moves between ilumd and that tool as the integration requires, and that tool handles it under its own terms. We may also disclose information when the law requires it, or as part of a merger or sale of the business, in which case this policy continues to apply to it.
Some of these providers process data outside Australia, including in the United States. Where they do, we rely on their contractual and security commitments to protect it.
How long we keep it
We keep your data while your account is active. If a trial ends or a workspace goes unpaid, outside access is switched off but your data is kept, so it can be restored. When you close your account, or ask us to delete it, we delete your personal data and your synced content within a reasonable period, except where we must keep records, such as invoices, by law. Disconnecting a repository stops us reading it; ask us if you also want its synced copy removed straight away.
Security
Access to documents is default-deny and enforced in the database itself, not just in the interface, so people can retrieve only what has been shared with them. Data is encrypted in transit, and we limit staff access to what is needed to run and support the service. No system is perfectly secure; if a breach affecting your data occurs, we will tell you and the relevant authorities as the law requires.
Your rights
You can ask to access, correct, export, or delete your personal data, or object to how we use it, by emailing support@ilumd.com. You can unsubscribe from product emails using the link in any of them; service emails stop when your account closes. Depending on where you live, you may have further rights under laws such as Australia’s Privacy Act or the GDPR, and you can complain to your local privacy regulator, such as the Office of the Australian Information Commissioner. We would like the chance to fix it first.
Changes to this policy
We update this policy when the service or the law changes. We will change the date above, and for significant changes we will email account owners before they take effect.