This policy is written to reflect how Imbew actually intends to operate, but it is not legal advice and has not been reviewed by a lawyer. Fill in every highlighted placeholder and have a qualified practitioner review it before launch — particularly if you take payments from, or serve users in, the EU, UK, or California.
The short version
You write private thoughts into Imbew. That deserves a straight answer about what happens to them, so here it is before the legal language starts.
We do not sell your personal data. Not to authors, not to publishers, not to advertisers, not to anyone. There is no version of Imbew where your writing is a product we sell.
What you write is private by default. Your interpretations and reflections are visible only to you unless you take a specific, deliberate action to share them.
Author sharing is opt-in, per book, and reversible. If you join Imbew through an author's link, that author sees aggregate engagement by default — never your individual writing unless you explicitly choose to share it.
We do not run advertising and we do not use your writing to target you with anything.
You can export everything and delete everything, at any time, without emailing anyone or sitting through a retention offer.
The rest of this page is the detail behind those five sentences.
01Who we are
Imbew is operated by [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS], [COUNTRY].
For the purposes of the UK and EU General Data Protection Regulation, we are the data controller for the personal data described in this policy. Under India's Digital Personal Data Protection Act, 2023, we act as a Data Fiduciary.
You can reach our privacy contact at privacy@imbew.com. Our Grievance Officer for DPDP Act purposes is [NAME], contactable at the same address.
02What we collect
| Category | What it actually is |
|---|---|
| Account data | Your email address. That's the only thing required to have an account — no name, no phone number, no date of birth. Optionally, a display name if you choose to share anything publicly. |
| Your content | The interpretations, reflections, goals, book titles, and notes you write. Voice recordings, if you use voice capture (see §5). |
| Review activity | When cards are shown to you, how you rated them, whether you marked something as tried, and your streak history. |
| Preferences | Your notification time, timezone, and email settings. |
| Usage data | Pages visited, features used, approximate location derived from IP (country/city level), browser and device type, and — where enabled — session recordings that capture on-page interaction. See the Cookie Policy. |
| Payment data | Handled entirely by our payment processor. We receive a subscription status, the last four digits of a card, and a billing country. We never see or store full card numbers. |
| Support messages | Anything you email us, and our reply. |
What we deliberately do not collect
- Precise location, contacts, photos, microphone access outside an active voice capture you started, or anything from other apps.
- Advertising identifiers or cross-site tracking data. We run no ad networks and no third-party advertising pixels.
- Special category data (health, religion, politics, sexuality, and so on). Note that you may write such things into a reflection — see §4 for how that's treated.
03Why we process it, and on what legal basis
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Creating and running your account; showing you your own cards; sending the daily review email you asked for | Contract — necessary to provide the service you signed up for |
| Taking payment and preventing fraud | Contract and legal obligation |
| Understanding which features are used and where people get stuck, so the product improves | Legitimate interests — running and improving a service, balanced against your privacy. You can opt out (§9) |
| Keeping the service secure and available | Legitimate interests |
| Voice transcription and suggested interpretations | Contract, and consent where required (§5) |
| Sharing anything you write with an author, another user, or publicly | Consent — always, and always revocable (§4, §6) |
| Product news and occasional updates by email | Consent — unsubscribe in one click, and it never affects your account |
04The things you write
This section matters more than the rest of the policy, because it's the part people actually worry about.
Your interpretations, reflections, and goals are private to your account by default. They are not visible to other users, to authors, or to anyone browsing the service. Nobody at Imbew reads them as a matter of routine.
When a human at Imbew might see your content
- If you send it to us in a support request, or explicitly ask us to look at something.
- If content is reported by another user after you've chosen to share it publicly, and we need to review that report.
- Where strictly necessary to investigate a security incident or a suspected serious violation of our Terms.
- Where we are legally compelled to. If that happens and we're permitted to tell you, we will.
Access is limited to the smallest number of people necessary, and is logged.
Sensitive things you may write
People reflecting honestly on self-improvement books sometimes write about health, relationships, faith, or difficult periods in their lives. We don't ask for any of that and we don't analyse your writing for it. But if you do write it, please understand it's stored as ordinary content of your account. If you would be seriously harmed by a particular thing being stored on a server, don't put it in Imbew — that's true of every product like this, and we'd rather say it plainly.
Imbew is a tool for remembering and applying ideas from books. It is not a mental health service, it does not provide medical or psychological advice, and it is not monitored by clinicians. If you are struggling, please speak to a qualified professional or a trusted person in your life.
05AI processing
Two features involve sending content to a third-party AI provider:
- Voice capture. If you record a spoken note, the audio is sent to a transcription provider and converted to text. The audio is deleted after transcription unless you save it.
- Suggested interpretations. To avoid a blank page, we may show a few candidate sentences for a chapter. Generating these may involve sending the book title, chapter reference, and — where the feature is personalised — a limited sample of your previous writing to an AI provider.
What we require of AI providers
- Your content is not used to train their models. We use enterprise or zero-retention API tiers where available and will not use a provider that reserves training rights over customer content.
- Data is retained by the provider only as long as needed to return a result, subject to their abuse-monitoring policies.
- Current providers are listed in §7 and updated when they change.
Both features can be turned off in your settings. If you turn them off, no content is sent to any AI provider. No automated decision producing legal or similarly significant effects is made about you.
08How long we keep things
| Data | Retention |
|---|---|
| Account and content | Until you delete it, or until your account is deleted |
| Deleted content | Removed from the live service immediately; purged from backups within 30 days |
| Inactive accounts | We email you after 24 months of inactivity and delete the account if there's no response within 30 days |
| Analytics data | 14 months, then deleted or fully anonymised |
| Session recordings | 30 days |
| Voice recordings | Deleted immediately after transcription unless you save them |
| Billing and tax records | As long as tax and accounting law requires — typically 7 years |
| Support correspondence | 24 months |
09Your rights
Depending on where you live, you have some or all of the following. We extend all of them to everyone, regardless of location, because maintaining two tiers of user would be tedious and a bit insulting.
- Access — get a copy of what we hold about you.
- Export — download everything you've written, in a portable format, from your settings. No request needed.
- Correction — fix anything inaccurate.
- Deletion — delete individual items or your whole account, from settings, immediately. We do not make you email us, and we do not show you a retention offer on the way out.
- Restriction and objection — ask us to stop processing on legitimate-interest grounds, including analytics.
- Withdraw consent — for AI features, author sharing, or marketing email, at any time, without affecting anything that happened before.
- Complain — to your local supervisory authority. In the UK that's the ICO; in the EU your national DPA; in India the Data Protection Board. We'd appreciate the chance to fix it first.
If you're in California, we additionally confirm: we do not sell or share personal information as those terms are defined under the CCPA/CPRA, we have not done so in the preceding twelve months, and we will not discriminate against you for exercising any right.
Write to privacy@imbew.com for anything you can't do yourself in settings. We respond within 30 days, usually much sooner.
10International transfers
We operate from [COUNTRY] and use providers based in the United States and elsewhere, so your data will cross borders. Where data leaves the UK or EEA, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), together with additional technical measures such as encryption in transit and at rest. Copies of the relevant safeguards are available on request.
11Security
- Encryption in transit (TLS 1.2+) and at rest.
- Passwordless authentication by default — we use magic links, so there's no password for anyone to steal or reuse.
- Row-level security in the database, so a query can only ever return your own rows.
- Access to production data restricted to a minimal set of people, logged, and reviewed.
- Regular dependency patching and backups.
No system is perfectly secure, and anyone claiming otherwise is selling something. If a breach affects your rights and freedoms, we will notify the relevant authority within 72 hours and tell you directly and promptly.
12Children
Imbew is not intended for anyone under 16, and we do not knowingly collect data from children. Under India's DPDP Act, processing children's data requires verifiable parental consent, which we are not set up to obtain — so accounts are limited to those 16 and over. If you believe a child has created an account, contact us and we'll delete it.
13Changes to this policy
If we change anything material — particularly anything in the five commitments at the top — we will email every registered user at least 30 days before it takes effect, and say plainly what changed and why. We won't quietly update a date and hope nobody notices. Previous versions are archived and available on request.
14Contact
Privacy questions, requests, and complaints: privacy@imbew.com
Everything else: hello@imbew.com
Postal: [LEGAL ENTITY NAME, REGISTERED ADDRESS]
Grievance Officer (India, DPDP Act): [NAME] — privacy@imbew.com