Privacy Policy

Effective Date: 7 November 2026Last Updated: 7 November 2026

1. Introduction

Welcome to Aimbrary.

Aimbrary (“Aimbrary”, “we”, “us”, or “our”) is an artificial intelligence-powered personal knowledge management application designed to help individuals capture, organise, connect, retrieve, and understand information.

We recognise that the information entrusted to Aimbrary may be personal, confidential, or important to its users. Protecting that information is a fundamental consideration in how we develop and operate our Services.

This Privacy Policy explains how we collect, use, process, store, disclose, retain, and protect personal data when you access or use Aimbrary, including our mobile application, associated websites, and related services (collectively, the “Services”).

Aimbrary is currently operated by an individual developer and is undergoing beta testing. Following incorporation, the Services may be operated by a registered legal entity, in which case this Privacy Policy will be updated accordingly.

We process personal data in accordance with applicable data protection laws, including Malaysia’s Personal Data Protection Act 2010 (Act 709), as amended (“PDPA”), where applicable.

By accessing the Services, you acknowledge that you have been provided with this Privacy Policy.

2. Information We Collect

We collect and process information necessary to provide, maintain, secure, and improve our Services.

2.1 Account Information

When you create or manage an Aimbrary account, we may collect:

• Your name or username;
• Email address;
• Account identifiers;
• Authentication information;
• Account preferences and settings;
• Account creation and activity timestamps.

Authentication credentials are processed through our authentication infrastructure.

2.2 User-Provided Content

Aimbrary allows you to create, submit, store, and organise information.

Depending on the features available, this may include:

• Notes and written content;
• Documents and uploaded files;
• Saved information and references;
• Links and associated metadata;
• Personal knowledge entries;
• Questions, prompts, and instructions;
• Information submitted for AI analysis;
• Other materials voluntarily provided through the Services.

We refer to this information collectively as “User Content”.

You determine what User Content you submit to Aimbrary.

User Content may contain personal data relating to you or other individuals. You should only submit information that you are legally entitled to process and share with the Services.

2.3 AI-Generated and Derived Information

To provide knowledge management functionality, Aimbrary may generate additional information from User Content.

This may include:

• Semantic embeddings;
• Knowledge clusters;
• Relationships between information;
• Knowledge graphs;
• Content classifications;
• Generated summaries;
• AI-assisted interpretations;
• Search results and contextual recommendations;
• Derived metadata.

Such information may reveal or relate to personal information contained in the original User Content.

Where derived information constitutes personal data, it is subject to the protections described in this Privacy Policy.

2.4 Technical and Usage Information

When you access the Services, certain technical information may be collected automatically.

This may include:

• Device type;
• Operating system;
• Application version;
• IP address;
• Connection information;
• Error reports;
• Diagnostic information;
• Service activity logs;
• Security-related events.

We use this information to maintain the reliability, performance, and security of the Services.

2.5 Communications and Feedback

If you contact us, report a problem, or participate in beta testing, we may collect:

• Your contact information;
• The contents of your communications;
• Bug reports;
• Feature suggestions;
• Feedback regarding the Services;
• Information necessary to investigate technical issues.

We use this information to respond to requests and improve Aimbrary.

3. How We Use Your Information

We process personal data for legitimate and disclosed purposes connected with operating Aimbrary.

These purposes include:

3.1 Providing the Services

We process information to:

• Create and maintain user accounts;
• Authenticate users;
• Store and retrieve User Content;
• Organise knowledge entries;
• Maintain relationships between information;
• Provide search and retrieval functionality;
• Deliver AI-powered features;
• Synchronise information where supported.

3.2 Artificial Intelligence Processing

We process User Content to provide AI-assisted functionality, including:

• Semantic analysis;
• Embedding generation;
• Information clustering;
• Knowledge graph construction;
• Contextual information retrieval;
• Automated summaries and insights;
• Identification of relationships between knowledge entries.

3.3 Service Improvement

We may process technical information, usage information, and voluntarily submitted feedback to:

• Identify and resolve software defects;
• Improve application performance;
• Evaluate feature reliability;
• Develop new functionality;
• Improve usability;
• Maintain compatibility with supported devices.

Where reasonably practicable, we seek to use aggregated or de-identified information for general product analysis.

3.4 Security and Fraud Prevention

We may process information to:

• Detect suspicious activity;
• Prevent unauthorised access;
• Investigate security incidents;
• Prevent misuse of the Services;
• Protect our infrastructure;
• Enforce applicable Terms of Service.

3.5 Legal and Regulatory Compliance

We may process or disclose information where reasonably necessary to comply with applicable laws, lawful requests, regulatory obligations, or legal proceedings.

4. Artificial Intelligence and Third-Party Processing

Aimbrary integrates artificial intelligence technologies to provide its core functionality.

4.1 OpenAI Integration

Aimbrary uses the OpenAI API to support certain AI-powered features.

Depending on the feature requested, relevant User Content, prompts, or contextual information may be transmitted to OpenAI for processing.

Such processing may include generating embeddings, analysing information, and producing AI-generated responses.

We seek to limit information transmitted to what is reasonably necessary for the requested functionality.

4.2 AI Model Training

Aimbrary does not intentionally submit User Content for the purpose of training general-purpose AI models.

Under OpenAI’s standard API data policies, API inputs and outputs are not used to train OpenAI models by default unless the API customer explicitly opts into such use.

OpenAI may nevertheless retain and process certain information for service operation, security, abuse monitoring, or other purposes permitted under its applicable terms and data policies.

4.3 AI Accuracy

AI-generated outputs are probabilistic and may contain inaccuracies, omissions, or misleading interpretations.

Knowledge relationships, summaries, classifications, and other AI-generated information should not be regarded as independently verified facts.

Users remain responsible for evaluating important information before relying on it.

5. Data Storage and Infrastructure

Aimbrary uses Supabase to support database, authentication, and storage functionality.

Depending on the Services used, information stored through Supabase may include:

• Account information;
• User Content;
• Knowledge entries;
• Semantic embeddings;
• Knowledge relationships;
• Application metadata;
• Authentication records.

Information may be stored or processed using infrastructure located outside Malaysia.

The location of primary data storage depends on the hosting region configured for the relevant infrastructure.

We take reasonable steps to ensure that service providers handling personal data are subject to appropriate contractual, technical, and organisational safeguards.

6. Data Sharing and Disclosure

We do not sell User Content or personal data to data brokers.

We may disclose information to the following categories of recipients where necessary:

6.1 Infrastructure Providers

Providers responsible for hosting, databases, authentication, storage, and technical infrastructure.

6.2 AI Service Providers

Providers processing information to deliver AI-powered features, including OpenAI.

6.3 Technical Service Providers

Providers assisting with application maintenance, diagnostics, security, and operational support.

6.4 Professional Advisers

Legal, accounting, or other professional advisers where disclosure is reasonably necessary.

6.5 Legal Authorities

Regulators, courts, law enforcement agencies, or other authorities where disclosure is required or permitted by applicable law.

6.6 Business Reorganisation

If Aimbrary undergoes incorporation, restructuring, merger, acquisition, or transfer of operations, relevant information may be transferred to the successor operator, subject to applicable legal requirements.

We will provide appropriate notice where required.

7. User Content and Ownership

You retain ownership of the original content you submit to Aimbrary, subject to any applicable third-party rights.

Aimbrary does not acquire ownership of your original notes, documents, or other User Content merely because you use the Services.

We process User Content only to the extent necessary for the purposes described in this Privacy Policy or otherwise lawfully authorised.

Generated embeddings, knowledge graphs, and related derived information may be processed and stored as part of the functionality of the Services.

Where such derived information constitutes personal data, it remains subject to applicable data protection rights and requirements.

8. Data Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, and destruction.

Depending on the relevant infrastructure and configuration, these measures may include:

• Encryption during transmission;
• Encryption of stored information;
• Authentication mechanisms;
• Access restrictions;
• Database security controls;
• Secure communication protocols;
• Security updates;
• Monitoring and incident investigation.

Access to personal data is restricted to authorised persons and service providers with a legitimate operational need.

Despite these precautions, no electronic system can be guaranteed to be completely secure.

Users should maintain the confidentiality of their account credentials and notify us promptly if they suspect unauthorised account access.

9. Data Retention

We retain personal data only for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy, subject to applicable legal obligations.

In general:

Account information: Retained while your account remains active and for any additional period reasonably required for legal, security, or administrative purposes.

User Content: Retained while stored within your account, unless deleted by you or otherwise removed in accordance with applicable law.

Derived information: Retained as necessary to provide the relevant knowledge management functionality.

Technical and security records: Retained for periods reasonably necessary to maintain security, investigate incidents, and comply with legal obligations.

Backup information: May remain temporarily within backup systems until the relevant backup retention period expires.

We will delete, anonymise, or securely dispose of personal data when it is no longer required, subject to applicable legal requirements.

10. Account and Data Deletion

Aimbrary provides users with the ability to delete their accounts.

You may initiate account deletion through the relevant functionality within the application.

Account deletion is intended to remove the personal data and User Content associated with your account from active systems, including associated derived information where applicable.

Certain information may be retained temporarily where necessary for:

• Backup management;
• Security investigations;
• Legal compliance;
• Dispute resolution;
• Enforcement of legal rights.

Information retained by third-party providers may be subject to their applicable retention policies and legal obligations.

If you experience difficulties deleting your account, you may contact us using the details provided below.

11. Your Data Protection Rights

Subject to applicable law, including the Malaysian PDPA where applicable, you may have rights to:

• Request access to personal data held about you;
• Request correction of inaccurate or incomplete personal data;
• Request deletion of personal data where legally applicable;
• Withdraw consent to processing where applicable;
• Limit or prevent certain processing;
• Object to certain processing activities;
• Request information about the processing of your personal data;
• Request data portability where applicable;
• Submit complaints to the relevant data protection authority.

Some requests may be subject to legal limitations or exceptions.

We may request reasonable information to verify your identity before fulfilling a request.

We will respond to valid requests within the periods required by applicable law.

12. Consent and User Choices

Where consent is required under applicable law, we will seek appropriate consent before processing personal data.

You may withdraw consent where permitted by law.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Certain information is necessary for the operation of Aimbrary.

If you decline to provide required information or withdraw consent for essential processing, some or all Services may become unavailable.

Where personal data is requested, we will distinguish between information necessary to provide the Services and information that is optional.

13. International Data Transfers

Aimbrary uses third-party infrastructure and AI service providers that may operate internationally.

Consequently, personal data may be transferred to, stored in, or processed in jurisdictions outside Malaysia.

Such jurisdictions may have data protection laws that differ from those applicable in Malaysia.

Where international transfers occur, we will take steps required by applicable law to ensure appropriate protection of personal data.

These steps may include contractual safeguards, assessments of applicable legal protections, and other recognised transfer mechanisms.

14. Children’s Privacy

Aimbrary is not intended for children under 13 years of age.

Users must also satisfy any higher minimum age or parental authorisation requirements applicable in their jurisdiction.

We do not knowingly collect personal data from children in violation of applicable law.

If we become aware that such information has been collected, we will take appropriate steps to delete it or otherwise address the matter in accordance with applicable law.

Parents or guardians may contact us regarding concerns about a child’s personal information.

15. Beta Testing

Aimbrary is currently undergoing beta testing.

During this period, we may collect additional technical information and feedback reasonably necessary to identify defects, evaluate performance, and improve the Services.

Beta versions may contain incomplete features, software errors, or functionality that changes during development.

Our privacy and data protection obligations continue to apply throughout the beta period.

Participation in beta testing does not waive your applicable privacy rights.

16. Changes to This Privacy Policy

We may revise this Privacy Policy to reflect:

• Changes to the Services;
• New application features;
• Changes in data processing practices;
• Changes to third-party service providers;
• Legal or regulatory developments;
• Changes to Aimbrary’s operating entity.

Where changes materially affect how personal data is processed, we will provide appropriate notice and obtain consent where required.

The latest version will be made available through the Services.

17. Contact Us

For questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact:

[email protected]