Privacy
Policy

This Privacy Policy explains how Imbu (trading name of IMBU WORLD LIMITED, 'we', 'us', 'our') collects, uses, stores, and protects personal data when you use our website and platform at imbu.world. We comply with UK GDPR and the Data Protection Act 2018.

1. Who this policy applies to

This Policy applies to: visitors to imbu.world; individuals who register for a free or paid account directly; students and staff provisioned by a school or institution; parents and guardians; and trial users.

Age eligibility — B2B institutional accounts

Under the Data Protection Act 2018, a child aged 13 or over can consent to an online service in their own right. Offering our standard B2B subscription only to students aged 16 and above is our own policy choice, not a legal threshold. Schools may apply to extend access to students under 16. This requires the school, as Data Controller, to confirm it has a valid lawful basis for under-16 processing before any under-16 accounts are activated.

2. What personal data we collect

2a. Data you give us directly

• Account registration: name, email address, hashed password, role, institution name
• Profile and Story Vault: professional narrative, work history, education, skills, projects, certifications
• Assessment responses: your answers to the Imbu North Assessment, and the Archetype Classification generated from them. The Archetype Classification is an educational summary of your working style and career interests, produced to help you and your school think about subjects, courses and career paths. It is guidance only. You can view it and retake the assessment at any time.
• Goal and application data: goal descriptions, task lists, job application details and notes
• Audio recordings: where a feature lets you record a spoken response, for example in the Imbu North assessment, Story Vault or Interview Prep. The recording is transcribed by our AI assistant and then deleted. We keep the transcript, not the audio, and we do not use your voice to identify you
• Uploaded documents: CVs and portfolio files uploaded to Story Vault
• Payment data: billing name, address, payment method (card details held by payment processor only)
• Support communications: messages to our support team

2b. Data collected automatically

• Usage and analytics data: pages visited, features used, time spent, progress scores
• Device and technical data: IP address, browser type, operating system and device identifiers. Some of this is collected using cookies and similar technologies. Our Cookie Policy at imbu.world/cookies explains what we use, why, and how to control them.

2c. Data received from institutions

• Where a school provisions your account, they may provide: name, email address, year group, age band, and role. Schools are responsible for ensuring they have appropriate authority to share this data with us, see clause 4 and clause 6.

3. How and why we use your data

We will never sell your personal data. We will never use your data or User Content to train AI models without your explicit consent.

4. Young users — Children's Code and age-tiered protections

4a. All users aged 16–17 (standard B2B tier)

The standard Imbu B2B subscription covers students aged 16 and above. Under the Data Protection Act 2018 a child aged 13 or over can consent to an online service in their own right, so offering the standard subscription only from age 16 is our policy choice rather than a legal line. Users aged 16 and 17 remain children for the purposes of the UK ICO Age Appropriate Design Code (the Children's Code), which governs how platforms must be designed and operated for under-18 users. We apply the following Children's Code protections to all users aged 16-17 as a matter of course:

• Privacy settings default to the most protective option, and optional analytics are off by default
• No behavioural or commercial profiling, no targeted advertising, and no analytics for marketing purposes. The Archetype Classification produced by the Imbu North Assessment is different: it is part of the educational service you or your school have signed up for, it is generated from answers you give us deliberately, it is presented as guidance only, and you can view it and retake the assessment at any time
• Data minimisation, we collect only what is necessary for the educational purpose

Where a student registers directly, they provide their own consent at account creation. Where a school provisions the account, the school determines the lawful basis for the processing, and whether parental consent is required is a matter for the school.

4b. Users under 16 (extension tier only)

Access for students under the age of 16 is available only as an optional extension to the standard B2B subscription. Schools must apply in writing to extend access to under-16 students. The following additional protections apply to all under-16 accounts:

• The school as Data Controller is responsible for determining and maintaining a valid lawful basis for sharing under-16 student data with Imbu. The school warrants its lawful basis before any under-16 account is created and retains records accordingly
• Under-16 accounts carry the strictest privacy defaults. Optional analytics, personalisation and non-essential features are switched off. The core educational features the school has chosen to enable, including the Archetype Classification, continue to operate under the lawful basis the school has determined
• All Children's Code protections listed in clause 4a above apply with heightened stringency
• Parents and guardians may contact us at privacy@imbu.world to access, correct, or request deletion of their child's data at any time
• If the school's lawful basis for under-16 processing ceases to apply, the account is deactivated and all data deleted within 30 days of notification

If you are a school wishing to extend access to under-16 students, contact legal@imbu.world.

4c. Direct sign-ups by individuals under 16

Our website does not knowingly accept direct registrations from individuals under 16. We ask for your date of birth at registration and will not create an account where the date given indicates you are under 16. If we become aware that an account has been created by someone under 16 without appropriate authorisation, we will deactivate the account and delete the associated data. Contact privacy@imbu.world if you believe this has occurred.

5. Who we share your data with

6. International data transfers

6a. Cloud infrastructure and AI processing

Our platform is hosted on cloud infrastructure. Core data storage and AI processing take place in the United Kingdom or in another location that provides an equivalent standard of protection recognised under UK law — including, where used, jurisdictions in the EEA covered by UK adequacy. These processing locations are maintained in our processing documentation and are covered by the Google Cloud Data Processing Addendum. Google does not use customer data to train its models.

Some authentication and analytics processing occurs in the United States via Google LLC, which is enrolled in the UK Extension to the EU-US Data Privacy Framework.

6b. Pakistan — schools and institutional users

If your school is in Pakistan, your data is stored in the United Kingdom and your school accesses it from Pakistan through the School Admin Dashboard. That access is covered by an International Data Transfer Agreement between Imbu and your school, which is the safeguard UK law requires before personal data is made available in a country without a UK adequacy decision. Pakistani institutional partners act as Data Controller for their students' personal data and are responsible for determining and maintaining their own valid lawful basis for sharing that data with Imbu, together with the contractual safeguards agreed with us. The tiered age model applies to Pakistani schools in the same way as to all other schools: the standard subscription covers students aged 16 and above, and the Under-16 Extension requires the school to warrant its lawful basis before any under-16 accounts are activated.

6c. Other transfers

This Policy is governed by the UK GDPR. Imbu is a UK-registered company and offers the Platform to schools and individuals in the United Kingdom and in countries outside the European Economic Area. We do not target our services at, or monitor the behaviour of, individuals in the EEA. Where data is processed in the EEA by one of our providers, it is protected under UK adequacy.

7. How long we keep your data

8. AI features, LIA and automated processing

LIA — AI-powered career assistant

LIA is powered by third-party AI infrastructure. All AI processing takes place in the United Kingdom, or in another country that the UK recognises as offering an equivalent standard of data protection. The AI provider does not use your data to train its models. We send only the minimum data necessary for each LIA task; your full profile is not transmitted with every request.

We will never use your personal data or User Content to train AI models without your explicit consent.

8a. Automated Decision-Making and Profiling

Imbu does not make solely automated decisions about you that produce legal or similarly significant effects within the meaning of Article 22 of the UK GDPR. The Archetype Classification generated by the Imbu North Assessment, and the recommendations generated by LIA, are informational and educational outputs. They do not determine any legal entitlement or obligation, and they are not treated as determinative of any subject choice, course, career decision or reference. You are always free to accept, reject or disregard any output from the Platform. You can also ask for a person at Imbu to review it, tell us your point of view, and challenge it and ask for it to be reconsidered. We have assessed this processing against Article 22 and recorded that assessment in our Data Protection Impact Assessment.

9. Data Protection Officer

We have assessed our processing activities against the criteria set out in Article 37 of the UK GDPR and have determined that the appointment of a Data Protection Officer is not currently required. That assessment is recorded in writing, is dated, and is reviewed annually and on any material change to our processing. It will be revisited as our institutional footprint grows. You can request a summary of the assessment by writing to privacy@imbu.world.

10. Your rights

Under UK GDPR: access, rectification, erasure, restriction, data portability, objection, and withdrawal of consent. Parents and guardians may exercise rights on behalf of under-16 children. Contact privacy@imbu.world. Response within one calendar month. Complaints to the ICO at ico.org.uk.

11. Security

Encryption at rest and in transit, role-based access controls, regular security testing, and staff training. Our cloud infrastructure is provided by vendors holding ISO 27001 and SOC 2 certified standards.

12. Changes to this policy

We may update this Policy from time to time. The current version is always available at imbu.world/privacy, and our Cookie Policy at imbu.world/cookies. We will notify you of any material change by email or through the Platform at least 14 days before it takes effect.