Version 1.0 · Last updated: 5 October 2026.
This Privacy Policy explains how Vanderwalt Trading Pty Ltd (ABN 87 633 334 291), trading as Leadership Intelligence System ("LIS", "we", "us", "our"), collects, uses, discloses, stores and protects your personal information when you use the LIS platform at thinklis.ai and its associated web and mobile applications (the "Service").
LIS is a structured AI thinking partner for leaders. By its nature, the Service processes the substance of your thinking — the situations, decisions, people and reflections you bring to a session. We treat that content with the highest level of protection because it may include sensitive or special category personal data, and we have built the Service around protecting it.
We are based in Australia, and this policy is framed primarily around the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where you are located in another region, additional rights apply to you and are set out in Section 12 — including the EU and UK GDPR, South Africa's POPIA, and the PDPL regimes of the UAE and Saudi Arabia.
Please read this policy together with our Terms of Service.
A plain-language overview. The detail follows in the rest of this policy.
— Your sessions are yours. Your session content — your conversations, the memories and profile we build from them, voice transcripts, summaries and commitments — may contain sensitive or special category personal data. Because users frequently discuss matters capable of revealing this information, LIS applies the same high level of protection to all session content, and processes it with your explicit consent.
— We do not sell your data, and we do not use third-party advertising or analytics trackers. There are no marketing cookies and no session-replay scripts.
— Voice audio is never stored. In voice mode we transcribe your speech to text and discard the audio. We keep only the transcript — the same text we would keep if you had typed. We do not create voiceprints or other biometric data.
— Files you share are read, not kept. If you attach a document to a session, we convert its content to text ("notes"), keep those notes as part of that session, and immediately discard the original file. You can see exactly what was captured, and remove it, at any time. By default nothing a document says becomes a lasting memory or story, and a session where you shared one is not captured as a story; what you type or say yourself is still remembered as usual. You can allow a session to draw on its documents if you want to.
— Memories and stories are about you — the observations the Service notices automatically in your sessions, and the longer arcs it keeps as your "stories". You can read, correct and delete both at any time, and you can turn story capture off.
— Your development record is yours to share, or not. LIS derives leadership-competency evidence from your sessions (you can turn this off). Development Evidence Reports never contain session content and are only ever shared by you, per report, with links you can revoke.
— Strict isolation. Your sessions, memories, stories and profile are visible only to you. Other members of your organisation, including administrators, cannot see them.
— You are in control. You can export your data, correct it and delete your account from within the app, and withdraw your consent at any time (Section 11).
— Where your data goes. Your primary data is stored in Australia. To generate responses, your session content is sent to specialist AI providers (currently Anthropic and OpenAI) that may process it in the United States. Payments are handled by Stripe, and your card number never reaches us. See Sections 8 and 9.
— If your access ends, you are told first. When a paid subscription ends or an Organisation stops funding your seat, you keep access for a set period so you can export your data or subscribe, and in every case we email you before anything is deleted (Section 10).
Every user works in their own personal workspace. An organisation that provides your LIS access ("Organisation Customer") funds and administers your seat. It never holds, hosts, or accesses your session content.
For your personal workspace — your conversations, memories, stories, profile, Growth and development record — LIS is the data controller (in APP and GDPR terms): we decide how and why this personal information is processed, and this Privacy Policy governs that processing directly. This is true whether you pay for LIS yourself or an Organisation funds your seat. You exercise your privacy rights over session content directly with us (Section 11). If an Organisation stops funding your seat, your session content stays yours: it is never transferred to the Organisation, and what happens to it is set out in Section 10.
Where an Organisation funds your seat, we process a limited set of information on the Organisation's behalf so it can administer what it pays for:
— Seat and membership data — that you hold a seat, the name and email provided for the roster, your role, and your seat status (for example active, suspended or removed) and when it last changed.
— Usage and cost information — token and cost figures attributed to the Organisation's billing, per seat.
For this administrative data, your Organisation is the data controller — it decides that LIS will be offered and on what terms — and LIS acts as a data processor on its documented instructions, under a separate customer agreement and Data Processing Addendum (DPA). Requests about your seat, your roster entry, or your Organisation's decision to provide LIS should be directed to your Organisation first; we will assist them in responding.
Your session content stays private to you. Organisation administrators can manage membership, roles and seat status, and can see operational information such as usage and cost, but they cannot read your conversations, memories, stories or profile. That isolation is enforced in the application, in every database query, and in every memory search.
We collect the following categories of information.
Provided by you or your Organisation, or via the identity provider used to sign you in:
— Name, email address, and (optionally) role or title, short bio, timezone, and language or locale.
— Your workspace memberships and role (owner, admin, member, viewer).
— Authentication identifiers from our identity provider (Authentik), and, where your Organisation uses single sign-on, the identifiers your Organisation's directory passes to us.
The heart of the Service, and the information we protect most carefully. We refer to this collectively as your session content:
— The messages you send in a session (typed or spoken).
— The content of documents you share in a session, converted to text. When you attach a file (currently PDF, Word, Excel, PowerPoint, CSV, or plain-text documents, and images such as PNG, JPEG or WebP), we extract its text during upload and immediately discard the original file — the file itself is never retained in our database, on disk, or by any third party. Text-bearing documents are read by our own software; images and scanned PDFs are read by our reasoning and response provider (currently Anthropic, with OpenAI as automatic failover — see Section 8.1), where the file is transmitted once to convert its content to text, then discarded everywhere. What we keep is the text extract ("notes"), stored encrypted as part of that session, together with basic file details (name, type, size). The app shows you exactly what was captured ("What LIS read") and lets you remove it from the session at any time. By default, document content is used only as context within that session — it is not turned into memories, stories or profile facts about you. The first time you share a document in a session we ask you to choose: keep that session private (the default, and what happens if you don't answer), or allow that session to draw on what you shared when building your memory and stories. Your choice covers everything you share in that session and applies to that session only. You can set a standing answer — including "ask me each session" — under Documents and memory in Your information; changing it applies to new sessions and never changes a session that has already made its choice.
— Session metadata — which thinking mode and stage you are in, session titles (auto-generated from your opening exchange), and timestamps.
— Mode summaries and commitments you arrive at during a session.
— Continuity context linking related sessions.
This content can reveal information about your professional circumstances, the people you work with, your decisions, and your inner state. We treat all of it as sensitive or special category personal information (see Section 5).
When you use voice mode:
— Your speech is streamed to a speech-to-text provider, transcribed in real time, and the audio is discarded. We do not retain raw audio recordings, and we do not generate voiceprints or other biometric identifiers.
— We retain the resulting text transcript, which is treated exactly like a typed message.
— To speak responses back to you, the assistant's text is sent to a text-to-speech provider.
The Service builds a longitudinal understanding of how you think:
— Memories — short observations the Service notices automatically in your sessions, drawn from what you say and how you engage; the AI's own output is not the subject of memory. These are classed as patterns (tendencies, habits, growth edges) or facts (your role, organisation, key people and relationships).
— Consolidated themes — recurring observations matured into higher-level themes.
— Stories — the longer arcs of your leadership: a challenge, an initiative or a decision you keep returning to, held as a short title, a summary, and a fuller account that grows as you come back to it. When a session develops a thread worth keeping, the Service writes it up as a new story or folds it into one you already have, and tells you on the closing card; later sessions can draw on the summary so your thinking carries forward. Stories are built from what you say in a session — never from a document you shared, unless you allowed that session to inform them (Section 4.2). You can read, edit and delete any story in your information panel, and you can stop the Service creating or growing them with Capture stories from sessions in Your information; stories you already have are kept unless you delete them.
— Your profile and "Growth" — a synthesised picture of your defining traits, plus a history of how that profile has changed over time and a plain-language development narrative.
— Development record (leadership competencies) — at the end of each session, the Service reads the session against a fixed framework of 28 leadership competencies and derives which competencies you engaged and how deeply (a 1 to 5 scale), the type of challenge you brought, and any growth indicators (shifts across the session, such as reframing a problem). It also drafts a short session synopsis, which becomes part of your development record only if you confirm it, and personal insights are recorded only in your own words. You can turn this off entirely with "Keep a development record" under Memory in your account settings.
— The evidence basis behind each inferred label (a short paraphrase of what the system matched) is held internally, never appears in the product or in any report, is included in your data export because it is your personal data, and is deleted with your account.
— Development Evidence Reports — you can generate a report of your engagement patterns, competency labels and your own insights for a period. A report is only ever shared by you: each release requires your explicit per-report authorisation, share links expire and can be revoked, and reports never contain session content. Your organisation has no access to your development record or reports unless you release a report to someone yourself.
Memories, stories, profile and your development record are derived from your session content and inherit its sensitivity. Semantic search over your memories and stories is powered by an embedding model that runs on our own infrastructure — that content is not sent to an external embedding service.
— Token and cost usage for each interaction (model used, token counts, latency, whether the work was a live session or background processing, and voice speech-to-text and text-to-speech costs), used for billing, capacity and abuse prevention.
— Technical and operational logs. We keep operational logs to run the Service securely. Logs are automatically scrubbed of secrets and personal identifiers — emails and names are masked, request payloads are not logged, and only stable opaque identifiers and trace IDs are retained.
— Device and PWA information strictly necessary to deliver the app. No session content is cached on your device by our installable app.
For individual subscriptions, we collect and store the information needed to manage your subscription and to prevent repeated misuse of the free trial:
— Your subscription record — the plan and price you are on, whether you are billed monthly or yearly, its status (including trialling, active, past due, paused, cancelled or expired), trial and current-period dates, cancellation/renewal flags, and limited reconciliation state.
— A limited billing display copy — the type of payment method and, for a card, its brand, last four digits and expiry month/year (or, for a wallet such as Stripe Link or PayPal, a partly masked version of the email address it uses); customer-facing invoice number, status/reason, currency, amounts (including tax, refund and dispute summaries), billing period and status dates; and short-lived Stripe-hosted invoice/PDF links. These fields are explicitly allowlisted rather than copied from a raw Stripe object.
— Identifiers issued by Stripe — the customer and subscription references Stripe creates for your account. We store these so we can retrieve your billing information and act on your instructions, such as changing or cancelling your plan.
— One-way trial-abuse signals — keyed, non-reversible digests made from the opaque card fingerprint Stripe supplies and from your normalised email address. We do not store the raw card fingerprint. These signals cannot make a payment or reconstruct card details and are used solely to enforce the free-trial allowance.
— Your trial and subscription history — when a trial began and how the subscription ended (converted to paid, cancelled, or terminated).
— Sign-up verification — the email address you enter when you start a subscription, and one-way verifiers of the codes we email you to confirm it (never the codes themselves), held while your sign-up is in progress.
— Complimentary or discounted access — if we give you free or discounted access: the rate; how long it runs (a number of billing periods, or an end date, if it has either); the billing periods it has been applied to, with the amount taken off each; who granted it and why; and when it ended.
What we do not hold. Your full card number, security code and billing address are entered on Stripe's own payment page and are never stored in our systems (Section 8). We do not store raw Stripe Customer, Subscription, Invoice or PaymentMethod objects, complete payment credentials, or invoice documents. Stripe-hosted invoice links are access capabilities: we omit them from your data-export archive, never log them, erase them with your account, and clear them promptly when their local projection becomes orphaned. As our payment processor, Stripe keeps its own accounting/payment records under its obligations and privacy policy.
After your account is closed. Before local erasure, we reconcile every known subscription with Stripe and cancel any subscription that could still charge; if Stripe is unavailable or the association is ambiguous, deletion is held rather than guessed. The account's billing-customer link, subscription and invoice display copies, invoice/PDF links, and consumed-signup operational identifiers are then deleted. For a confirmed transfer to organisation funding, we retain a separate, minimal financial reconciliation receipt: the provider references, service-period and payment amounts, cancellation and credit status, and relevant timestamps. We remove its link to your LIS user identity during erasure; it contains no name, email, payment credentials or coaching content. This preserves the ability to reconcile credit owed to you and prevents duplicate credit after a lost provider response. A separate pseudonymous trial-abuse ledger retains only the keyed signals, trial decision/dates and minimum opaque attempt/subscription provenance needed to enforce the allowance, on the basis of our legitimate interest in preventing repeated trial misuse. Stripe independently retains processor accounting records under its own legal obligations.
— Feedback, feature requests, bug reports and support messages you send us, and our replies.
— Operational notifications we send you within the app (for example, "your data export is ready").
We use a small number of first-party cookies only (Section 13). We do not use third-party advertising, analytics or cross-site tracking cookies.
Because LIS exists to help you think through real leadership situations, your session content — conversations, voice transcripts, the text extracted from documents you share, memories, profile, summaries, commitments and related support text — may constitute sensitive information under the Privacy Act and special category data under the GDPR (Article 9) and equivalent provisions of POPIA and the PDPL regimes.
We process this information only with your explicit consent, which we record against the specific version of this Privacy Policy and our Terms that you accepted (see Section 7). You can withdraw that consent at any time (Section 11). Withdrawing consent stops further processing of that kind, and you can also delete the underlying content. Because processing your session content is how the Service works, withdrawing consent means we can no longer provide the Service to you; you can export your data before you withdraw. If you withdraw during a paid subscription term, the cancellation and refund terms in our Terms of Service govern any refund.
We do not use your session content for advertising, for profiling unrelated to the Service, or for any purpose other than providing and protecting the Service as described here.
We use your information for the purposes below. The "lawful basis" column applies where the GDPR or an equivalent regime requires us to identify one; in Australia the equivalent test is consent (for sensitive information) and reasonable necessity for our functions.
Provide the core Service — What this involves: Running sessions across the thinking modes, voice mode, session continuity, and saving your sessions. Lawful basis: Performance of our contract with you (GDPR Art. 6(1)(b)); explicit consent for the sensitive content within it (Art. 9(2)(a)).
Build memory, stories, profile and Growth — What this involves: Extracting memories from your words — and, only for sessions where you have allowed it, from documents you shared in that session — consolidating themes, capturing and growing your stories when a session closes, synthesising your profile and development narrative. Your per-session choice about documents is recorded with the session and is included in your data export. Lawful basis: Explicit consent (Art. 9(2)(a); Art. 6(1)(a)). You can review, correct and remove the facts and stories LIS holds about you at any time in your information panel, and you can turn story capture off.
Development record and evidence reports — What this involves: Deriving competency engagement, challenge types and growth indicators from your sessions; drafting session synopses for your confirmation; generating Development Evidence Reports you choose to release. Lawful basis: Performance of contract; explicit consent for the sensitive content (Art. 9(2)(a)). You can turn the development record off under Memory in your account settings; reports are shared only on your explicit per-report authorisation.
Voice transcription and speech — What this involves: Converting speech to text and assistant text to speech. Lawful basis: Performance of contract; explicit consent for the sensitive content.
Account, access and security — What this involves: Authentication, workspace membership, enforcing isolation, preventing abuse, audit logging of privileged access, and breach detection. Lawful basis: Legitimate interests in operating a secure service (Art. 6(1)(f)); legal obligation where applicable (Art. 6(1)(c)).
Usage, cost and capacity management — What this involves: Tracking token and cost usage, enforcing spend caps, capacity planning, and billing your Organisation. Lawful basis: Performance of contract; legitimate interests.
Billing and subscription management — What this involves: Taking payment for individual subscriptions and managing your trial, renewals, cancellations and plan changes through Stripe. Lawful basis: Performance of our contract with you (Art. 6(1)(b)).
Preventing free-trial misuse — What this involves: Using keyed one-way digests of the card fingerprint Stripe supplies and of your email address to recognise repeated sign-ups and prevent repeated use of the free trial, including after account deletion (for up to 2 years). Lawful basis: Our legitimate interest in preventing misuse of the free trial (Art. 6(1)(f)).
Support and communication — What this involves: Responding to feedback and support requests and sending operational notifications, including billing notices and the notices we send before an account is deleted. Lawful basis: Performance of contract; legitimate interests.
Legal and compliance — What this involves: Meeting our legal, tax and regulatory obligations, and establishing or defending legal claims. Lawful basis: Legal obligation (Art. 6(1)(c)); legitimate interests.
We do not carry out automated decision-making that produces legal or similarly significant effects about you. The Service's AI generates responses to support your thinking; it does not make decisions about you.
When required, we ask for your explicit consent to this Privacy Policy and our Terms before processing your session content. We record:
— the specific version of each document you accepted,
— the time you accepted it, and
— the lawful basis that applies.
These consent records are kept as legal evidence and are included in your data export. If we publish a new version of a document that materially changes how we handle your information, we will ask you to review and accept it before you continue using the affected parts of the Service. You can review the current versions at any time at thinklis.ai/privacy and thinklis.ai/terms, and your acceptance status under Security & data in your account settings.
To deliver the Service we rely on a small set of carefully chosen service providers ("sub-processors"). The most important to understand are the AI providers that generate responses and power voice mode, because your session content is transmitted to them to produce a reply.
What we share is defined by AI role — the job being done — not by vendor. The table binds each role to the data it may receive; the provider column shows the current assignment, which we may change under Section 8.2 (the data boundaries themselves do not change without an updated policy).
Reasoning and response generation — generates responses (text and voice sessions) and performs background processing, including reading documents you share. Data shared (fixed per role): Your session messages and the context needed to reply, including the text extracted from documents you share in a session. For images and scanned PDFs only, the file itself is transmitted once so its content can be read, then discarded; text documents are converted by us and the original file is never transmitted. Current provider: Anthropic (Claude) — primary; OpenAI — automatic failover when the primary is unavailable. Processing location: United States.
Voice — speech-to-text transcription and text-to-speech. Data shared (fixed per role): Your spoken audio (transiently, for transcription) and the assistant's text (for speech). This role never receives your documents or their extracted text. Current provider: OpenAI. Processing location: United States.
Supporting (non-AI) sub-processors:
DigitalOcean — Role: Cloud hosting and encrypted backups of the platform. Data shared: All stored platform data (at rest, in our region). Processing location: Australia (Sydney).
SMTP2GO — Role: Delivery of transactional email (sign-up verification codes, invitations, billing and account notices, and other notifications). Data shared: Recipient email address and message content. Processing location: Routed via Australian endpoint.
Stripe — Role: Payment processing for individual subscriptions (billing, card processing, refunds). Data shared: Your email address and our internal account references, so Stripe can hold your customer record; card and billing details you enter on Stripe's payment page (these never reach our systems). Stripe returns to us subscription and customer references, a card fingerprint and the limited billing display copy described in Section 4.6. Processing location: United States and globally (see Section 9).
If we change an AI provider. We may reassign a role to a different provider, or add one. If we do, we will update this table and notify you in the app before your content is processed by the new provider; the role's data boundary stays as written above. Our systems enforce the assignment in software — for example, document content is only ever sent to the provider listed for the reasoning and response generation role.
No-training commitment. We use these AI providers under their commercial and API terms, which provide that content submitted through their APIs is not used to train their models — Anthropic's Commercial Terms of Service ("Anthropic may not train models on Customer Content from Services") and OpenAI's Business Terms ("OpenAI will not use Customer Content to develop or improve the Services"). API inputs and outputs are subject to each provider's limited operational retention (currently up to 30 days, longer only where required for safety or by law). This commitment is a condition of any provider we assign to a role.
Administrator-configurable models. LIS is model-agnostic. An administrator may enable additional AI providers (for example, Google Gemini) or, for data-sovereignty-sensitive customers, an on-premise model that keeps session content entirely within the customer's own infrastructure. The current, live list of AI sub-processors in use for your workspace is available on request.
Local processing. Semantic memory search uses an embedding model that runs on our own infrastructure — your memory content is not sent to a third-party embedding service. Identity is handled by Authentik, which we self-host.
We maintain our list of sub-processors and will update it when it changes. Where we act as processor for an Organisation Customer (Section 3.2), our DPA governs how we notify the Organisation of new sub-processors.
Your primary data storage and backups are located in Australia (Sydney).
However, to generate responses and to power voice mode, your session content (and, in voice mode, your audio for transcription and the assistant's text for speech) is transmitted to AI sub-processors that may process it in the United States or other countries (see Section 8). This means your sensitive information may be transferred outside your home country.
Where we transfer personal information across borders, we take steps to ensure it remains protected:
— We process your sensitive content with your explicit consent, including to the cross-border processing described here.
— Where required by applicable law, we implement appropriate safeguards for international transfers of personal information. As the controller of your session content, we are responsible for ensuring that appropriate transfer mechanisms are in place for our international data transfers. We put these mechanisms in place through the data processing terms of our AI providers and other sub-processors, including the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, where applicable. We select sub-processors that provide appropriate contractual commitments for the protection of personal information and keep those arrangements under review.
— Under the Australian APPs, we take reasonable steps to ensure overseas recipients handle your information consistently with this policy.
Regional data residency (pinning AI processing to a specific region, such as Australia) is on our roadmap for customers with strict residency requirements. If your organisation requires in-region AI processing today, contact us to discuss an on-premise or regional deployment.
We keep personal information only for as long as we need it for the purposes above, then delete or de-identify it.
Session content, memories, stories, profile, development record, evidence reports, summaries, commitments — Kept while your account is active. Deleted when you delete your account (after a 24-hour period in which you can change your mind, then a durable purge across our database and the memory vector store).
Individual memories — Deleted immediately when you remove a fact from your information panel; your profile is then rebuilt so the content cannot resurface.
Individual stories — Deleted immediately when you delete a story in your information panel — both the story and the index entry that made it retrievable are removed. Turning off Capture stories from sessions stops new ones being created; it does not delete the ones you have.
Documents shared in a session — The original file is never stored — its content is converted to text during upload and the file is discarded in the same request. The text extract ("notes") is kept encrypted as part of that session: when you remove a document from the session it is removed from use immediately and durably deleted shortly afterwards; otherwise it is deleted with the session or with your account.
Account and identity information — Kept while your account is active; removed or de-identified on account deletion.
Subscription and billing data — Your allowlisted subscription/invoice display records, card brand/last four/expiry, Stripe account references and hosted-invoice/PDF links are kept while associated with your active account and deleted with it. If a projection becomes orphaned, capability links are cleared on the next daily sweep and the remaining facts are deleted after 30 days by default (configuration is bounded to 1–365 days). Raw Stripe objects, invoice documents, full card numbers, security codes and billing addresses are not stored.
Free-trial abuse-prevention data — Keyed, non-reversible card-fingerprint and email signals, the trial decision/dates and minimum opaque attempt/subscription provenance are retained after account deletion on the basis of our legitimate interest in preventing repeated trial misuse, and deleted 2 years after they were recorded. They are not payment credentials, but the retained subscription provenance may remain linkable to Stripe's processor record.
Billing delivery jobs — Pending jobs retain only the data needed to complete an owed cancellation, subscription creation, identity restoration or alert and are never expired while the effect is owed. Provider-command detail is removed as soon as it settles; payload, deduplication and error detail on all other terminal jobs is removed after 30 days by default and never later than 90 days. Non-identifying kind/state/counter/timestamp facts may remain for delivery audit.
Accounts whose subscription has ended — If a subscription you have paid for ends — or complimentary access we gave you ends — and it is not replaced, the account enters a 14-day limited-access period (you can sign in, read your sessions and export your data, but not start new sessions). At the end of it, the account and all content listed above are permanently deleted on the same durable purge path as a self-service deletion. If a subscription ends before any payment was made — a free trial you cancelled, or a trial whose first payment could not be collected — there is no limited-access period, and the account is deleted when the subscription ends. In every case we email a final notice at least 24 hours before deletion. If our records and Stripe's disagree about a subscription, or collection of payment is paused, the account is held and nothing is deleted until that is resolved.
Accounts whose organisation funding ends — If an Organisation stops funding your seat, its account is suspended or closed, or it removes your seat — and you are not funded another way — you keep full access for 14 days, then have 60 days of limited access in which you can export your data or take out your own subscription and keep everything. If you have not subscribed by then, the account and all content listed above are permanently deleted on the same durable purge path as a self-service deletion. We email you when your access becomes limited, a week before deletion, and the day before.
Beta accounts — If you joined LIS during its beta and your beta access has ended, the account moves to limited access and is not deleted for that reason; it is kept until you delete it.
Unfinished sign-ups — If you start signing up but do not finish, the email address you entered and the one-way code verifiers are deleted 90 days after the sign-up attempt ends.
Invitations — An invitation's email address and link are kept until it is used or expires, then for 30 days. An invitation that is withdrawn is deleted.
Data export files — Encrypted and held only briefly (about 48 hours), then automatically purged.
Deletion audit record (tombstone) — After an account is deleted we retain a minimal record (an opaque user ID, the email temporarily in plaintext and as a keyed pseudonymous token, and deletion metadata) to prove the deletion occurred and apply the repeated-free-trial policy. Legacy records may instead contain an older unkeyed hash during migration. The plaintext email, names, and either token/hash are erased after 2 years, leaving only the opaque ID and deletion metadata.
Held-deletion authority record — Where a legacy deletion has no reliable source, an administrator must identify the authority from an external record before it can proceed. We retain an append-only, pseudonymous record of the source transition. The administrator ID and identifier-shaped external-record reference are held separately and erased no later than 2 years. The field is restricted to an opaque record-ID syntax, and administrators are instructed not to enter names, contact details, narrative notes, or other personal data.
Report release audit trail — Minimal lifecycle events for evidence reports (opaque report ID, action such as authorised or link revoked, timestamp, never content) are retained append-only as evidence of what you authorised and released.
Usage, cost, support and notification records — Usage and cost records are kept for up to 3 years, in-app notifications for 1 year, and resolved feedback and support tickets for 2 years, then purged on a schedule. All are deleted or de-identified when your account is deleted.
Voice spend-cap receipts — A content-free operational ledger (opaque attempt identifier, UTC date, voice component, quoted/actual micro-cost and state) is kept for 7 days by default and never longer than 30 days, then purged. It contains no prompt, transcript or audio and is deleted immediately with your account.
Operational logs — Retained for up to 12 months, scrubbed of personal identifiers.
Backups — Encrypted backups are kept on a rolling basis of up to 90 days; deleted data ages out of backups within that window.
Consent records — Retained as legal evidence for as long as needed to demonstrate lawful basis.
When LIS acts as a processor for an Organisation Customer, retention may be governed by the Organisation's instructions and our DPA.
You have rights over your personal information. Many of these you can exercise yourself, instantly, inside the app, under Security & data in your account settings:
Access and data portability — get a copy of your data. Request a self-service export from Security & data. We build an encrypted archive covering all of your information across the platform and notify you when it is ready to download.
Rectification — correct inaccurate data. Edit your profile fields directly; review, add, correct or remove the facts LIS holds in your information panel; write, edit or delete any story; and confirm or decline any session synopsis and edit or remove your development-record insights at any time.
Erasure — delete your data. Remove individual facts or stories from your information panel with one action, or delete your entire account from Security & data. Account deletion durably purges your content from our database and memory vector store.
Restriction — limit processing. Remove facts from your information panel to suppress them; turn off "Capture stories from sessions" to stop the Service creating or growing stories; turn off "Keep a development record" to stop competency inference entirely; or contact us to restrict processing.
Withdraw consent — Because processing your session content is how the Service works, withdrawing consent means we can no longer provide the Service. You can withdraw it in the app by deleting your account (Security & data), or by contacting privacy@thinklis.ai. Withdrawing consent stops the affected processing going forward; export your data first if you wish to keep it. If you are on a paid subscription, any refund is governed by the cancellation and refund terms in our Terms of Service.
Object to certain processing — Contact us (Section 18).
For requests that cannot be completed in-app, contact us at privacy@thinklis.ai. We will respond within one month, as required under the GDPR and ordinarily under the Australian Privacy Act. We may need to verify your identity first. These rights are free to exercise, though we may charge a reasonable fee for manifestly unfounded or excessive requests where the law allows.
If an Organisation funds your seat, direct requests about your seat, roster entry or the Organisation's use of LIS to your Organisation first (Section 3.2); requests about your session content come directly to us.
The rights in Section 11 are available to all users. Depending on where you are, additional or specific rights apply:
— Australia (Privacy Act and APPs). You may access and correct your personal information and complain about how we handle it. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
— EU and UK (GDPR and UK GDPR). You have the rights of access, rectification, erasure, restriction, portability, objection, and to withdraw consent. You may lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office, ico.org.uk). Our processing of special category data relies on your explicit consent (Art. 9(2)(a)).
— South Africa (POPIA). You may access, correct and delete your information and object to processing, and you may complain to the Information Regulator (South Africa). Our operator (processor) arrangements are governed by written agreement.
— United Arab Emirates and Saudi Arabia (PDPL). You have rights of access, correction, deletion, and to withdraw consent, and to be informed about cross-border transfers of your data. You may contact the relevant data protection authority in your jurisdiction.
In all regions you may contact us first at privacy@thinklis.ai. We aim to resolve concerns directly.
LIS uses a deliberately minimal, first-party-only cookie footprint. We do not use advertising cookies, third-party analytics, session-replay, or cross-site tracking.
Session and authentication cookies — Type: Strictly necessary. Purpose: Keep you signed in and secure your session.
lis-colour-scheme — Type: Functional (first-party). Purpose: Remembers your theme preference so the app looks the way you set it.
Sign-up cookies (lis_signup, lis_enrolling) — Type: Strictly necessary. Purpose: Keep your place while you sign up and pay, including when you return from Stripe's payment page and while your account is being set up. They are not used once sign-up is over.
lis_seen — Type: Functional (first-party). Purpose: Remembers that this browser has signed in before, so opening the app takes you straight to sign-in rather than the sign-up page.
Local app storage — Type: Strictly necessary. Purpose: Stores app state needed to run the installable web app. No session content is cached.
Because we use only strictly necessary and first-party functional cookies, with no tracking or optional marketing cookies, no separate cookie-consent banner is required. If we ever introduce optional cookies or third-party scripts, we will ask for your consent first and provide a preference control.
Security is built into the platform, not bolted on. Our measures include:
— Strict per-user and per-organisation isolation, enforced at three independent layers — application logic, every database query, and every memory search — so your content is invisible to other users, including teammates and administrators.
— Encryption in transit — public traffic is protected with TLS, and internal service-to-service traffic carrying personal data is encrypted.
— Encryption at rest for sensitive material — stored provider credentials and your data-export archives are encrypted using envelope encryption; database backups are encrypted before they leave our systems.
— Audit logging of privileged access — access to user data by administrators or investigators is recorded to an append-only audit trail, with a read-only, least-privilege investigator role.
— Breach detection and monitoring — security metrics, centralised logging and alerting designed to surface anomalous access, such as unusual exports or bulk reads.
— Secret and PII redaction in logs, rate limiting on sensitive endpoints, immediate revocation of access when an account is suspended or deactivated, defence against header spoofing, and CSRF protections.
— Hardened infrastructure — non-root containers, data services on a private network only, daily encrypted backups, and tested restore procedures.
No system is perfectly secure, but we work continuously to protect your information and to limit what we collect in the first place.
If a data breach occurs that is likely to result in serious harm or a risk to your rights, we will:
— assess and contain the incident,
— notify the relevant supervisory authority without undue delay (and, where the GDPR applies, within 72 hours of becoming aware), and
— notify affected users where required, including under the Australian Notifiable Data Breaches scheme, the GDPR, POPIA and the PDPL regimes.
Where we act as processor for an Organisation Customer, we will notify the Organisation without undue delay so they can meet their own obligations.
LIS is a professional tool intended for adults. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.
We may update this Privacy Policy from time to time. The current version always governs and is published at thinklis.ai/privacy, with its version and effective date shown. If we make a material change to how we handle your personal information, we will notify you and, where required, ask you to review and accept the new version before continuing to use the affected parts of the Service. Previous versions are retained and available on request.
Vanderwalt Trading Pty Ltd, trading as Leadership Intelligence System
13a View Street, East Maitland, NSW 2323, Australia
Privacy enquiries: privacy@thinklis.ai
If you have a concern about how we handle your personal information, please contact us first. We take privacy seriously and aim to resolve issues directly. You also have the right to complain to your local data protection authority (Section 12).
Contact us at privacy@thinklis.ai, or read our Terms of Service.