Impact Vault
LEGAL

Privacy policy

Lu Lu Min Pty Ltd (ABN 97 684 391 973) trading as Impact Vault. Last updated 14 October 2026.

This is our interim policy. A fuller version reviewed by our lawyers will replace it soon, and we'll tell account holders in the app when it does.

1The short version

  • Your record belongs to you. We keep it so you can use it, and for nothing else.
  • It's stored and backed up in Sydney, Australia.
  • We don't sell data or show ads. The app has no analytics, advertising or crash-reporting tools. Our website uses Google Analytics to count visits, only if you accept cookies (see section 9).
  • Nothing leaves your vault unless you choose to share it.
  • You can export everything, delete any document, and delete your account from inside the app.

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

2What we collect

From you, the account holder

  • Your name, email address and password (the password is held by our sign-in service, and we never see it).
  • Your agreement to our Terms and this policy: which version, and when.
  • Your confirmation that you have the agreement of, or authority for, the person you support.
  • Your own caring record, if you use "What it takes": hours of care, what caring displaces, and how it changes over time.

About the person you support

  • Their name, date of birth, postcode and, if you add it, their NDIS number and plan goals.
  • What you record: entries, photos, letters, documents and reports. This often includes health and disability information.

When you pay or share

  • For App Store subscriptions: Apple's transaction details and the date your access ends. Apple handles your payment, and we never see your card.
  • For invoiced access: the payer's name and email, plan manager details if they pay, the amount, and the access code issued.
  • For shared links: when a link was opened, kept so you can see who has accessed your report.

On our website

  • If you join the Android waiting list, your email address. We use it only to tell you when Android is ready, then delete it.
  • If you email us, your message and email address.
  • If you request an invoice: your name, role, contact details and organisation, the participant's name, their NDIS number if you give it, and where to send the invoice and access code.
  • If a practice requests flyers, we collect the practice name, contact name, email, phone and postal address, and use them only to post the flyers.
  • Visit statistics from Google Analytics: pages viewed, how you arrived, rough location (city level), device and browser type. This isn't linked to your app account.

3How we use it

  • To run the app: keep your record, sync it between your phone and our servers, and build the reports you ask for.
  • To manage your access: your first 7 days of recording, subscriptions and access codes.
  • To send emails you need: sign-up codes, a welcome email, and reports you choose to email.
  • To answer you when you contact us.
  • To understand how the service is going, from counts in our own billing and account records (for example, how many accounts are active each week). These counts never include anything you've written.
  • To meet our legal obligations.

We never use your record to market to you, and we never use it to train AI models.

4Vera, our AI assistant

Vera turns what you say or type into a clear, factual entry, and helps write report summaries. She runs on Anthropic's Claude through Amazon Bedrock, in Australia (Sydney or Melbourne), and is only ever called from our servers.

What Vera receives. The app asks your permission before Vera is first used, and you can turn it off any time in Account. When you use her, our servers send her text only:

  • when you hand an entry to Vera: what you wrote or dictated for that entry, the first name of the person it's about, your relationship to them, the date, and the titles of their plan goals;
  • when you talk with Vera about your week: what you say in that conversation, the first names of the people you look after, and the hours you recorded last time;
  • when a report includes Vera's summary: the entries in that report, the person's first name and pronouns, and the report's purpose and dates.

This can include health or disability information, including about a child. Vera never receives audio, photos, documents, surnames, dates of birth, addresses, NDIS numbers or your email address. We use it only to write the draft, reply or summary you asked for.

How it's protected. Vera runs on Amazon Bedrock, part of Amazon Web Services, in Australia. Amazon Web Services processes it only to run Vera, under its data processing terms with us, which require it to keep the information secure and confidential. Amazon doesn't keep it after Vera replies, doesn't use it to train any model, and doesn't share it with Anthropic, which makes the model.

You see everything Vera drafts before it's saved, can change any of it, and can skip her completely. Your original words are always kept. Vera doesn't give advice, diagnose, or assess eligibility. Your conversations with Vera about your own caring record aren't stored; only the figures you confirm are.

5Where it's stored

Your record is stored and backed up on Amazon Web Services in Sydney, and isn't copied to any other country. A working copy is kept on your phone so you can read and add entries without signal; Vera, reports and sync need a connection.

Some information can leave Australia:

  • Dictation. If you speak an entry, Apple's speech recognition turns it into text. Where your iPhone can't do this on the device, Apple may process the audio outside Australia. Typing avoids this. On Android, the app's own dictation stays on your phone; if you use your keyboard's voice typing instead, that's handled by your keyboard's provider.
  • App updates. When the app opens, it checks with Expo, the service that delivers our app updates, in the United States. That check sends a random number created for that installation of the app and, if an update ever failed to start, a short technical error message, but no personal or health information.
  • Payments. Apple (App Store), Google (Google Play), Xero (invoices) and Stripe (card payments for invoices, through Xero) handle payment details under their own privacy policies, and may do so overseas.
  • What you send. When you email or share a report, it goes to whoever you send it to, wherever their email is held.

6Who else handles it

We use these service providers, only for the purposes described:

  • Amazon Web Services (Sydney): hosting, storage, backups, sign-in and email.
  • Amazon Web Services (Amazon Bedrock, in Australia): Vera, using Anthropic's Claude model. Anthropic doesn't receive your information.
  • Apple: the App Store, subscriptions and dictation.
  • Google: Google Play and subscriptions on Android. Google receives the purchase and a random account identifier. On Android, the app's own dictation runs only on your phone.
  • Expo (United States): app updates. When the app opens, it checks with Expo for a newer version. That check sends a random number created for that installation of the app and, if an update ever failed to start, a short technical error message, but no personal or health information.
  • Xero and Stripe: invoices, and card payments for invoices through Xero, for invoiced access only. We never see or store card details.
  • Google: website visit statistics (Google Analytics), on our website only. Google may process this outside Australia.

We don't sell or rent personal information, and don't share it with anyone else unless the law requires it, such as a court order or subpoena.

7Sharing your record

Only you decide what's shared and who with. You can share a report as a PDF, or as a secure link. A link only opens with a separate six-character code, expires after seven days, locks for an hour after five wrong codes, and you can close it at any time. Deleting a report closes its links straight away. A PDF you've already sent can't be recalled.

Your own caring record is private by default. It's included in a report only if you tick the box for that report, every time.

8Sensitive information and consent

Health and disability information is sensitive information under the Privacy Act. We collect it only with consent, and only because you've chosen to record it.

Account holders must be 18 or over. When you add the person you support, you confirm that they've agreed, or that you have the authority to keep a record about them, for example as a parent or guardian. If you record information about other people, such as a teacher or therapist, please keep it factual and relevant.

9Analytics, cookies and tracking

The app doesn't collect usage analytics, and has no advertising, tracking or third-party analytics tools. If we ever add usage statistics, they'll be optional, off unless you tick a box, never include what you write, and never be linked to your account. We'll update this policy first.

Our website uses Google Analytics to count visits and show us which pages are read. It only runs if you choose Accept on the cookie banner. We use it only to improve the site, not for advertising, and it isn't linked to app accounts. You can change your choice at any time with "Cookie settings" at the bottom of every page. Our cookies policy lists the cookies we use. Like any website, our hosting keeps short-term technical logs (such as IP addresses) for security.

10How long we keep it

  • Your record: for as long as you have an account. It isn't deleted because a subscription ends.
  • Invoices and the requests behind them: 7 years from the end of the financial year they were issued in, because Australian tax law requires it. Requests that never become an invoice are deleted after 12 months.
  • Deleted documents: removed from your vault and any shared links straight away, and can't be put back. The file is permanently destroyed within 30 days and gone from backups within about two months. After that we keep only a note that a document was deleted and when, with no name, subject or contents.
  • Reports you sealed before deleting a document still list it by name, because a sealed report can't be changed. The document itself can no longer be opened.
  • Deleted entries and reports: you can put them back for 30 days. After that they're permanently deleted, and gone from our backups within about two months.
  • Deleted accounts: you have 30 days to change your mind, then everything is permanently deleted, and gone from backups within about two months.
  • Export files: 7 days. Shared links: 7 days. Link access logs: 90 days.
  • Billing records: as long as tax law requires.
  • Android waiting list: until we've told you Android is ready.

11Your choices and rights

  • See and correct: everything you've recorded is in the app, and you can edit it there. For anything else, email us.
  • Export: download your whole record at any time, whether or not you're subscribed.
  • Delete: delete a document from its details screen, delete entries and reports, or delete your whole account (Account → Delete account).
  • Unsubscribe: from the Android list, by replying to any email from it.

We'll respond to access or correction requests within 30 days.

12Security and data breaches

Your record is encrypted in transit and at rest, and access to our systems is tightly limited. Your phone's own passcode protects the copy on your device, so please keep it set.

If a data breach is likely to cause serious harm, we'll tell the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

13Contact and complaints

For privacy questions, requests or complaints, email support@impactvault.com.au. A person will reply, and we aim to resolve complaints within 30 days.

If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

If we change this policy, we'll update the date at the top and tell account holders in the app about any significant change.