Innatium Privacy Policy

Policy version: privacy_v2
Status: Final approved
Effective date: 2026-10-07
Last updated: 10 October 2026

This Privacy Policy explains how Innatium Pty Ltd (Innatium, we, us, our) collects, holds, uses and discloses personal information in connection with Innatium.

Innatium is based in New South Wales, Australia. The Service is currently intended for people in Australia aged 18 or older.

ABN: 34 321 685 019
Privacy contact: privacy@innatium.com.au

1. Scope

This Policy applies to personal information handled through Innatium's website, applications and related services, including Profiles, Posts, Decisions, Decision Intelligence, social features, personalisation, notifications, referrals, Innatium Credits and membership features.

It should be read with the Innatium Terms of Use.

2. Personal information we collect

Depending on your use, we may collect:

Account and authentication information

• email address
• username
• display name
• authentication identifiers
• email-confirmation and account status
• authentication/security records
• onboarding state
• Terms/Privacy consent records and versions

Profile and identity information

• username and username history
• display name
• bio
• Decisioner/banner selections
• custom avatar/banner images
• membership presentation
• public Profile metrics

Some Profile information is public by design.

User Content

• Posts
• Decisions
• replies
• Profile text
• uploaded images
• other content/interactions you submit

Public content may be visible to other users and visitors according to the Service's visibility rules.

Decision and analytical information

We may hold information associated with Decisions and their evidence, such as:

• asset/company
• direction
• horizon
• target/confidence information where applicable
• reference/completion information and timestamps
• target progress/achievement
• directional return
• excursion evidence
• Decision-quality observations
• rating snapshots
• information used by Innatium's published analytical methodologies

We use this to operate Decisions, Decision Intelligence, ratings, rankings and related analytics.

Social and interaction information

This may include:

• follows
• likes
• replies
• bookmarks
• Decision tracking
• notifications
• supported sharing actions
• other platform interactions

Qualified-view information

Innatium measures qualified views for eligible Posts and Decisions.

The current system may use:

• authoritative content identity
• authenticated user identity when signed in
• a privacy-safe random browser token for anonymous viewers
• a hashed form of that anonymous token
• qualification timestamp
• methodology version
• information required to apply visibility, dwell-time and deduplication rules

The current qualified-view system does not require invasive device fingerprinting such as canvas or font fingerprinting.

An anonymous browser token is not treated as a perfect identity of a natural person.

Private personalisation preferences

During onboarding or in Settings, you may choose:

• sector interests
• companies/assets you follow
• Decision horizons that interest you
• content categories you want to see more of

These preferences help personalise your experience and are not intended to appear on your public Profile.

When you choose Not Interested on a Post or Decision, Innatium privately stores your account ID, the content ID and the time of your choice to omit that item from your For You feed. You can Undo the choice. Otherwise, the record is retained until the content or account is deleted, subject to applicable retention obligations. This choice does not affect public engagement counts or Decision analytics.

personalisation_v1 does not ask for net worth, income, portfolio size or risk tolerance.

Referral and Innatium Credit information

If you use Invite & Earn, we may collect:

• referral code
• referral attribution
• referrer/referred-account identifiers
• referral status/lifecycle
• relevant verification status
• qualifying-contribution count
• maturation timing
• lifetime verified referral count
• Innatium Credit ledger entries, balance and redemptions
• Promoter status
• fraud/error reversal records where applicable

Referrers are not intended to receive a referred member's email, private preferences or detailed contribution activity merely because of the referral relationship.

Membership and transaction information

If membership purchasing/redemption becomes available, we may collect or receive information needed to administer:

• membership tier
• entitlement periods
• redemption status
• billing/customer references
• payment status and transaction metadata

Payment-card information may be handled directly by a payment provider rather than stored by Innatium, depending on the payment architecture implemented when billing is enabled.

We will update this Policy if our payment handling materially changes.

Technical and security information

We may collect technical information reasonably needed to operate and secure the Service, such as:

• timestamps
• session/security events
• error and diagnostic information
• request/security logs
• device/browser information provided through ordinary web requests where reasonably necessary
• fraud/abuse indicators

We do not intend to build the qualified-view or referral systems around invasive device fingerprinting.

3. How we collect personal information

We may collect information:

• directly from you
• automatically when you use the Service
• from your interactions with other users/content
• from authentication, hosting, storage, market-data, communications and other service providers
• from public or licensed market-data sources where relevant to Decisions
• through referral links/codes
• when you contact us

4. Why we collect, hold and use personal information

We may use personal information to:

• create/authenticate accounts
• provide Profiles and identity features
• operate Posts, Decisions and social features
• preserve Decision integrity
• calculate/display platform analytics
• personalise content and suggestions
• provide notifications
• measure qualified views and service performance
• operate referrals and Innatium Credits
• administer memberships
• detect/prevent fraud, abuse and security incidents
• enforce Terms and platform rules
• respond to support/privacy requests
• maintain, debug and improve the Service
• comply with legal obligations
• establish, exercise or defend legal rights

We do not use private personalisation answers as public Profile fields.

5. Personalisation and future recommendation systems

personalisation_v1 uses explicit interests to help seed recommendations and suggested people.

Phase 2J does not require a machine-learning model to make significant automated decisions about users.

If Innatium later introduces automated decision-making using personal information in a way that significantly affects individuals' rights or interests, we will review and update our privacy disclosures and practices as required.

6. Public information

Information you choose to make public may be accessible to other users and, depending on route visibility, visitors.

This may include:

• username/display name
• avatar/banner
• bio
• Posts
• public Decisions
• replies
• public social metrics
• public Decision Intelligence/ratings/rankings where applicable
• public membership presentation
• earned public badges/statuses such as Promoter if the product displays them

Do not post personal information you do not want made public.

7. How we disclose personal information

We may disclose personal information to service providers that help us operate the Service, such as providers of:

• authentication/database/storage
• hosting/deployment
• email/communications
• security/monitoring
• market data
• analytics/technical infrastructure
• payments if enabled
• professional advice and legal/compliance services

We may also disclose information where required or authorised by law, to protect rights/security, investigate fraud or abuse, or in connection with a corporate transaction subject to appropriate protections.

We do not sell personal information to advertisers.

8. Overseas disclosure and cloud services

Although Innatium is currently available only in Australia, cloud and technology service providers may process or store personal information outside Australia.

Innatium1's primary Supabase database and Storage origin are configured in Sydney, Australia. Innatium's Vercel application Functions are configured for Sydney, Australia. Vercel CDN and routing infrastructure, Supabase Edge Functions and Storage CDN delivery may operate in distributed locations; the locations of particular processing or recipients have not been verified. Innatium currently uses Supabase's default Auth email-delivery service, whose underlying delivery locations have not been verified. Alpaca supplies market-data infrastructure; its relevant processing locations have not been authoritatively established. We do not infer a processing country from a provider's corporate address.

We do not state that all Innatium data is stored only in Australia.

9. Cookies, local storage and similar technologies

Innatium may use cookies, browser storage and similar technologies for:

• authentication/session management
• security
• preferences
• referral attribution
• qualified-view deduplication
• application functionality

For anonymous qualified views, Innatium may use a random browser token with a limited lifetime and transmit/store only a hashed representation as described by the current methodology.

Referral attribution may use first-party storage for the approved attribution window.

10. Referral privacy

Referral attribution is private program information.

A referrer may see aggregate/status information such as pending or verified referrals and Credits earned, but is not entitled merely through referral status to see the referred person's:

• email address
• private personalisation answers
• detailed qualifying Posts/Decisions
• private account metadata

A referred member may see their own verification progress.

11. Innatium Credit records

Credit ledger records may be retained to maintain auditability, prevent duplicate issuance, resolve disputes, investigate fraud, administer redemptions and meet legal/accounting obligations.

Deleting public content does not necessarily require deletion of an already valid historical credit-ledger event.

12. Security

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

Measures may include:

• authentication/access controls
• row-level and storage security
• least-privilege permissions
• audit records
• secure transport
• input/path validation
• security monitoring
• bounded privileged functions
• testing and deployment controls

No internet service can guarantee absolute security.

13. Data retention

We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, maintain platform/Decision integrity, comply with legal obligations, resolve disputes, prevent fraud and enforce agreements.

Retention periods may vary by information type.

Examples of information that may need continued retention include:

• consent/version records
• security/audit records
• locked Decision evidence
• username history
• referral/credit ledger records
• records required for legal/compliance purposes

Where information is no longer reasonably required, we will take reasonable steps to delete or de-identify it where required by applicable law.

14. Account deletion

Users may use available account-deletion processes or contact Innatium.

Account deletion does not necessarily require immediate deletion of every record where retention is reasonably required for legal, security, fraud-prevention, dispute, backup or Decision-integrity purposes.

Public presentation of deleted/suspended accounts and content follows Innatium's platform rules.

15. Access and correction

You may request access to personal information we hold about you and request correction where it is inaccurate, out of date, incomplete, irrelevant or misleading, subject to applicable exceptions.

Some information can be reviewed or updated directly through Innatium.

For privacy requests contact:

privacy@innatium.com.au

We may need to verify your identity before acting on a request.

16. Privacy complaints

If you believe Innatium has mishandled your personal information, contact:

privacy@innatium.com.au

Please provide enough information for us to understand the issue.

We will assess and respond to privacy complaints within a reasonable period.

If you are not satisfied with our response, you may have the right to contact the Office of the Australian Information Commissioner (OAIC).

17. Data breaches

Where required by applicable law, Innatium will assess suspected eligible data breaches and make notifications under Australia's Notifiable Data Breaches scheme.

18. Children

Innatium accounts are for people aged 18 or older.

We do not knowingly permit people under 18 to create accounts. If we become aware that an account belongs to a person under 18, we may take steps to restrict or close the account and handle associated information appropriately.

19. Australia-only service

Innatium is currently intended for users in Australia.

If Innatium expands to other countries, we will review the applicable privacy requirements and update this Policy and related notices before or as required for that expansion.

20. Changes to this Policy

We may update this Policy to reflect product, legal, security or operational changes.

If changes require new consent or additional notice under law or Innatium's consent architecture, we will take appropriate steps.

For the privacy_v2 rollout, new signups on or after the Effective Date acknowledge privacy_v2. Existing users are not being forced to re-consent merely because privacy_v2 is introduced.

Historical privacy_v1 records must remain preserved.

21. Contact

Innatium Pty Ltd
Privacy email: privacy@innatium.com.au
ABN: 34 321 685 019