Skip to main content

Privacy Policy

Effective Date: 13/10/2026

Operator (APP entity): OMNIMIND TECHNOLOGIES PTY LTD

Contact email: [email protected]

This Policy is drafted in accordance with the Australian Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APP 1–13) contained in it, and incorporates the new requirements introduced by the Privacy and Other Legislation Amendment Act 2024.

1. Who we are​

1.1 OMNIMIND TECHNOLOGIES PTY LTD ("we", "us", "our", "this Platform", "Token Factory") is the collector and controller of the personal information described in this Privacy Policy. We collect personal information of users in Australia in connection with the Services, and are an "APP entity" bound by the Privacy Act 1988 (Cth) (Privacy Act).

1.2 For privacy enquiries and complaints, you may contact us at any time using the contact email above.

1.3 This Policy explains what personal information we collect, how we collect it, the purposes for which we use and disclose it (including disclosure to overseas recipients), your rights, and how to exercise them. This Policy satisfies the privacy policy content requirements of Australian Privacy Principle 1 (APP 1).

2. What personal information we collect​

2.1 Account information: name or username, email address, password (stored in encrypted form), account settings.

2.2 Billing and recharge information: recharge amounts and timestamps, payment method (de-identified details such as card brand and last four digits), invoice information, and refund records. Complete payment credentials are held by third-party payment processors (see clause 6).

2.3 API usage information: API Key identifiers, call timestamps, call volumes (Token consumption), model types, rate and error data, and billing records.

2.4 Input and output content (Prompts and Outputs): the content you submit via the API and the content returned by the models, processed to the extent necessary for providing the Services, preventing abuse (abuse monitoring) and ensuring accurate billing. We recommend that you do not submit unnecessary personal information or sensitive information via the API.

Such data may be transferred to Upstream Model Providers located outside Australia (see clause 6 and the Cross-Border Data Transfer Policy).

2.5 Technical information: IP addresses, device and browser characteristics, access logs, and information collected through cookies and similar technologies (used for session management, security protection and statistical analysis).

2.6 Customer support information: the content you provide and the records of your communications with our customer support team.

2.7 Sensitive information: as a rule, we do not collect "sensitive information" (as defined in section 6 of the Privacy Act, including health information, biometric information, religious beliefs, sexual orientation, etc.). If a specific feature genuinely requires us to do so, we will first obtain your express consent (APP 3.3) and provide a separate notice.

2.8 Unsolicited information: if we receive personal information you have proactively provided that we did not solicit, and we determine it could not have been collected under APP 3, we will destroy it or de-identify it within a reasonable period (APP 4).

3. How we collect personal information​

3.1 We collect personal information mainly in two ways: directly from you (registration, recharge, support communications) and automatically as you use the Services (API call logs, technical information).

3.2 In accordance with APP 3, we only collect personal information that is reasonably necessary for our functions or activities in providing the Services, collect it by lawful and fair means, and generally collect it directly from you.

3.3 Cookies and similar technologies: we use strictly necessary cookies (sign-in, security) and analytics tools to improve the Services. You may manage or delete cookies through your browser settings without affecting essential functionality. We do not use analytics information for purposes beyond those described in this Policy. Where information is used for direct marketing purposes, clause 4.3 (APP 7) applies, together with your right to opt out at any time.

4. Why we collect and use personal information (Purposes)​

4.1 Primary purposes:

  • creating and managing your Account;
  • providing model API calling, billing and settlement services;
  • processing recharges, refunds and invoices;
  • securing the Services and preventing fraud and abuse;
  • providing customer support.

4.2 Secondary purposes (directly related to a primary purpose and within your reasonable expectations, or undertaken with your consent — APP 6):

  • analysing and improving service quality (primarily using de-identified or aggregated data);
  • record-keeping and reporting as required by law;
  • service notices relating to your Account (non-marketing).

4.3 Direct marketing (APP 7): we will only use your personal information for direct marketing where an APP 7 exception applies (for example, where you have consented, or where the information is non-sensitive and each marketing message contains an opt-out facility). You may ask us to stop sending you marketing messages at any time, free of charge, via the unsubscribe link in any marketing email or via [marketing opt-out email], and you may ask us to tell you the source of your personal information.

4.4 Refusing to receive marketing does not affect your use of the Services.

5. How we use and disclose personal information​

5.1 We use your personal information only to the extent necessary for the purposes set out in clause 4, or where we reasonably believe it is necessary to lessen or prevent a serious threat, to investigate suspected unlawful activity, or where required or authorised by law (APP 6).

5.2 Disclosure to third parties includes:

  • Upstream Model Providers (who process your API request content — see clause 6);
  • Service providers and contractors: cloud infrastructure, payment processing, data analytics, customer support (each bound by contract to process information only on our instructions and for our purposes);
  • Payment networks and financial institutions (to complete payments and dispute processing);
  • Professional advisers (lawyers, auditors, to the extent necessary);
  • Law enforcement, regulatory bodies or courts: where required or authorised by law.

5.3 Other than in the circumstances above, we do not sell, rent or otherwise make your personal information available to third parties for their own marketing.

5.4 Government related identifiers (APP 9): we do not adopt, use or disclose a government related identifier (such as a tax file number (TFN) or driver licence number) as our own identifier for you, except where required for statutory verification purposes.

6. Disclosure to overseas recipients (APP 8)​

6.1 Because our Upstream Model Providers, certain cloud infrastructure and payment processors are located outside Australia, your personal information (principally the information described in clauses 2.3–2.5 and your API request content) may be disclosed to recipients in the following countries or regions: [United States] [Singapore] (as applicable according to actual data flows — see the schedule in the Cross-Border Data Transfer Policy).

6.2 Before any overseas disclosure, we take reasonable steps as required by APP 8.1 to ensure that the overseas recipient does not breach the Australian Privacy Principles.

These steps include entering into data processing/transfer agreements with recipients, conducting security and destination-law assessments, and ongoing monitoring. We are accountable under section 16C of the Privacy Act for acts or practices of overseas recipients that would breach the Australian Privacy Principles (see clause 6 of the Cross-Border Data Transfer Policy).

6.3 Following the overseas disclosure exception and "white list" mechanism introduced by the Privacy and Other Legislation Amendment Act 2024 (new subsections 100(1A)–(1B)), we may also rely on that mechanism where its conditions are met. The complete rules for overseas disclosures, the list of destination countries and the safeguards we apply are set out in the Cross-Border Data Transfer Policy, which forms part of this Privacy Policy.

6.4 If you do not wish your personal information to be transferred to a particular overseas recipient, please contact us using the details in clause 16. This may affect the availability of the relevant service; we will explain the available alternatives to you.

7. Automated decision-making (APP 1.7–1.8)​

In accordance with the amendments made to APP 1 by the Privacy and Other Legislation Amendment Act 2024 (which applies from 10 December 2026), we disclose here the decisions made, or done by way of a thing substantially and directly related to the making of a decision, solely or substantially by the operation of computer programs that may significantly affect your rights or interests:

7.1 Risk control and anti-fraud decisions: our systems automatically assess the risk level of recharge and API-calling behaviour, and may automatically trigger transaction holds, rate-limiting or temporary Account suspension. Personal information involved: account information, billing information, API usage information, technical information (IP, device characteristics).

7.2 Automated billing and anomalous-charge flagging: our systems automatically calculate Token consumption and generate invoices, and may automatically flag anomalous charging events.

7.3 If a decision listed above materially and adversely affects you, you may request human review via [support email]. We will process the request within a reasonable period and inform you of the outcome.

8. Security of personal information (APP 11)​

8.1 We take reasonable security measures to protect the personal information we hold from misuse, interference and loss, and from unauthorised access, modification or disclosure, including: encryption in transit (TLS), encryption at rest, least-privilege access controls, multi-factor authentication, security logging and periodic security assessments.

8.2 Security incidents affecting personal information are handled in accordance with clause 10 (Data breaches).

9. Quality and retention of personal information (APP 10, APP 11.2)​

9.1 We take reasonable steps to ensure that personal information is accurate, complete and up to date when collected, used or disclosed (APP 10). You may update your information through your Account settings or by contacting us (see clause 16).

9.2 Retention periods: account information and billing records are retained for [7] years from Account closure or the last transaction (to meet tax and statutory record-keeping requirements); API usage detail is retained for [12] months from generation; abuse-monitoring records are retained for [24] months; customer support records are retained for [3] years. Personal information that is no longer needed and not required to be retained by law will be destroyed or de-identified.

10. Data breaches (Notifiable Data Breaches scheme)​

10.1 If a data breach occurs that is likely to result in serious harm to individuals, we will, in accordance with Part IIIC of the Privacy Act:

  • assess the incident as quickly as possible (the law requires us to take all reasonable steps to complete the assessment within 30 calendar days of becoming aware of grounds to suspect an eligible data breach);
  • if the breach is an "eligible data breach" and remedial action has not removed the risk of serious harm, notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable;
  • the notification will include: a description of the breach, the kinds of information involved, and our recommendations on the steps you should take in response.

10.2 We maintain a data breach response process (detect — contain — assess — notify — review).

11. Access to your personal information (APP 12)​

11.1 You may request access to the personal information we hold about you. We will:

  • verify your identity;
  • provide the information in an appropriate form within a reasonable period (targeting 30 days from receipt of a verified request);
  • not charge a fee (if your request is repeated or burdensome, we will discuss it with you first).

11.2 We may refuse access in whole or in part where an APP 12 exception applies (for example, where access would affect another person's privacy, is required for law enforcement, or is protected by legal privilege). We will explain the reasons (to the extent lawful) and your complaint options.

12. Correction of your personal information (APP 13)​

12.1 You may ask us to correct personal information we hold that is inaccurate, out of date, incomplete, irrelevant or misleading. We will process corrections promptly and free of charge. If we refuse, we will give you written reasons and, at your request, may associate with the information a statement you provide.

12.2 Where we have previously disclosed the information to a third party, we will take reasonable steps to notify the third party of the correction.

13. Anonymity and pseudonymity (APP 2)​

Where it is practicable and consistent with our legal obligations, you may choose not to identify yourself or to use a pseudonym for certain features of the Services (for example, browsing public documentation). Identity information is required for recharge, invoicing and other statutorily required purposes.

14. Children's privacy​

14.1 The Services are not directed at persons under 18 years of age, and such persons may not register. We do not knowingly collect personal information of children; if we discover that we have done so, we will delete it as soon as practicable.

14.2 Please note: the Children's Online Privacy Code must be registered no later than 10 December 2026 under the Privacy and Other Legislation Amendment Act 2024. The Code will apply to online services likely to be accessed by children. We will monitor the final text of the Code, assess its application to the Services, and update this Policy accordingly.

15. Complaints and external redress​

15.1 Complain to us: if you believe we have breached the Privacy Act or this Policy, please contact us at [privacy complaints email]. We will acknowledge your complaint within [10] business days and endeavour to respond within [30] days.

15.2 Complain to the OAIC: if you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:

  • Website: www.oaic.gov.au
  • Phone: 1300 363 992
  • Post: GPO Box 5218, Sydney NSW 2001

15.3 Statutory tort: from 10 June 2025, under Schedule 2 of the Privacy Act (inserted by the Privacy and Other Legislation Amendment Act 2024), an individual may bring court proceedings for a serious invasion of privacy (including intrusion upon seclusion or misuse of personal information). This clause is provided as notice of your statutory rights only.

16. Updates to this Policy and contact details​

16.1 We may update this Policy from time to time. Material changes will be announced prominently on the Platform at least 14 days before taking effect (changes involving new overseas disclosure destinations or new purposes will, where required by APP 6, be subject to your consent or separately notified as required by law).

16.2 Contact details: