Privacy Policy | IdeaStream

1. Introduction

Alserda Tech AB ("we", "us", "our"), operating the platform IdeaStream at www.ideastreamai.com, respects your privacy and is committed to protecting your personal data. This policy explains how we collect, use, and safeguard your information when you use our platform.

2. Data We Collect

We collect the following types of data:

•Account data: Email address, name (if provided via Google OAuth), and authentication tokens when you create an account.
•Subscription data: Subscription tier and customer ID. We do not store credit card numbers — all payment processing is handled by Lemon Squeezy, our merchant of record.
•User-generated content: Chat messages (Idea Chat), generator preferences and inputs, builder outputs, bookmarks, and favorites.
•Usage data: Feature usage counts (for rate limiting), page views, and interaction data for improving the service.
•Local storage: We store your generator preferences locally in your browser (localStorage) for convenience. This data does not leave your device.
•Technical data: Browser type, device information, and IP address collected automatically for security and analytics purposes.

3. How We Use Your Data

•To provide and maintain the Service, including managing your account and subscription.
•To process payments through our payment provider (Lemon Squeezy).
•To generate AI-powered content by sending your inputs (preferences, chat messages, idea descriptions) to third-party AI services for processing.
•To improve and personalize your experience, including recommendations based on your bookmarks and usage.
•To enforce rate limits and prevent abuse of the Service.
•To communicate with you about your account, updates, or support requests.
•To comply with legal obligations.

4. AI Processing

When you use AI-powered features (Idea Lab, Blueprint Builder, Idea Chat), your inputs are sent to third-party AI services for processing. These services may process data outside the EU/EEA. We only send the minimum data necessary to generate your requested content. AI providers are contractually obligated not to use your data for training their models.

5. Third-Party Services

We use the following third-party services:

•Supabase: Authentication and database hosting.
•Lemon Squeezy: Payment processing and merchant of record. Lemon Squeezy's privacy policy applies to payment data.
•Vercel: Hosting and content delivery.
•Google: OAuth authentication (sign in with Google).
•AI providers: Third-party AI services used to generate analyses, ideas, and recommendations. Your inputs are processed by these services to produce output.

6. Data Retention

We retain your personal data only for as long as necessary to provide the Service and comply with legal obligations. When you delete your account, your personal data is removed within 30 days. Anonymized usage data may be retained for analytics purposes.

7. Your Rights (GDPR)

Under GDPR, you have the right to:

•Access your personal data and request a copy.
•Rectify inaccurate personal data.
•Erase your personal data ("right to be forgotten").
•Restrict processing of your personal data.
•Data portability — receive your data in a structured format.
•Object to processing based on legitimate interests.

To exercise any of these rights, contact us at support@ideastreamai.com. You also have the right to lodge a complaint with your local data protection authority.

8. Cookies

We use essential cookies for authentication and session management. We do not use advertising or tracking cookies. Analytics cookies may be used in anonymized form to improve the Service.

9. Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS) and at rest, row-level security on our database, and secure authentication via Supabase Auth.

10. White-Label & Multi-Tenant Data

IdeaStream operates a White-Label (WL) program where third-party operators ("Tenants") run branded instances of the platform. The following provisions apply to data processed in this context.

10.1 Data Isolation. Each tenant's data is logically isolated using row-level security (RLS) policies in our database. Tenants cannot access data belonging to other tenants or the main IdeaStream platform.

10.2 Tenant Visibility. Tenants can view their end-users' email addresses, subscription tiers, and usage statistics. Tenants cannot access passwords, payment card details, or data belonging to other tenants.

10.3 IdeaStream Access. IdeaStream maintains administrative access to all tenant data for the purposes of platform operation, security monitoring, billing reconciliation, and technical support.

10.4 Processor Roles (GDPR). In the context of the WL program, the Tenant acts as the Data Controller for their end-users' data, and IdeaStream acts as the Data Processor. IdeaStream processes data on behalf of the Tenant in accordance with these terms and applicable data protection laws.

10.5 Tenant Responsibility. Each Tenant is responsible for maintaining their own privacy policy, obtaining appropriate consent from their end-users, and responding to data subject access requests (DSARs) from their users.

10.6 Data Portability. Upon termination of a Tenant's WL subscription, end-user data is retained for 90 days. During this period, the Tenant may request a data export. After 90 days, all tenant-specific data is permanently deleted.

11. Children's Privacy

The Service is not intended for children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The "Last updated" date at the top indicates the most recent revision.

13. Contact

For privacy-related questions or requests, contact us at our contact page or email support@ideastreamai.com.