Privacy Policy

Overview

IdeaFlow is operated by Neo Sapiens (“we”, “us”, “our”). This policy explains how we collect, use, store, and share your personal information when you use IdeaFlow.

This policy is made in compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and, for users in the European Economic Area or United Kingdom, with the General Data Protection Regulation (GDPR) and UK GDPR.

1. What we collect

• Account data — email address, display name, and OAuth profile picture when you sign in with Google.
• Idea content — titles, descriptions, chat messages, task notes, and phase summaries you create inside the app.
• Usage data — counts of AI messages and ideas created, used solely to enforce plan limits.
• Push subscription tokens — encrypted device endpoints used to deliver follow-up reminders you have opted into. We cannot read your device or other apps through these tokens.
• Payment data — handled entirely by Paddle. We store only your Paddle customer ID, subscription status, and next billing date. We never see or store your card number.
• Coaching profile — role, bio, and interests you optionally provide to personalise AI coaching sessions. This is included in requests to Anthropic's API to improve coaching relevance. You can clear it at any time from Settings.
• Feedback submissions — when you submit feedback via the in-app widget, we store your message, the page you were on, and your email address. Your email is used only to identify and filter abusive submissions; it is permanently removed once your feedback is reviewed and deemed legitimate. The anonymised message is then retained as a product improvement note. Do not include personal information about yourself or others in feedback messages.
• Trial eligibility — if you delete your account after activating a paid trial, we retain your email address in a separate, access-controlled record for up to 5 years solely to prevent duplicate trial abuse. This record is never linked to any other user data and is never used for marketing.
• Terms acceptance — the date and version of the Terms of Service you agreed to at signup, kept for legal compliance.

2. How we use your data

• To operate and deliver the AI coaching service.
• To send follow-up push notifications you have explicitly enabled.
• To enforce usage limits tied to your plan.
• To process payments and manage your subscription via Paddle.
• To maintain the security and integrity of the service.
• To personalise AI coaching using your coaching profile context, if you have provided it.
• To review feedback submissions and improve the product. Feedback is treated as a backlog of bugs and improvement requests.

We do not sell your data. We do not use your idea content or feedback to train AI models.

3. Legal basis for processing (EEA and UK users)

For users in the European Economic Area or United Kingdom, we process your personal data on the following lawful bases under Article 6 GDPR:

• Performance of a contract (Art. 6(1)(b)) — account creation, idea storage, AI coaching sessions, and payment processing.
• Legitimate interests (Art. 6(1)(f)) — service security, fraud prevention, and aggregate usage analytics, where these interests are not overridden by your rights.
• Consent (Art. 6(1)(a)) — push notifications, where you have explicitly opted in. You may withdraw consent at any time from Settings.

4. AI processing

Your idea content and coaching messages are sent to Anthropic's API to generate coaching responses. Anthropic processes this data under their Privacy Policy. We send the minimum context necessary (up to 1,500 tokens per request) and do not transmit your full conversation history. Anthropic's API terms for business customers prohibit training on submitted content.

5. Data processors and international transfers

We share your data with the following processors only to the extent required to deliver the service:

For EEA/UK users: Personal data transferred to Anthropic and Vercel (USA) is covered by Standard Contractual Clauses (SCCs) approved by the European Commission. Paddle (UK) operates under the UK International Data Transfer Agreement for onward transfers.

For Australian users: Neo Sapiens has taken reasonable steps under APP 8.1 to ensure overseas recipients (Anthropic, Vercel, Google, Sentry) handle your data consistently with the Australian Privacy Principles.

6. Data storage and security

Your data is stored in Supabase hosted on AWS in the AP-Southeast-2 region (Sydney, Australia). All data at rest is encrypted by the hosting provider. All data in transit is encrypted with TLS 1.2 or higher.

Row-level security ensures each user can only read and write their own data. Access to production databases is restricted to authorised personnel only. We have procedures in place to detect and respond to data breaches, and will notify affected users and relevant authorities as required by law.

7. Data retention

We retain your data for as long as your account is active. On account deletion:

• Idea content, messages, and tasks are permanently deleted within 30 days.
• Payment records (Paddle transaction IDs and subscription history) are retained for 7 years to meet Australian taxation law obligations.
• Feedback submissions: your email address is removed within 30 days of review. The anonymised message is retained for up to 3 years as a product improvement record, then deleted.
• Trial eligibility records: your email is retained for up to 5 years after account deletion to prevent trial abuse, then permanently deleted. Legal basis: legitimate interests (APP 6.2(a); Art. 6(1)(f) GDPR).
• Server logs are retained for 90 days then deleted.
• Anonymised aggregate usage statistics containing no personal identifiers may be retained indefinitely.

8. Your rights

All users have the right to:

• Access — request a copy of all personal data we hold about you.
• Correction — request correction of inaccurate data.
• Deletion — permanently delete your account and all associated data directly from Settings → Account, or by emailing us. Deletion is processed within 30 days.
• Export — export your ideas in Markdown or PDF format from within the app at any time.
• Notifications — disable push notifications at any time from Settings.

Additional rights for EEA and UK users under GDPR:

• Restriction (Art. 18) — request that we restrict processing of your data while a complaint is pending.
• Object (Art. 21) — object to processing based on our legitimate interests.
• Portability (Art. 20) — receive your data in a portable, machine-readable format.
• Supervisory authority (Art. 77) — lodge a complaint with your local data protection authority. In the EU, find your authority at edpb.europa.eu. In the UK, contact the ICO.

To exercise any right, submit a request from Settings → Data & Privacy inside the app, or email contact-us@neosapiens.com.au. We will respond within 30 days.

9. Cookies

We use only essential session cookies set by Supabase Auth to keep you signed in. We do not use analytics cookies, advertising trackers, or fingerprinting of any kind. No cookie consent banner is required for strictly necessary cookies.

10. Children

IdeaFlow is not directed at children under 16. We do not knowingly collect personal information from anyone under 16. If you believe a person under 16 has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to this policy

We will notify you of material changes via email at least 30 days before they take effect. The updated policy will be posted at this URL with a new “Last updated” date. Continued use after the effective date constitutes acceptance.

12. Contact

Privacy questions and data rights requests: contact-us@neosapiens.com.au

Neo Sapiens · Australia