Privacy Policy

1. Information We Collect

• Account data: name, email, and authentication details when you sign up or join the waitlist
• Google Sign-In data:if you choose “Continue with Google,” we receive your name, email address, and profile photo from your Google account (via Firebase Authentication) to create and secure your IdeasTurn account. We request only basic profile scopes and do not access your Gmail, Drive, Calendar, or other Google services
• Venture data: the ideas, content, brand assets, and business data you submit to build a venture
• Billing data: payment method and transaction history, processed and stored by Stripe on our behalf — we do not store full card numbers
• Usage data: pages visited, features used, and device/browser information collected automatically via cookies and similar technologies
• Communications: messages you send us for support or feedback

2. How We Use Your Information

We use your information to:

• Provide, operate, and maintain the Service, including generating your venture
• Process payments and send billing-related communications
• Respond to support requests and product feedback
• Send service notices, security alerts, and (with consent) product updates
• Improve and personalize the Service
• Detect, investigate, and prevent fraud, abuse, and security incidents
• Comply with legal obligations

3. Legal Basis for Processing (GDPR)

For users in the EEA, UK, or Switzerland, we process personal information under the following legal bases: performance of a contract (providing the Service you signed up for), legitimate interest (improving and securing the Service), consent (e.g., marketing emails, non-essential cookies), and legal obligation. You may withdraw consent at any time without affecting prior processing.

4. Third-Party Service Providers

We share personal information with service providers who help us operate the Service, including:

• Google Cloud Platform & Firebase — hosting, authentication, and data storage
• Stripe — payment processing
• Google Gemini — AI-powered venture validation and content generation
• Resend — transactional email delivery
• Cloudflare — DNS, content delivery, and security

Each provider is contractually obligated to process your data only for the purposes we authorize and to maintain appropriate security safeguards. We do not sell your personal information.

5. International Transfers

Your information may be transferred to and processed in the United States and other countries where our service providers operate. Where required by GDPR, we rely on Standard Contractual Clauses or equivalent safeguards to protect transferred data.

6. Cookies

We use essential cookies to operate the Service (authentication, session management) and, where you consent, analytics cookies to understand product usage. You can control non-essential cookies through your browser settings.

7. Data Retention

We retain personal information for as long as your account is active, plus a reasonable period afterward to comply with legal, tax, and accounting obligations (typically up to 7 years for financial records). You may request deletion of your data as described below.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data (“right to be forgotten”)
• Restrict or object to certain processing
• Receive your data in a portable, machine-readable format
• Withdraw consent where processing is based on consent
• Lodge a complaint with your local data protection authority

California residents additionally have rights under the CCPA to know, delete, and opt out of the sale of personal information — we do not sell personal information. To exercise any of these rights, contact us below; we will respond within 30 days or as required by applicable law.

9. Data Security

We use industry-standard technical and organizational measures — including encryption in transit, access controls, and secret management — to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children's Privacy

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or through the Service before they take effect.

12. Contact

Questions about this Privacy Policy or your data? Reach us at legal@ideasturn.ai.