Privacy Policy

IdeaForge ("we", "us", "our") is committed to protecting your personal data. This policy explains what we collect, why, and your rights under UK GDPR and the Data Protection Act 2018.

Data Controller: [Legal business name — company not yet registered], [Registered office address — pending registration]
ICO Registration Number: [Insert once registered]
Contact: [Contact email — not yet set up]

1. What we collect

Account data: name, email address, password (hashed), country, business type/interests you provide during signup or when generating ideas.

Usage data: ideas you generate, save, or validate; chat messages with the AI Co-Founder; search history within the app; subscription tier and billing status.

Payment data: we do not store card details. Payments are processed by Stripe, who acts as an independent data controller for payment information. See their privacy policy at stripe.com/privacy.

Technical data: IP address, browser type, device information, cookies (see Section 6).

2. How we use your data

• To provide the core service (idea generation, validation, chat)
• To process subscription payments and manage your account
• To enforce free-tier usage limits (5 AI calls a day)
• To improve the service and detect misuse or abuse
• To contact you about your account, billing, or material changes to this policy
• With your consent, to send product updates or marketing (you can opt out any time)

Legal basis: contract (providing the service you signed up for), legitimate interest (fraud prevention, service improvement), and consent (marketing, non-essential cookies).

3. AI processing

When you use the AI Validation or AI Co-Founder features, the content you enter is sent to our AI provider, Anthropic, to generate a response. Anthropic may process data outside the UK/EEA under its own data processing terms.

• We do not knowingly submit special category data (health, ethnicity, religion, etc.) to our AI provider, and you should avoid entering such data into prompts.
• AI-generated content (scores, business ideas, validation results) is provided for informational purposes only and does not constitute financial, legal, or business advice.

4. International data transfers

Where personal data is transferred outside the UK (e.g. to our AI provider or cloud hosting based in the US/EU), we rely on Standard Contractual Clauses or an equivalent adequacy mechanism recognised under UK GDPR.

5. Data retention

• Account data: retained while your account is active, and for 12 months after closure for legal/accounting purposes.
• Saved ideas and chat history: retained until you delete them or close your account.
• Payment records: retained for 6 years as required by UK tax law.

6. Cookies

We use essential cookies (login sessions, security). We do not currently use analytics cookies; if we add them in future, we'll ask for your consent via a cookie banner shown on first visit.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Restrict or object to certain processing
• Data portability (receive your data in a portable format)
• Withdraw consent at any time (where processing is based on consent)
• Complain to the ICO (ico.org.uk) if you believe we've mishandled your data

To exercise any of these rights, email [Contact email — not yet set up]. We'll respond within one month.

8. Data sharing

We share data with:

• Stripe to process subscription payments
• Anthropic to generate AI responses
• Hosting/infrastructure providers (Supabase, Vercel) to run the service
• Analytics providers, if enabled in future, in aggregated/anonymised form where possible

We do not sell your personal data.

9. Security

We use industry-standard measures (encryption in transit, hashed passwords, access controls) to protect your data. No system is 100% secure, and we encourage you to use a strong, unique password.

10. Children

IdeaForge is not intended for users under 18. We do not knowingly collect data from minors.

11. Changes to this policy

We'll notify you of material changes via email or an in-app notice. Continued use after changes constitutes acceptance.

12. Contact

Questions or requests: [Contact email — not yet set up]
Postal address: [Registered office address — pending registration]