Privacy Policy
This policy explains what personal data we collect, why, and your rights — under the EU/EEA GDPR, the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA) and comparable laws. We keep data collection to the minimum needed to run the Service. We do not sell your personal data and we do not use advertising or tracking cookies.
1. What we collect and why
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Email address | Sign-in (one-time codes), delivering your dossier, service emails | Contract (Art. 6(1)(b)) | Until account deletion |
| Business idea & wizard answers | Generating your dossier | Contract | Until you delete the draft/dossier or account |
| Generated dossiers | Providing your purchase | Contract | Until account deletion |
| Purchase records (amount, currency, Stripe IDs — never full card numbers) | Payment processing, accounting, fraud prevention | Contract + legal obligation (Art. 6(1)(c)) | As required by tax law (typically 5–10 years) |
| IP address, user agent, security logs | Security, rate limiting, fraud & abuse prevention | Legitimate interest (Art. 6(1)(f)) | [⬜ e.g. 12 months] |
| Cookies / localStorage | Session only — no advertising or analytics cookies | Strictly necessary | Session |
We do not knowingly collect special-category (sensitive) data. Please do not put third-party personal data or sensitive data into your idea description.
2. AI processing
To generate your dossier, the text you enter is sent, via our own server, to our AI model providers (currently DeepSeek; optionally Anthropic for higher tiers). We instruct providers not to train on this data [⬜ verify current provider DPA/API terms]. Outputs may be inaccurate — see our Terms. Do not submit personal data of others.
3. Who we share with (processors)
We share only what is necessary with: Stripe (payment processing), [⬜ ChemiCloud hosting — region], DigitalOcean (generation server, [⬜ region]), our email-delivery provider, and the AI model providers above. Each acts as our processor under a data-processing agreement. We never sell or rent personal data and use no ad networks or cross-site tracking. We may disclose data if required by law or to protect our rights or users' safety.
4. International transfers
Where processors are outside the EEA/UK, transfers rely on adequacy decisions or the EU/UK Standard Contractual Clauses, with additional safeguards as needed.
5. Your rights — everyone
Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing, data portability, and to withdraw consent. The easiest path is the in-app "Delete account" button, which removes your account, drafts and dossiers; records we must keep by law (e.g. purchase/tax records) are retained. To exercise any right, email info@havetheidea.com. We respond within the time required by applicable law (generally within 30 days).
EU / EEA & UK (GDPR / UK GDPR)
You have the rights above and the right to lodge a complaint with a supervisory authority — in the Czech Republic the ÚOOÚ (uoou.gov.cz), or your local authority. [⬜ if required, appoint/name an EU or UK representative under Art. 27.]
California (CCPA / CPRA)
California residents have the right to know, delete, correct, and to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined, and we do not use it for cross-context behavioural advertising. We will not discriminate against you for exercising your rights. Exercise them at info@havetheidea.com.
Other regions
If your local law (e.g. Australia, Canada, Brazil) grants further rights, we honour them where they apply. Contact us and we'll help.
6. Security
API keys and secrets are encrypted at rest (AES-256-GCM), data is transmitted over TLS, sign-in is passwordless (one-time codes), and access is limited to the operator. No system is perfectly secure; we cannot guarantee absolute security.
7. Children
The Service is not directed at, and we do not knowingly collect data from, children under 16. If you believe a child has provided data, contact us and we will delete it.
8. Changes
We may update this policy; material changes will be announced by email or in the app. Continued use after the effective date means you accept the updated policy.
← Back to HaveTheIdea