Privacy Policy

Data Controller: Inovera Limited (Company No. SC874398), Scotland, United Kingdom.

Privacy contact: support@ideasmine.co.uk

General contact: support@ideasmine.co.uk

We collect and process the following categories of personal data:

• Account data — name, email address, hashed password, country of residence, profile bio and avatar.
• User-generated content — startup ideas, posts, comments, replies, likes, saves, reports and uploaded images.
• AI conversation data — messages you exchange with the AI Idea Studio, retained to power chat history and product improvement.
• Transactional data — Stripe payment identifiers, subscription tier and purchase history. Card details are processed directly by Stripe and are never stored by us.
• Technical & usage data — IP address, browser type, device info, log events, theme preference and limited application-level usage data we log on the server to keep the service running and secure.
• Communications — emails or support messages you send us.

Under UK GDPR Article 6 we rely on the following lawful bases:

• Contract (Art. 6(1)(b)) — to create your account, deliver the Service, process payments and provide AI chat features.
• Legitimate interests (Art. 6(1)(f)) — platform safety, fraud prevention, abuse and brute-force protection, content moderation, service analytics and product improvement. You may object at any time (see Section 8).
• Legal obligation (Art. 6(1)(c)) — accounting, tax, anti-fraud and responding to lawful requests from competent authorities.
• Consent (Art. 6(1)(a)) — for non-essential cookies and any optional marketing communications. You can withdraw consent at any time.

• Authenticate you and keep your account secure (including bcrypt password hashing, JWT Bearer tokens stored in your browser's localStorage, brute-force lockout).
• Display country-filtered feeds, deliver posts, comments, likes and notifications.
• Provide the AI Idea Studio, including saving conversation history so you can rename, revisit or delete past chats.
• Process payments and manage subscriptions via Stripe.
• Moderate content, enforce our Terms, and protect users from spam, harassment and unlawful material.
• Send transactional emails (e.g. password resets, billing receipts) and, with your consent, occasional product updates.

We do not sell your personal data. We share limited data with the following processors, each bound by a written data-processing agreement and appropriate safeguards:

• Stripe — payment processing (PCI-DSS certified).
• OpenAI — AI chat completions for the Idea Studio (prompts and responses are transmitted to OpenAI for processing).
• Emergent — application hosting, object storage for uploaded images, and the universal LLM gateway.
• MongoDB Atlas / our database provider — encrypted at rest storage of platform data.

We may also disclose data where required by law, court order, or to protect the rights, property or safety of Inovera Limited, our users or others.

Some of our processors are located outside the UK (notably the United States). Where personal data is transferred outside the UK, we rely on adequacy decisions or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, and we apply additional technical safeguards such as encryption in transit (TLS) and at rest.

• Account data — for the lifetime of your account, plus up to 30 days after deletion to allow recovery and dispute resolution.
• User-generated content — until you delete it, or until your account is deleted (after which posts and comments are removed).
• AI chat history — until you delete the conversation or your account.
• Transaction records — retained for 6 years to comply with UK accounting and tax law (Companies Act 2006).
• Login attempts and rate-limit logs — auto-expire within 1 hour via TTL indexes.
• Server logs — retained for up to 90 days for security investigations.

Subject to applicable conditions and exemptions, you have the right to:

• Access the personal data we hold about you (Art. 15).
• Rectification of inaccurate or incomplete data (Art. 16).
• Erasure ("right to be forgotten", Art. 17). You may delete your account at any time via the sidebar, which removes your profile and posts.
• Restriction of processing (Art. 18).
• Portability of data you provided to us in a structured, machine-readable format (Art. 20).
• Objection to processing based on legitimate interests, including profiling (Art. 21).
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email support@ideasmine.co.uk. We will respond within one month.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Ideas Mine itself does not set any tracking cookies on your device. The only cookie present when you visit ideasmine.co.uk is set by our security partner (Cloudflare) for bot protection. We use no analytics cookies, no advertising cookies, and no third-party trackers. Your data is not shared with marketing partners.

• Strictly necessary — __cf_bm set by Cloudflare with a ~30-minute lifetime. Used to distinguish human visitors from automated bots and protect the Service from abuse. Falls under the PECR "strictly necessary" exemption and does not require consent.
• Local browser storage (not a cookie) — your authentication token (im_access_token) and your theme preference (light / dark / system) are stored in your browser's localStorage. This is not transmitted automatically with every request the way a cookie is, and is technically outside the scope of PECR's cookie rules, but is disclosed here for full transparency. Clearing your browser storage will sign you out.
• No analytics, no advertising, no cross-site tracking — we do not use Google Analytics, Facebook Pixel, advertising pixels, retargeting tags, or any third-party tracker. There is nothing to opt out of.

You can clear cookies and local storage at any time via your browser settings. Doing so will sign you out and reset your theme preference; all other functionality continues normally.

We use industry-standard measures including TLS encryption in transit, bcrypt password hashing, JWT-based authenticated sessions, brute-force protection, role-based access control, encrypted-at-rest storage and least-privilege backend access. No system is 100% secure; in the unlikely event of a personal data breach affecting your rights and freedoms, we will notify the ICO within 72 hours as required by UK GDPR Article 33, and notify you where required by Article 34.

The Service is not directed to children under the age of 13. If you are under 13, do not use Ideas Mine or submit any personal data to us. If we learn that we have collected personal data from a child under 13 without verified parental consent, we will delete it promptly.

We will only send you marketing emails where you have given consent or where permitted under PECR (e.g. a "soft opt-in" to similar products). Every marketing email contains an unsubscribe link.

We do not subject you to decisions based solely on automated processing that produce legal or similarly significant effects. AI Idea Studio outputs are advisory and do not constitute professional, financial, legal or investment advice.

We may update this Privacy Policy from time to time. Material changes will be notified by in-app banner or email at least 14 days before they take effect. The "Last updated" date at the top of this page indicates when changes were last made.

For privacy questions or to exercise your rights, contact support@ideasmine.co.uk.

For general support: support@ideasmine.co.uk.