IdeaFlow

Legal

Privacy Policy

Last updated: May 2025

1. Who we are

IdeaFlow ("we," "us," or "our") operates the platform at useideaflow.com and app.useideaflow.com. IdeaFlow is an AI-powered employee insight platform that helps organisations collect, surface, and act on team ideas.

For questions about this policy, contact us at ideaflow@appstimize.nl.

2. Information we collect

Account information

When you create an account, we collect your email address, name, and the name of your organisation. This information is necessary to provide the service.

Workspace content

We store the ideas, comments, votes, and other content that you and your team members create inside IdeaFlow. This content belongs to your organisation and is used only to provide the platform functionality.

Usage data

We collect anonymised usage data to understand how the product is used and to improve it. This includes pages visited, features used, and interaction patterns. We do not sell this data.

Payment information

Billing is handled by Stripe, a certified PCI-compliant payment processor. We never store your full payment card details. We receive a token and subscription status from Stripe.

Communications

If you contact us by email or via the contact form, we retain that correspondence to help resolve your request.

3. How we use your information

We use the information we collect to:

  • Provide, maintain, and improve the IdeaFlow platform
  • Send transactional emails (account confirmation, password reset, IdeaFlow reminders)
  • Send weekly digest emails to workspace administrators (paid plans)
  • Process billing through Stripe
  • Respond to support requests and inquiries
  • Generate AI-powered insights and summaries for your workspace (Pro plan)
  • Detect and prevent fraud or abuse

We do not use your workspace content to train general AI models or share it with third parties for marketing purposes.

4. Legal basis for processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal data on the following legal bases:

  • Contract performance — to provide the IdeaFlow service you've signed up for
  • Legitimate interests — to improve the product, ensure security, and communicate service updates
  • Consent — for optional communications such as product newsletters (where you have opted in)
  • Legal obligation — where we are required to retain data by law

5. Data retention

We retain your personal data for as long as your account is active or as needed to provide the service. If you delete your account, your personal data is removed within 30 days, except where we are required by law to retain it for longer (such as billing records, which may be retained for up to 7 years).

Workspace content (ideas, comments, votes) is deleted upon account or workspace deletion.

6. Data sharing

We share your data only with trusted sub-processors needed to operate the platform:

  • Supabase — database and authentication (EU-hosted on AWS Frankfurt)
  • Stripe — payment processing (PCI DSS Level 1 certified)
  • Resend — transactional email delivery
  • Vercel — application hosting and edge network

We do not sell, rent, or trade your personal information to third parties.

7. International transfers

IdeaFlow is hosted in the European Union (Frankfurt, Germany via AWS). If any data is processed outside the EEA, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses) in compliance with GDPR.

8. Your rights

If you are located in the EEA or the UK, you have the following rights under data protection law:

  • Access — you can request a copy of the personal data we hold about you
  • Rectification — you can request correction of inaccurate data
  • Erasure — you can request deletion of your personal data ("right to be forgotten")
  • Portability — you can request your data in a machine-readable format
  • Objection — you can object to processing based on legitimate interests
  • Restriction — you can request we restrict processing in certain circumstances

To exercise any of these rights, email us at ideaflow@appstimize.nl. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority (in the Netherlands: Autoriteit Persoonsgegevens).

9. Cookies

IdeaFlow uses the following types of cookies:

  • Essential cookies — required for authentication sessions and core functionality. These cannot be disabled.
  • Preference cookies — remember your UI preferences (e.g. sidebar state).

We do not use advertising, tracking, or third-party analytics cookies. For more detail, see our Cookie Policy.

10. Security

We take security seriously. Our measures include:

  • All data transmitted over HTTPS / TLS
  • Database access governed by Row Level Security (RLS)
  • Service-role keys never exposed to browser clients
  • HTTP security headers (CSP, X-Frame-Options, HSTS)
  • Stripe webhook signature verification
  • Rate limiting on sensitive endpoints

If you discover a security vulnerability, please disclose it responsibly to ideaflow@appstimize.nl.

11. Children

IdeaFlow is intended for use by organisations and their employees. We do not knowingly collect personal data from individuals under the age of 16. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify workspace administrators by email and update the "Last updated" date above. Your continued use of IdeaFlow after the change takes effect constitutes acceptance of the updated policy.

13. Contact

For any questions, requests, or concerns about this Privacy Policy:

IdeaFlow
Email: ideaflow@appstimize.nl