Privacy Policy

1. Who we are

Idea to Product is operated as a sole trader based in Israel. We are the data controller for personal data processed through the Service. Contact: eva@idea-to-product.com. Our full legal name and registered details are available on request.

2. What we collect

We collect the data you give us and the data the Service generates about your use:

• Account data: email address, and if you sign in with Google, your OAuth profile name and avatar.
• Content: the ideas, messages, and deliverables you submit and receive inside the chat.
• Usage events: per-message usage logs (token counts, response times, errors) used to operate and improve the Service.
• Product analytics: page views and product interaction events captured via PostHog. This runs in a cookieless, anonymous mode by default and becomes tied to your account after you grant consent (see sections 5 and 11 below). We do not record or replay your screen.
• Page-view and engagement data: alongside the PostHog analytics above, we record page visits in our own database: the page address, the referring page, your browser type, a country code derived from your IP address (we do not store the IP itself), any campaign parameters (such as UTM tags) in the link you used to arrive, an anonymous session identifier, scroll depth, and time spent on the page. This is first-party, fires regardless of your analytics-consent choice, and is not tied to your account.
• Waitlist data: if you join the waitlist, your first name (and last name, if you provide it), your email address, and your marketing opt-in flag. If you later sign in with the same email address, our server matches it to your waitlist signup so we can measure how the waitlist converts to active use.
• Feedback you send us: the content of any feedback you submit through the in-app feedback form, including whether you ask us to follow up by email.
• Access and sign-in data: the email address you use to request or receive access to the Service, which we hold in our access allowlist.
• Payment data: when you buy access to the paid phases, checkout is handled entirely by our payment processor, Lemon Squeezy, acting as Merchant of Record. You enter your email and card details on Lemon Squeezy's hosted checkout; that information goes to Lemon Squeezy and never reaches our app or database. From a completed purchase we store only an opaque order reference linked to your idea, and the fact and time of payment. We never receive your name, email, card number, or any other card or billing details.

3. How we use it

We use your data to run the Service, generate responses through AI sub-processors, process payments and unlock the paid phases, keep the Service secure and operational, respond to your support requests, and, if you have opted in, send product updates.

We do not sell or share your personal information, and we do not disclose it to third parties for their own marketing purposes.

4. Legal bases (GDPR)

Where GDPR applies, we rely on: (a) performance of a contract to provide the Service to account holders; (b) consent for marketing communications and any non-essential cookies; and (c) legitimate interests in operating, securing, and improving the Service.

5. Sub-processors

We use a small set of third-party providers to run the Service. Each processes personal data only on our instructions and under its own privacy policy. By category:

• Infrastructure and hosting. Supabase (database, authentication, and edge functions; Switzerland), Vercel (frontend hosting; United States), and Cloudflare (DNS; United States).
• AI inference. AWS Bedrock running Anthropic Claude, and Google Gemini for lightweight utilities such as title generation (both United States). These providers are contractually barred from training their models on your inputs or outputs.
• Product analytics. PostHog (European Union). It runs in a cookieless, anonymous mode by default and becomes tied to your account after you grant consent, which you can give or withdraw from the usage-analytics toggle in your account menu. We do not record or replay your screen.
• Error monitoring. Sentry (United States), for diagnostic event data.
• Email. Resend (United States), for transactional and waitlist email.
• Internal team alerts. Slack (United States), which receives in-app feedback you send us and per-user activity signals such as a new sign-up or a session starting.
• Payments. Lemon Squeezy (United States), as Merchant of Record for checkout, billing, and tax. Section 2 explains how little payment data reaches us.

6. International transfers

Personal data is stored and processed in Switzerland (our primary database), the European Union, and Israel, each recognised by the European Commission as providing an adequate level of data protection. Some sub-processors listed above (AI inference, frontend hosting, DNS, and payments) are based in the United States; transfers to them rely on the EU-U.S. Data Privacy Framework where the sub-processor is self-certified, with Standard Contractual Clauses as a fallback.

7. AI model training and automated decisions

We do not use your Inputs or Outputs to train our own AI models or those of our sub-processors. Your conversations are processed to generate responses and stored so you can return to them later.

AI outputs are non-binding suggestions intended to support your own decision-making. We do not use the Service to make decisions about you that produce legal effects or similarly significantly affect you without human involvement. Every outcome that matters is the result of a choice you make.

8. Retention

We retain account data and chat history until you delete your account. Waitlist emails are retained until you unsubscribe. Usage event logs are retained for up to 24 months. The order reference we store is deleted with your account; the underlying transaction record held by our payment processor as Merchant of Record is retained by them for up to 7 years to meet tax and accounting obligations.

9. Your rights (GDPR)

If GDPR applies to your data, you have the right to access, rectify, erase, or port your data; to restrict or object to processing; and to withdraw consent at any time. You may also lodge a complaint with your local data protection supervisory authority. We respond to rights requests within one month, and will tell you if a complex request needs longer, as GDPR allows. Contact eva@idea-to-product.com to exercise any of these rights.

10. EU representative

We are established outside the EU. Data subjects in the European Union can contact us directly at eva@idea-to-product.com about any matter relating to their personal data, including requests they would otherwise address to an Article 27 GDPR representative. If we appoint an EU representative, we will name them here.

11. Cookies and local storage

The Service uses local storage items required by Supabase Auth to keep you signed in. Product analytics run in a cookieless, anonymous mode by default: PostHog sets no cookies and writes nothing to your device's persistent storage until you grant consent. If you turn on usage analytics, PostHog then sets local storage and cookies so your activity can be attributed to a consistent visitor across pages. You can grant or withdraw this consent at any time, either from the prompt shown inside the chat or from the usage-analytics toggle in your account menu; withdrawing stops account-tied capture and returns analytics to the cookieless baseline. Separately, we store a per-tab analytics session identifier in your browser's session storage to group page views within a visit; it is cleared when you close the tab and is not tied to your account. No advertising cookies are used.

12. Children's privacy

The Service is not intended for children under 13 (or under 16 in the EEA). We do not knowingly collect data from children.

13. Changes

We may update this policy, including the list of sub-processors in section 5. Material changes, and changes to the sub-processors who handle your data, will be announced in the Service or by email.

14. Contact

Privacy questions or data rights requests: eva@idea-to-product.com.