How Ideiqo handles your data

Controller and contact

Ideiqo is operated by the Ideiqo team. For privacy requests or questions, email contact@ideiqo.com. If your contract or invoice names a specific Ideiqo legal entity, that entity is the controller for your use of the service.

What we collect

• Account data: email address, name if provided, password hash, sign-in metadata, and account settings.
• Workspace content: strategy session titles, chat messages, onboarding answers, uploaded files, generated documents, notes, feedback, and export activity.
• Voice recordings: when you choose to dictate a message, the audio you record is sent for transcription and the resulting text is placed in your message box. Ideiqo does not store the recording; only the text you decide to send becomes part of your workspace.
• Landing-page chat: the single message (up to 200 characters) you type into the chat on our home page, which is sent to our AI provider to generate one reply and a suggested path. Ideiqo does not store the message or the reply; it keeps only which path was suggested, the processing cost, and a hashed security identifier for abuse prevention.
• Guest scorecard data: project name, problem and customer answers, an optional website address, the generated scorecard, and an opaque guest token used to recover it after signup. Public page content retrieved from the website is processed to produce the score but is not stored in the guest snapshot.
• Usage and operations data: feature interactions, quota and usage records, model/runtime information, errors, logs, and security events needed to run and improve the service.
• Technical data: IP-derived security identifiers, browser and device information, requested pages, timestamps, and similar connection data.
• Analytics data: page views and product events in Google Analytics 4 only when you accept analytics cookies.
• Email data: email address and reset-token metadata when you request password reset or account-related messages.

Where the data comes from

• Directly from you when you answer questions, create an account, upload materials, use the workspace, send feedback, or contact us.
• Automatically from your browser and use of the service, including security, operational, consent, and—only if accepted—analytics data.
• From a public website you ask Ideiqo to review during the guest scorecard or another workflow.

Why we use it

• To create and secure your account, authenticate you, and prevent misuse.
• To provide the product strategy workspace, including AI-assisted analysis, document generation, file storage, exports, and admin management.
• To answer a message you type into the landing-page chat and suggest which Ideiqo path fits you, and to remember the path you choose so it can be applied to your first project after signup.
• To maintain service reliability, debug errors, enforce quotas, and protect the application.
• To respond to feedback, support requests, and password reset requests.
• To understand product usage through Google Analytics only after you opt in.

Legal basis

• Contract performance: account access, session storage, AI workflow execution, document generation, exports, and core product features.
• Legitimate interests: security, abuse prevention (including rate limits on the landing-page chat), debugging, service improvement, and internal operational reporting.
• Steps at your request before signup: answering your landing-page chat message and remembering the path you choose.
• Consent: Google Analytics and non-essential analytics cookies.
• Legal obligation: records we must keep to comply with applicable law, accounting, or lawful requests.

AI processing and workspace content

Ideiqo processes your prompts, onboarding answers, uploaded materials, and generated deliverables to provide AI-assisted strategy work. You remain the owner of the idea and the materials you submit. By submitting them you give Ideiqo permission to store that information in your workspace and to send what a task needs to the AI providers named in this policy, including Anthropic for strategy work and OpenRouter for optional dictation. Do not upload content you are not allowed to use or share with the service. AI outputs may be inaccurate or incomplete, so you remain responsible for reviewing and validating them before using them for business decisions. Ideiqo scores and guidance are advisory: Ideiqo does not make funding decisions and its outputs do not guarantee funding or investor interest. The service does not make solely automated decisions that produce legal or similarly significant effects about you.

Dictation is optional and starts only when you press the microphone button and grant microphone access in your browser. The recording is transmitted to our speech-to-text provider for transcription and is not retained by Ideiqo; our logs record only technical details such as its length, format, cost, and processing time. Review the transcribed text before sending it.

The chat on our home page is optional and runs only when you send a message or choose one of the suggested goals. Your message is sent to Anthropic to generate a short reply and a suggested path; it is not stored by Ideiqo or written to our logs. Each visitor can receive a limited number of AI replies per day; after that, a fixed reply is shown instead. The suggestion is advisory. Please do not include confidential or personal information in this message.

Service providers and recipients

We use processors and service providers only as needed to operate Ideiqo:

• Hosting, database, storage, and infrastructure providers used to operate the application.
• Anthropic, which currently supplies the commercial Claude models used to process prompts, landing-page chat messages, relevant uploaded context, and generated strategy materials. Anthropic states that commercial API inputs and outputs are not used for model training by default; Ideiqo does not opt workspace content into provider training.
• OpenRouter, which receives optional dictation recordings and routes them to a speech-to-text model (by default OpenAI Whisper Large V3 Turbo). The company that runs that model can vary. If cloud transcription is unavailable, dictation may instead use your browser’s built-in speech recognition, which is processed by your browser vendor under its own terms.
• Email delivery providers used for password reset and service messages.
• Google Analytics 4, but only when analytics consent is granted.

We do not sell your personal data. We do not use Google Analytics for advertising, retargeting, or ads personalization in this application. We may also disclose data when required by law, to protect the service and its users, or as part of a corporate transaction subject to appropriate safeguards.

International transfers

Some service providers may process data outside Slovakia or the European Economic Area. Where required, transfers rely on an applicable adequacy decision, approved contractual safeguards such as the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism. Contact us if you want information about the safeguards relevant to your data.

Analytics consent

Analytics is off by default. If you choose "Accept all", Ideiqo enables Google Analytics 4 to collect page views and product events such as onboarding progress, board usage, downloads, feedback actions, and pane interactions. If you choose "Essential only", analytics stays disabled and Google Analytics cookies already stored in this browser are removed. You can change this later through the Cookie Policy or Privacy settings in the account menu.

Retention and security

• Account and workspace data is kept while your account is active and then only as needed for deletion processing, backups, disputes, security, or legal obligations.
• Unclaimed guest snapshots are scheduled for deletion after 12 months. Once a snapshot is claimed, the separate problem and customer answer fields are cleared from that guest record after being applied to the workspace; the generated scorecard and claim audit fields remain subject to operational retention needs.
• Landing-page chat records (suggested path, processing cost, and a hashed security identifier, never the message itself) are scheduled for deletion after 90 days. The cookie that remembers a path you chose on the home page lasts up to 30 days and is cleared the first time you open your workspace after signing in.
• Password-reset links expire after 30 minutes; related records may be retained briefly for security and abuse prevention.
• Operational, security, billing, and legal records are retained for the period reasonably necessary for their purpose and applicable obligations.
• Google Analytics data follows the retention configured in Google Analytics. Browser-side data remains until its stated expiry, completion of the relevant flow, or deletion through your browser or product controls.

We use technical and organizational safeguards appropriate to the service, including hashed passwords and access controls. No internet service can promise absolute security.

Your rights

• Access: ask for a copy of personal data we hold about you.
• Correction: ask us to correct inaccurate account or profile information.
• Deletion: ask us to delete your account and associated workspace data, subject to legal or security retention needs.
• Portability: ask for your workspace content in a usable format where technically feasible.
• Restriction or objection: ask us to limit certain processing where applicable.
• Withdraw consent: turn analytics off at any time from Privacy settings.
• Complaint: contact your local data protection authority if you believe your rights are not being respected.

To exercise a right, email contact@ideiqo.com. We may need to verify your identity before acting on a request. You may also lodge a complaint with the Office for Personal Data Protection of the Slovak Republic or the supervisory authority where you live or work.

Changes

We may update this policy when the product, providers, or legal requirements change. Material updates will be reflected on this page and, where appropriate, communicated in the product or by email.