Privacy Policy

Effective Date: September 8, 2026

1. Introduction

idea ("Company", "we", "us", or "our") provides AI-powered chat and image processing services through a microservices-based architecture (the "Service").

This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use idea.

By using the Service, you agree to the practices described below.

2. Information We Collect

A. Account Information

  • Email address (via Google or direct account registration)
  • Internal user ID
  • Password hash, email-verification status, and password-reset security records for direct accounts
  • Invite code usage data

Authentication is provided through Google OAuth or a password stored as a one-way salted hash. We never receive your Google password.

B. User Content

We collect and process content that you submit through the Service, including:

  • Chat messages;
  • Prompts and other text inputs;
  • Uploaded files;
  • AI-generated outputs produced in response to your inputs.

User content is processed and stored as necessary to operate the Service.

Uploaded files and generated outputs are stored within shared infrastructure environments that utilize access controls designed to restrict content to authorized users. The Service provides temporary processing only and is not intended as a permanent storage or archival solution.

As described in Section 4 (Data Storage and Retention), files may be automatically deleted at any time without notice when storage capacity is reached or for operational needs. No retention period is guaranteed. Users are solely responsible for downloading and maintaining independent backups of all content immediately after processing.

C. Payment Information

Payments are processed by Stripe.

We store:

  • Transaction history
  • Credit balance
  • Payment status

We do not store full credit card numbers or payment credentials.

D. Usage Data

  • IP address
  • Browser type
  • Device information
  • Access timestamps
  • Job processing logs
  • Developer organization, project, role, environment, API-key identifier, and scope metadata
  • API requests, tool runs, uploads, workspace identifiers, billing events, and audit events

Secret API keys and one-time account tokens are stored using one-way cryptographic hashes. We temporarily process the complete credential when authenticating a request but do not store the retrievable secret.

Developer applications may provide pseudonymous external-user identifiers and content on behalf of their users. The developer customer is responsible for its collection and instructions, and we process the data to provide and secure the Service.

E. Cookies and Local Storage

We use:

  • Essential Cookies: Authentication tokens, Session management
  • Functional Storage: Theme preferences
  • Analytics: Vercel Web Analytics (privacy-first, no cookies)

F. Analytics

We use Vercel Web Analytics to collect anonymized usage data:

  • Page views
  • Referrer information
  • Country/region
  • Browser and device type

Vercel Web Analytics is privacy-first: it does not use cookies, does not track individuals across sites, and is GDPR compliant without requiring consent banners. Analytics data is used for debugging, performance improvement, and service optimization.

3. How We Use Information

We use collected data to:

  • Authenticate users
  • Provide AI chat and image processing services
  • Process image generation and analysis jobs
  • Operate prepaid credit balances
  • Process payments
  • Send service-related notifications
  • Monitor abuse and enforce policies
  • Improve system performance
  • Improve Service reliability, safety, and user experience
  • Comply with legal obligations

We do not sell personal data or share it for cross-context behavioral advertising. We do not use customer content to train generalized AI models unless we provide a specific disclosure and obtain any legally required permission.

4. Data Storage and Retention

A. Infrastructure

Data may be processed and stored using:

  • Vercel (hosting and edge infrastructure)
  • Neon (PostgreSQL database)
  • Upstash (Redis/caching)
  • Stripe (payments)
  • Google and Resend (authentication and account email delivery)

B. Video Storage Policy (Important)

  • Uploaded and processed files are stored temporarily in shared storage directories.
  • Storage capacity is finite and managed via a limited-size queue.
  • Videos may be automatically and permanently deleted at any time without prior notice, including when storage capacity is reached or for system maintenance.
  • No minimum retention period is guaranteed.
  • The Service is a temporary processing workspace, not a permanent storage solution.
  • Users are solely responsible for downloading and maintaining backups of all content immediately after processing.

C. Retention Periods

  • Account data: retained until account deletion.
  • Chat history: retained until deleted by user or account termination.
  • Payment records: retained for accounting/legal compliance.
  • Security, API, audit, and operational logs: retained according to documented security, fraud-prevention, support, and legal requirements, then deleted or de-identified.

D. Security Measures

We implement reasonable safeguards including:

  • Encryption in transit (HTTPS)
  • Role-based access controls
  • Infrastructure-level protections

However, no system can guarantee absolute security.

5. Third-Party Services

We rely on third-party service providers including:

  • Google (OAuth authentication) and Resend (account emails)
  • Stripe (payments)
  • Vercel (hosting/CDN)
  • Neon (database)
  • Upstash (Redis)

These providers may process data on our behalf.

6. Your Rights (GDPR / CCPA)

Depending on your location, you may have rights to:

  • Access your personal data
  • Request deletion
  • Request correction
  • Export your data
  • Object to certain processing

To exercise rights, contact: support@4014labs.com

We will respond as required by applicable law.

7. Children's Privacy

The Service is intended only for individuals 18 years or older.

We do not knowingly collect data from minors.

8. Changes to This Policy

We may update this Privacy Policy periodically. Updates will be posted on this page with a revised effective date.

Continued use constitutes acceptance.

9. Contact Information

  • Email: support@4014labs.com
  • Company Address: 131 Continental Dr Suite 305 Newark, DE 19713