IdeaNexus Privacy Policy — Australian SaaS DRAFT
1. Who we are
[TO CONFIRM: Australian legal entity and trading name] operates IdeaNexus. Address: [TO CONFIRM]. Privacy contact: [TO CONFIRM: email and responsible role]. Effective date/version: [TO CONFIRM].
This policy explains personal information handling in our website and SaaS service. [TO CONFIRM: Privacy Act 1988 and Australian Privacy Principles applicability, any exemptions and other countries' requirements.] Being based in Australia alone does not settle coverage. Our proposed commitments below must reflect actual practices whether or not particular statutory obligations apply.
2. Information we collect and why
We collect information you provide when creating an account, using features, subscribing or contacting us. We also receive information from configured identity and payment providers and collect technical information when you use the service.
| Information | Purpose |
|---|---|
| Email, name, profile image, biography, account identifiers and verification information | Sign-in, account administration, identity linking and profiles |
| Optional business background, skills, experience, budget range, goals and time availability | Personalising business guidance and recommendations |
| Prompts, conversations, saved ideas, research, project material and saved assistant context | Providing requested AI assistance, planning and application-building features |
| Subscription/customer/payment identifiers, plan, payment status and transaction evidence | Billing support, account entitlements, reconciliation and dispute handling |
| Newsletter email, optional first name and subscription information | Managing newsletter subscriptions where enabled |
| Session and browser state, request IP information used for abuse controls, and configured diagnostics | Maintaining sessions, securing the service and investigating faults |
| Information supplied in support requests | Responding to requests and resolving problems |
[TO CONFIRM: attachment types, precise diagnostic/log fields, support systems and complete generated-application end-user data flows.] Avoid putting secrets or unnecessary personal information into prompts or support messages. Sensitive personal information is not an approved use case unless expressly confirmed for the relevant feature.
Some information is necessary for an account or a requested feature. If you do not provide it, we may be unable to provide that feature. Optional profile fields can be left blank. [TO CONFIRM: available anonymous or pseudonymous interactions.]
3. Providers and disclosure
We use providers to operate authentication, AI processing, payments, infrastructure, communications and diagnostics. The inspected integration inventory includes:
- WorkOS AuthKit for authentication (sign-in, sign-up, email verification and password reset). Supabase Auth is retired; legacy account records stay in the Supabase database until the planned database migration. [TO CONFIRM: enabled sign-in methods.]
- OpenRouter and the configured downstream model providers for AI requests. Relevant prompts and context are sent to provide requested responses. [TO CONFIRM: active models/providers, logging, retention, training settings and any separate IdeaNexus training use.]
- TypeSafe AI, Inc. (typesafe.ai), a third-party AI provider, classifies Home chat messages to choose the right action. It receives the message and a short recent conversation excerpt. Location: United States.
- Dodo for hosted checkout and billing management when enabled. Account name, email and an internal identifier are supplied to checkout. Current Test Mode activity does not establish live billing. [TO CONFIRM: live relationship and exact payment-data inventory.]
- Beehiiv for newsletter syncing where configured, and Sentry for configured error diagnostics. [TO CONFIRM: active deployment, transmitted fields and unsubscribe process.]
[TO CONFIRM: complete active hosting, database, research/search, generated-app/sandbox and optional integration recipient list.] This inventory is not proof that every integration is currently active. Payment details entered on a provider's hosted pages are also handled under that provider's applicable notice; confirm what returns to IdeaNexus.
We may disclose information where required or authorised by law or reasonably necessary to investigate abuse or protect legal rights, subject to applicable restrictions. [TO CONFIRM: actual advertising, sale or other commercial sharing practices before stating any position.] This policy does not grant unrestricted permission for new purposes.
4. Overseas handling
Our providers may store or process information outside Australia. [TO CONFIRM: likely recipient countries for each active provider, including downstream model providers, and relevant contractual and transfer arrangements.] We do not promise Australian-only storage. Where applicable, we will take the steps required by Australian privacy law for overseas disclosures. Acceptance of this policy is not intended to waive protections or create a blanket overseas-transfer exception.
5. Cookies, browser storage and communications
The product uses session state and browser storage for functions such as appearance, pending research, builder prompts and workspace continuity. [TO CONFIRM: cookie/storage inventory, lifetimes, active optional analytics, third-party tracking and required choice controls.] Blocking necessary storage may prevent sign-in or features from working.
Newsletter subscriptions are separate from essential account and billing messages. Proposed choice: use an unsubscribe link or contact us to stop newsletters. [TO CONFIRM: that this process works before publication.] The inspected Settings release does not provide general notification preferences or MFA-enrolment controls.
6. Security and retention
We propose to take reasonable steps to protect personal information against loss, misuse and unauthorised access, modification or disclosure. No system is completely secure. [TO CONFIRM: implemented safeguards, access governance, incident process and any certifications before claiming them.] Where legally required, we will notify affected individuals and the relevant authority of qualifying data breaches.
We retain information for the purposes described in this policy, including necessary account, security, billing and legal records. When it is no longer needed and no legal retention requirement applies, the proposed approach is secure deletion or de-identification. [TO CONFIRM: category-specific periods or criteria, backup expiry, provider deletion and generated-app resource cleanup.] This is not a promise of immediate deletion from every backup or provider.
7. Access, correction, closure and complaints
Contact our privacy contact to request access to or correction of your information, ask about deletion or closure, or make a privacy complaint. We may reasonably verify your identity before acting. We will assess requests under applicable law, explain any lawful refusal and available review options, and correct inaccurate information where appropriate. [TO CONFIRM: request owner, verification method and achievable response process/timeframes.]
The current Settings controls do not provide complete account deletion. Deleting one saved assistant memory does not delete your account, projects or billing records. Account closure may leave records that must be retained; we will explain relevant limits when handling your request.
For a complaint, describe what happened and the outcome you seek. Our proposed process is to acknowledge it, investigate the relevant handling and provide a written outcome and next steps. [TO CONFIRM: working contact, owner and response targets.] Where the matter falls within its jurisdiction, you may also contact the Office of the Australian Information Commissioner at oaic.gov.au/privacy/privacy-complaints.
8. Generated apps, age and policy changes
If you operate an application created with IdeaNexus, you may have separate responsibilities for its end users' information and should provide appropriate notices. [TO CONFIRM: when IdeaNexus hosts or otherwise handles that information, its role and any additional processing terms.]
Minimum age, handling of children's information and supported customer regions: [TO CONFIRM].
We will date policy updates and explain material changes through [TO CONFIRM: notice channel]. A policy update does not by itself authorise otherwise unlawful handling or remove any separate consent requirement.