Privacy Policy

1. Who We Are

IdeaSpark is operated by Nextera Consulting LLC, based in Chicago, Illinois, United States. We are the data controller for personal information collected through IdeaSpark. For all privacy matters, contact us at ideaspark@nexteraconsult.com.

2. Information We Collect

Account data: Your email address, password (stored as a one-way hash by Supabase — we never see your plaintext password), and any display name or profile information you choose to provide.

Content data: The startup idea descriptions you submit ("prompts") and the AI-generated blueprints we create for you. This content is stored in our database and associated with your account.

Usage data: How many blueprint generations you have made in the current billing period, timestamps of generations, and which blueprint sections you regenerate.

Billing data: Your subscription status, plan type, billing period dates, and Stripe customer ID. We do not store full payment card numbers — card data is handled directly by Stripe.

Technical data: IP address, browser type, operating system, referring URL, and pages visited, collected via PostHog (see Section 5). Log data including error reports containing stack traces and session context, collected via Sentry.

Communications: Emails you send to our support address, including their content. If you submit an email address on a public validation or waitlist page, we store it to record early interest for that page; it is not displayed publicly.

3. How We Use Your Information

• Providing the service: Authenticating you, storing and displaying your blueprints, processing payments, and enforcing plan generation limits.
• AI generation: Your submitted idea descriptions are transmitted to our AI generation pipeline to produce blueprint content (see Section 6).
• Service communications: Transactional emails such as account verification, password resets, billing, and security notices are sent as needed to operate your account.
• Marketing communications: Product updates, re-engagement, and upgrade emails are sent only when you opt in. You can unsubscribe using the link in those emails.
• Product improvement: Aggregated and anonymized usage analytics to understand how features are used and where the service can be improved.
• Security: Detecting and preventing fraud, abuse, and unauthorized access.
• Legal compliance: Maintaining records as required by law, responding to lawful requests from authorities.

4. Legal Basis for Processing

We process personal data as needed to provide the service, protect it, and meet applicable legal obligations.

• Contract performance: Processing necessary to provide the service you signed up for (authentication, generating blueprints, billing).
• Legitimate business interests: Security monitoring, fraud prevention, product analytics (PostHog, Sentry), and service communications.
• Legal obligation: Record-keeping required by applicable law, tax authorities, or regulatory requirements.

5. Third-Party Service Providers

We use service providers to operate IdeaSpark. They process data as needed to provide their services under their own applicable terms and privacy policies.

6. AI Generation and Third-Party AI Providers

How generation works: When you submit an idea for blueprint generation, the text of your idea is transmitted through our backend automation pipeline (n8n, self-hosted) to third-party AI language model providers to generate your blueprint.

AI providers used: We route AI generation through OpenRouter and may use models from providers configured through that service, including OpenAI and others. Some features may use additional AI providers configured in our generation workflow. Your submitted idea text and relevant generation context are processed by these providers to produce output and are subject to their applicable terms and privacy policies.

What we do: We do not use your submitted ideas or generated blueprints to train IdeaSpark's own models. We do not sell your content. We do not make provider-training commitments unless they are stated in the applicable provider terms or account configuration.

Recommendation: Do not submit sensitive personal information, trade secrets, confidential business information, or anything you would not want transmitted to a third-party AI provider as part of your idea descriptions.

7. Cookies and Tracking

We use the following types of cookies and similar tracking technologies:

We do not use advertising cookies, third-party ad networks, or sell cookie-based data to any party.

8. Data Retention

• Account and content data: Retained for as long as your account is active. When you delete your account, we remove active account data, ideas, blueprints, and profile data. Some records may be retained in backups or where needed for security, billing, legal, or fraud-prevention purposes.
• Billing records: Stripe and related billing records may be retained as required for billing, tax, fraud-prevention, or legal purposes.
• Provider records: Error, analytics, and delivery records are retained according to the applicable service configuration and provider policy.
• Audit logs: Internal security and audit records may be retained where needed for security, fraud prevention, or legal obligations.

9. Data Location

IdeaSpark is operated by Nextera Consulting LLC in the United States. Our service providers may process data in the United States and other locations according to their infrastructure and policies.

10. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you. You can export your data via Settings → Export My Data.
• Rectification: Correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): Request deletion of your data. You can delete your account via Settings → Delete Account.
• Portability: Receive your data in a machine-readable format.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent (e.g., analytics cookies), you may withdraw at any time without affecting prior processing.

To exercise any of these rights, email ideaspark@nexteraconsult.com. We will respond within 30 days (or within the timeframe required by applicable law). We may need to verify your identity before processing your request.

11. California Residents (CCPA / CPRA) — Do Not Sell My Information

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of personal information we have collected, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: We do not sell your personal information to third parties, and we do not share personal information for cross-context behavioral advertising. No opt-out is required, but if our practices change, we will provide notice and the means to opt out.
• Non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a request, email ideaspark@nexteraconsult.com with "CCPA Request" in the subject line. We will verify your identity and respond within 45 days.

12. Data Security

We use industry-standard security measures including: TLS/HTTPS for all data in transit; row-level security (RLS) enforced at the database level so each user can only access their own data; bcrypt-hashed passwords (via Supabase Auth); and access controls limiting who within Nextera Consulting can access production data.

No method of transmission over the internet or electronic storage is 100% secure. In the event of a data breach that affects your rights or freedoms, we will notify affected users and relevant authorities as required by applicable law (including within 72 hours under GDPR where applicable).

13. Children's Privacy

IdeaSpark is intended for users 18 years and older. We do not knowingly collect personal information from anyone under 18. If we become aware that a minor has provided us with personal information, we will delete it promptly. If you believe a minor's information has been collected, contact us at ideaspark@nexteraconsult.com.

14. Links to Other Sites

IdeaSpark may contain links to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. For material changes, we will notify you by email where practicable. Your continued use of IdeaSpark after changes are posted constitutes acceptance of the updated policy.

16. Contact

For all privacy questions, data requests, or concerns, contact us at ideaspark@nexteraconsult.com. Please include "Privacy" in the subject line.

Nextera Consulting LLC · Chicago, Illinois · United States