Privacy

ideare (the ideare.app site, the studio at studio.ideare.app, the API, the SDK, the CLI and the MCP server) is run by OpenWings Automação Comercial Ltda., CNPJ 63.852.648/0001-06 ("ideare", "we"). We are the controller of the data described here. Our data protection officer, who is also the encarregado under Brazil's LGPD, is Gustavo Salomé Silva: [email protected].

1. What ideare does

ideare makes a business's brand (a logo, colors, fonts and the files for every place) and its everyday posts. The try-it on the home page runs in your browser: what you type there doesn't reach us. It only leaves your browser if you press "Keep going in the studio", and then it travels inside the link.

2. What we collect

• Account: your email address, the language you use and, if you want, your name. You sign in with a link or a 6-digit code we email you.
• Your brands and posts: what you write and choose (name, lines, colors, fonts, logo), the files you upload (logos and photos), the links you ask us to read and the posts you make.
• Team: the email addresses of the people you invite and the role of each.
• Usage: every AI request (what was asked, how many credits it took and what it cost us), your plan's counters, your API keys (we keep only a code worked out from each key, never the key), the steps you take in the product (approving a brand, for example) and errors.
• Payment: your plan, your credits and Stripe's references. Card numbers never pass through us: Stripe keeps them.
• Technical: the IP address and browser of each request, in the server logs. For the site's AI suggestions, we keep a code worked out from your device and IP address, never the address itself, to limit free use.

The site uses no cookies. Your browser remembers the language you picked and the examples you've seen, and none of that reaches us. In the studio, your browser keeps your session so you stay signed in.

3. What we use it for

To run the service: drawing your files, publishing what you approve, billing you, keeping things safe, answering when you write, and learning which parts of the product work. We don't sell your data, we don't use it for ads, and we don't train AI models on what you make.

4. What becomes public

A brand has a draft and approved versions. The draft is private. When you approve a version, it becomes public at cdn.ideare.app and at ideare.app/b/<your-brand>: the name, the logo, the colors, the fonts, the brand's lines and every file. Anyone can see and download them. Your phone, WhatsApp, social links, voice notes and reference pictures only show if you tick them. A new brand's page stays out of search engines until you say the brand has launched.

If you delete a brand, we take its public versions down. Copies other people already downloaded stay with them.

5. Legal basis

• To do what you asked for (your account, brands, files and payments): performing our contract (GDPR art. 6(1)(b); LGPD art. 7, V).
• For security, abuse prevention, server logs and product metrics: legitimate interest (GDPR art. 6(1)(f); LGPD art. 7, IX).
• To keep payment records: a legal obligation (GDPR art. 6(1)(c); LGPD art. 7, II).

6. Who else handles the data

• Oracle Cloud (São Paulo, Brazil): the servers that run the API, the database and sign-in.
• Google, through the Gemini API (United States): suggests names, lines and colors, makes the AI pictures and checks pictures. It receives what you send to an AI button: the words, the pictures and the references. We use the paid API, under which Google doesn't use this data to improve its products.
• OpenRouter (United States): passes AI symbol requests to Recraft, which draws them as vectors. Both receive the symbol's brief, written from your brand's words.
• Cloudflare (United States and a global network): hosts the site and the studio (Pages), stores files in R2, in the United States, and checks that you're a person (Turnstile).
• Amazon Web Services (Amazon SES, us-east-1 region, United States): sends our email. It receives your address and the message.
• Stripe (United States): processes payments. Card details stay with Stripe.
• socially (run by the same company, with servers in Brazil): reads public social media profiles when you paste a profile link, and checks whether a handle is free. It receives the link or the handle, not who asked.
• scrapa: reads public web pages when you paste a site's link. It receives the address, not who asked.

7. Data outside Brazil and the EU

Some of the services above are in the United States. For readers in the European Union, these transfers rely on the European Commission's standard contractual clauses or the EU-US Data Privacy Framework, depending on the provider. Under Brazil's LGPD, they follow art. 33: the standard clauses approved by the ANPD (art. 33, II, b, and Resolution CD/ANPD 19/2024) where the provider offers them, and they are needed to perform the contract you made with us (art. 33, IX, with art. 7, V).

8. How long we keep it

• Your account, brands, files and posts: for as long as the account exists.
• Server logs: 180 days.
• Backups: 7 days on our servers and 30 days in private storage.
• Pictures from the site's AI suggestions: 7 days.
• Payment records: for as long as tax law requires.

When you ask us to delete your account, we remove your data from the system, and it leaves the backups when they expire. A file you uploaded is only deleted for good once no other account uses the very same file.

9. Your rights

You can ask us to confirm whether we hold data about you, to show it to you, to correct it, to hand it over so you can take it elsewhere, to anonymize or delete it, to tell you who we share it with, to withdraw a consent, and to stop a use based on legitimate interest (GDPR arts. 15 to 21; LGPD art. 18). Write to [email protected]: we answer within 15 days. You can also complain to the data protection authority where you live, or to the ANPD in Brazil.

10. Security

All traffic uses TLS. API keys are stored only as a code worked out from them. The database only accepts encrypted connections, and backups sit in private storage. Few people have access, and only to keep the service running. If an incident affects you, we tell you and the authorities, as the law requires.

11. Age

ideare is for people aged 18 and over. We don't knowingly keep accounts for minors.

12. Email

We only send email about your account: sign-in codes, invitations, approval notices, receipts and the confirmation when you cancel a purchase. We send no marketing email. If that changes, we'll ask first, with the box unticked.

13. Changes

If this policy changes in a way that matters, we email you and update the date at the top. The terms of use cover the rest of the contract.