Privacy when you connect an AI app

What this page covers

You can connect ideare to an AI app or agent, like Claude, ChatGPT, Codex or Cursor: with the ideare plugin, as a connector, or with an API key. This page says what that app can see, what ideare keeps, and how to cut the app off. Everything else about your data is in our Privacy Policy.

Read the Privacy Policy

What the app can see and do

The app acts as you, with your role in the workspace you connected. It can read what you can read in ideare: the workspace's brands, with their drafts (including voice notes and art references that aren't public), approved versions, files and checks, the files your team uploaded, the credits and the runs you started.

It can change what you can change: start a brand, save a draft, ask the owner to approve it, read a link, check names, and draw AI symbols and art, which spend the workspace's credits.

It can't publish on its own. A connected app's approval is always a request the owner approves in the studio. Only a key an owner or admin makes by signing in to the ideare CLI publishes a version.

Through the plugin or a connector, it can't delete brands, change who's in the workspace, buy credits, or make or revoke keys. With an API key used directly on the API, it can also upload files, change a brand's settings and, if the key is the owner's, delete a brand. A read-only key can only read.

The app sees only what a tool returns when it calls one.

Who receives your data

What a tool returns goes to the company behind the AI app you connected, such as Anthropic for Claude or OpenAI for ChatGPT and Codex. That company handles it under its own privacy policy, and ideare does not control what it keeps. When the app asks for text suggestions, AI symbols or art, or reads a link, ideare sends the brand's details to the providers listed in our Privacy Policy, under the same rules as when you use those features in the studio.

What ideare keeps, and for how long

When you connect, the Connect page shows the app's name and the address it sends you back to. That sign-in works for 5 minutes (a link) or 10 minutes (a code) and can't be used after that. Its record stays with your account.

Connecting makes an API key named after the app. We store only a hash of the key, never the key itself, plus its name, its first few characters (so you can tell keys apart), who made it, and when it was made and last used. The key works until it is revoked. After that, its record stays with the workspace.

What the app does shows up in ideare as your own work. A saved draft records who saved it; an approval request or a version also records that it came through the app. Approved versions are public and never change, as the Privacy Policy says.

Each AI call is recorded with what it cost, so the credits add up. These records stay with the workspace.

Our API logs each request's route, result and duration, with no IP address and no content, and deletes those logs within 31 days. Our web server's access log also records the IP address and which app sent the request, with sign-in headers and secrets removed. We keep it for 180 days, then delete it.

Why we use it

To run the tools the app calls, to show who did what, to count credits and apply usage limits, to keep accounts safe and to fix problems. We don't sell this data or use it for advertising.

How to cut an app off

• Revoke its key in the studio, in the workspace's list of keys. The app loses access at once.
• Remove ideare from the AI app too, so the app forgets the key.
• If you leave a workspace, or are removed from it, your keys stop working there.
• To delete your account and your data, write to the address below.
• Your rights under the LGPD and the GDPR, and how to use them, are in our Privacy Policy.

Contact

Questions about this page? Email [email protected].