This policy explains what personal information Ideyo collects, why, who receives it, how long we keep it and how you can exercise your rights. It is written to meet Québec’s Act respecting the protection of personal information in the private sector, as amended by Law 25, and, for people in the European Union, the General Data Protection Regulation (GDPR).
01Who we are
Ideyo (ideyo.io) is operated by Mohamed Douaré, in Montréal, Québec, Canada (“Ideyo”, “we”). We are responsible for the personal information described here.
Our person in charge of the protection of personal information can be reached at privacy@ideyo.io.
02What we collect
- Account: your name, email address, a hash of your password (never the password itself), your language and your plan.
- Projects: the ideas, messages and settings you enter, and everything Ideyo produces for you: studies, specifications, designs, code and the log of each run.
- Keys and connections: the API keys you add and your GitHub token, encrypted at rest with AES-256-GCM. We only ever display their last four characters.
- Billing: your plan, purchases, amounts and invoices. Cards are handled by Stripe and mobile-money payments by CinetPay; we never see your card number or your mobile-money PIN.
- Technical data: IP address, browser type and timestamps in server logs, used for security and debugging. One strictly necessary session cookie keeps you signed in. We use no advertising or cross-site tracking cookies.
03Why we use it
- To provide the service you asked for: run your projects, store your documents and open pull requests (GDPR: performance of a contract).
- To bill you and keep accounting records (contract; legal obligation).
- To secure the service, prevent abuse and fix bugs (legitimate interest).
- To write to you about your account and, only if you agree, about new features (contract; consent, which you can withdraw at any time).
We do not sell personal information, and we do not use your projects to train AI models.
04Who receives it
AI model providers. To run a stage, Ideyo sends the relevant project text to the provider you chose for that stage, for example Anthropic, OpenAI, Google, Mistral, DeepSeek or OpenRouter. With your own key, that exchange is also governed by your agreement with the provider; for managed purchases, by Ideyo’s. Choose providers accordingly, and do not put information in a project that you are not allowed to share.
GitHub, when you connect it, receives the code and documents Ideyo pushes to your repository.
Payment processors: Stripe for cards, CinetPay for mobile money.
Hosting and email providers, bound by contract to use the information only on our behalf.
We disclose information to public authorities only when the law requires it.
05Transfers outside Québec and the European Union
Some of the recipients above process information outside Québec and outside the European Union, notably in the United States. Before such a transfer we assess, as Law 25 requires, whether the information will be adequately protected, and where the GDPR applies we rely on safeguards such as the European Commission’s standard contractual clauses.
06How long we keep it
- Account and projects: as long as your account is open. A deleted project is removed from the database at once and from backups within 30 days.
- When you delete your account, your keys, GitHub token, projects and documents are deleted at once; backups expire within 30 days.
- Billing records: as long as tax law requires (six years in Québec).
- Server logs: 30 days.
07How we protect it
Encryption in transit (TLS) and at rest for keys and tokens, access limited to the people who run the service, and a security review of every release. If an incident creates a risk of serious injury, we notify you and the Commission d’accès à l’information du Québec and, where the GDPR applies, the competent authority within 72 hours.
08Your rights
You can ask to access your personal information, correct it, delete it, receive it in a structured and commonly used format, or stop receiving messages. In the European Union you can also object to processing based on legitimate interest and ask us to restrict processing. Export and account deletion are available in your settings; for everything else, write to privacy@ideyo.io. We answer within 30 days.
Ideyo’s verdicts and scores are recommendations about ideas, not decisions about people: no decision about you is made solely by automated processing.
09Children
Ideyo is not intended for people under 16, and we do not knowingly collect their information.
10Complaints
If our answer does not satisfy you, you can complain to the Commission d’accès à l’information du Québec (cai.gouv.qc.ca) or, in the European Union, to the data protection authority of your country.
11Changes
We post every change here with a new date, and we tell you by email before a significant change takes effect.