Privacy Policy
Effective date: 28 July 2026 · Last updated: 14 October 2026 (v0.7)
This is an English translation of the Polish original (Polityka Prywatności), which is the governing version. In the event of any discrepancy between the two versions, the Polish version prevails. Questions: privacy@aideasflow.com.
1. Who is the controller of your data
The controller of your personal data is Aideasflow sp. z o.o., with its registered office in [address — after company registration], entered in the register of entrepreneurs of the National Court Register (KRS) under number [KRS], tax identification number (NIP) [NIP] (“Aideasflow”, “we”).
Data protection contact: privacy@aideasflow.com
This policy covers the aideasflow.com website and the Aideasflow platform in all its versions: beta.aideasflow.ai (beta version) and dev.aideasflow.ai (development version). Where the platform versions work differently, we say so explicitly.
The two roles in which we process data:
- We are the controller of the data of visitors to our websites (aideasflow.com, aideasflow.ai), people who contact us, business contacts and the billing and account data of our customers.
- We are a processor with respect to the data of employees of companies that use the Aideasflow platform. In this respect, the controller is the employer (our customer), and we process the data on its documented instructions, under a data processing agreement (DPA). Questions about data processed within a company account (e.g. the content of submitted ideas) should be addressed first to your employer; we will provide the employer with the necessary support.
2. What data we collect
Data you provide directly:
- account data: email address, display name, role in the organisation, company; if you sign in with a Google or Microsoft account — also the profile data provided by that provider (first and last name, profile picture, account identifier with that provider); your display name and profile picture are visible to other users in your organisation (e.g. next to ideas and in the company chat);
- content entered into the platform: submitted ideas/improvements, comments, problem descriptions, attachments, as well as declarations relating to ideas (e.g. the declared implementation time, estimated savings);
- content of conversations with the AI assistant (coach): we store your messages and the assistant’s replies so that the conversation keeps its context and so that we can look after the quality of the AI features (retention period — section 7); you may also voluntarily rate or comment on the assistant’s reply;
- company chat: the content of messages you exchange with other users in your organisation (direct messages and shared threads about an idea or a topic), the time they were sent and — optionally — the title of the idea the message relates to and, if your organisation uses the rewards programme, a tip given for a message (the amount and the person who gave it); direct messages are visible only to their participants, and idea or topic threads to people in your organisation who have access to that idea or topic; chat content is currently not used by the AI features; retention period — section 7;
- internal communication between authorised roles: short questions and answers exchanged between the HR department and a manager to clarify a user’s reward request; they concern the rewarded user but are not visible in that user’s view of the application (only the authorised HR/manager roles have access); they are subject to GDPR rights exercised through the employer (the controller) — retention period in section 7;
- contact details provided in forms, in emails, when booking a demo in the online calendar or during the sales process (first name, last name, company, job title, email, phone);
- customers’ billing data (invoicing details).
Data created in the platform:
- development and rewards programme (if your organisation uses it): points, badges, mission progress, competence belts, rewards and tips credited, balance, payout or redemption requests and the decisions on them; the platform calculates some of these automatically from your activity (e.g. ideas submitted and implemented, use of the AI assistant) according to rules set by your employer — section 4;
- diagnostic record of AI calls: what was sent to the AI model and what the model replied — section 4.
Data collected automatically:
- basic technical logs (IP address, browser type, timestamps, security events) — necessary for the operation and security of the service;
- country determined from your IP address — only when your browser asks for neither Polish nor English, and solely to choose the interface language (Polish for Poland, English for other countries); we do not save the country code in our database or link it to your account (details in our Cookie Policy);
- account device registry: when you sign in, we store a random device identifier (assigned by us and stored in your browser — it is not a hardware identifier or a device “fingerprint”), the browser/operating system type, the time of the first and last sign-in, the device name you assign and the IP address of the last sign-in. Purpose: accounts are personal — we limit the number of devices using one account at the same time and protect account security. You can see the list of your devices in your profile and revoke any of them yourself. The administrator of the company account (your employer) sees the list of devices of users in its organisation without IP addresses; the IP address is available only to authorised Aideasflow personnel;
- data on the use of platform features, to the extent needed to provide the service and for billing;
- cookies and similar technologies — details in our Cookie Policy.
Competence belt certificate: when a belt is awarded, the platform creates a certificate with a random verification code (a link or a QR code). Anyone you share this code with will see, on the verification page, your display name, the name of the belt, the name of your company and the award date — without your email address. Only you share the code; without it the verification page shows no data (sections 5 and 7).
We do not direct the service at children and we do not knowingly collect data of persons under 16 years of age.
3. Purposes and legal bases of processing
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and maintaining an account, providing the service | account data, content in the platform | Article 6(1)(b) (contract) — with respect to customers; with respect to employee data, we act as a processor on the employer’s instructions (Article 28) |
| AI features (analysis and coaching of ideas) | content of submitted ideas, organisational context | as above — part of the service provided; see section 4 |
| Investigating errors and checking the quality of the AI features | diagnostic record of AI calls (content sent to the model and the reply), ratings of AI replies | with respect to employee data — as a processor on the employer’s instructions (Article 28), as part of maintaining the quality and security of the service; see section 4 |
| Development and rewards programme | points, badges, mission progress, belts, rewards and tips credited, balance, payout requests | the programme is run by the employer — we act as a processor on its instructions (Article 28); see section 4 and §2(4) of the Terms of Service |
| Billing and invoicing | billing data | Article 6(1)(c) (legal obligation — tax/accounting regulations) |
| Service security, logs, abuse prevention | technical logs, IP address | Article 6(1)(f) (legitimate interest — security) |
| Choosing the interface language on your first visit | country determined from your IP address | Article 6(1)(f) (legitimate interest — showing the service in a language you understand) |
| Enforcing the device limit on an account — accounts are personal; we prevent one account from being shared by several people | account device registry (identifier, browser type, sign-in times, IP address) | Article 6(1)(f) (legitimate interest — enforcing licence terms and account security); you have the right to object (Article 21 — section 8) |
| Sales contact, CRM, responding to enquiries (including arranging a demo) | contact details | Article 6(1)(f) (legitimate interest) or Article 6(1)(b) (steps prior to entering into a contract) |
| Booking a demo in the online calendar (the aideasflow.com/demo page): displaying and securing the calendar, booking a time slot, creating a Microsoft Teams meeting and sending the invitation by email; with your consent — statistics of calendar views in our HubSpot account | first name, last name, email, selected time slot; when the calendar is displayed — IP address and technical browser data (see section 5 and the Cookie Policy) | Article 6(1)(b) (steps taken at your request prior to entering into a contract) and Article 6(1)(f) (legitimate interest — providing and securing the calendar); view statistics and the collection and transfer of technical data to HubSpot by the analytics code in the calendar window — Article 6(1)(a) (consent given by clicking “Show calendar”; you can withdraw it by closing or reloading the page) |
| Newsletter / marketing communications | email address | Article 6(1)(a) (consent) — you can withdraw it at any time |
| Pursuing and defending claims | contract and billing data | Article 6(1)(f) (legitimate interest) |
We do not process special categories of data (Article 9) and we ask you not to enter such data into the platform.
4. How the AI features work
The platform uses language models (LLMs) from third-party providers to analyse and improve submitted ideas (e.g. quality suggestions, analysis for managers, verification of implementation reports). This means that the content of an idea and the necessary context are sent to the AI model provider acting as our sub-processor. The context may include, among other things, the department and category of the idea’s author, attachment names, your organisation’s goals and earlier messages in the conversation and — when an implementation report is verified — also the content of small text attachments (e.g. CSV, TXT). Model providers:
- Anthropic (Claude models — processing in the USA),
- Google Cloud (Gemini models provided through the Vertex AI service — processing in the EU) — in the development version of the platform (dev.aideasflow.ai),
- Google (Gemini models provided through the Gemini API — data may also be processed outside the EU, including in the USA) — in the beta version of the platform (beta.aideasflow.ai).
We use the paid commercial APIs of these providers. Under their terms, data sent via the API is not used to train models (Anthropic Commercial Terms; Google Cloud Service Specific Terms — Vertex AI; Gemini API Additional Terms of Service — paid services). Google may keep Gemini API prompts and responses for a limited time solely to detect violations of its usage policy.
We store the course of conversations with the AI assistant (your messages and the assistant’s replies) so that the conversation keeps its context across follow-up questions and so that we can verify the quality and accountability of the AI features. We keep transcripts in a separate, protected part of the database for a limited time (section 7) and then delete them. The technical log of AI calls contains metadata only (e.g. the number of tokens) — no content.
Diagnostic record of AI calls. For every call to an AI feature we keep a diagnostic record for 30 days: what was sent to the model, what the model replied and with which technical settings. It is used to investigate errors and to check the quality of AI replies. Only authorised members of the Aideasflow team, signing in with two-factor authentication, can access the content of these records; every time a record is opened, this is logged. Authorised people may also rate the quality of AI replies — a comment on a rating is deleted together with the record it concerns, and only the numeric rating remains, without the content of the conversation.
In the beta version of the platform (beta.aideasflow.ai), if your organisation turns on suggestions of similar ideas, the content of that organisation’s ideas (title, problem description and solution) is processed by the Gemini API into a search index (so-called embeddings). The index is used only for suggestions within the same organisation.
AI results are assistive (suggestions, analyses) — we do not make decisions about users based solely on automated processing that would produce legal effects (Article 22 GDPR). Decisions about ideas are made by people (supervisors / the managerial role at the customer).
Development and rewards programme. Points, mission progress, some competence belts (e.g. the first belt after completing the introductory missions) and the related bonuses are credited by the platform automatically according to fixed rules set by your employer — without the use of AI. A payout or redemption of a reward is always approved by a person on the employer’s side. The programme is run by your employer, which is responsible for its rules — you can ask your employer to explain the rules and to have a person check a calculation.
5. Who we share data with (recipients)
We use processors acting on our behalf:
| Provider | Role | Processing location |
|---|---|---|
| Supabase | database, authentication, file storage, server functions | EU — Frankfurt (eu-central-1; beta version of the platform, beta.aideasflow.ai) and Ireland (eu-west-1); development version of the platform (dev.aideasflow.ai) — United Kingdom, London (eu-west-2) |
| Vercel | hosting of the application and the website | EU/USA |
| Resend | sending transactional emails (e.g. invitations) | USA |
| Anthropic | AI features (Claude) | USA |
| Google Cloud | AI features (Vertex AI) — development version of the platform (dev.aideasflow.ai) | EU (Warsaw — europe-central2; EU multi-region location) |
| AI features (Gemini API) — beta version of the platform (beta.aideasflow.ai) | countries in which Google or its subcontractors have infrastructure, including the USA | |
| HubSpot | CRM, sales contact, handling of website forms (newsletter, demo request) and of the demo booking calendar (HubSpot Meetings on the aideasflow.com/demo page) | EU (CRM data hosted in the EU); part of the technical data from the calendar window — also USA |
| Microsoft | company email, calendar and online meetings (Microsoft 365, Teams) — including the meeting created when a demo is booked | EU |
Signing in with a Google or Microsoft account. If you choose to sign in with a Google or Microsoft account, that provider transfers to us, at your request, the profile data described in section 2. The sign-in provider is not our processor: it is responsible for your account with it as a separate controller, under its own privacy policy.
HubSpot as a separate controller. After you click “Show calendar” on the aideasflow.com/demo page, HubSpot’s tracking code starts running in the booking calendar window and collects technical data, including your IP address and online identifiers. According to its privacy policy, HubSpot also uses such data for its own purposes (including developing its products) as a separate controller. We are jointly responsible with HubSpot for collecting this data in the window embedded on our website and for transferring it to HubSpot — on the basis of your consent (Article 6(1)(a) GDPR); HubSpot is responsible for its further use for HubSpot’s own purposes. Technical details: Cookie Policy. You can also arrange a demo without the calendar by emailing sales@aideasflow.com.
People you share your belt certificate with. The data in the belt certificate (display name, belt, company, award date — section 2) is visible only to the person you give the certificate link or QR code to yourself, e.g. a recruiter or a supervisor. This disclosure happens on your initiative; we do not publish certificates or a list of their holders.
We may also disclose data to competent authorities where required by law. We do not sell personal data.
6. Transfers of data outside the EEA
Some providers (Resend, Anthropic, Google — with respect to the Gemini API in the beta version of the platform, partly Vercel and also HubSpot — with respect to part of the technical data from the booking calendar window) process data in the USA or in other countries outside the EEA, and the data of the development version of the platform (dev.aideasflow.ai) is stored in the United Kingdom. Transfers are based on:
- the European Commission’s decision finding that the United Kingdom ensures an adequate level of protection of personal data (Article 45 GDPR; Commission Implementing Decision (EU) 2021/1772) — for data stored in the United Kingdom,
- the EU–U.S. Data Privacy Framework adequacy decision — for providers certified under the DPF (including Google, Vercel, Resend, Microsoft, HubSpot),
- standard contractual clauses (SCCs) included in the data processing agreements with the other providers — including Anthropic (EU SCCs Module 2/3 + UK/Swiss Addendum, included in Anthropic’s DPA incorporated into its Commercial Terms of Service) and Supabase; SCCs also serve as a fallback mechanism for DPF-certified providers (including Resend and HubSpot — SCCs in their data processing agreements).
You can obtain a copy of the information on the safeguards applied by contacting us.
7. How long we keep data
| Category | Period |
|---|---|
| Account data and content in the platform (including data of the development and rewards programme) | for the term of the contract with the customer; after it ends, deletion or return in accordance with the DPA within 30 days |
| Transcripts of conversations with the AI assistant and ratings/comments on replies | 90 days from storage; earlier — when the account is deleted |
| Diagnostic record of AI calls (content sent to the model and the reply) | 30 days |
| Technical log of AI calls (metadata, no content) | 90 days |
| Internal HR↔manager communication clarifying reward requests | 90 days from the last message in the thread; earlier — when the contract with the customer ends (deletion or return in accordance with the DPA) |
| Company chat (messages between users) | for the term of the contract with the customer; after it ends, deletion or return in accordance with the DPA within 30 days |
| Belt certificates (verification code) | for the term of the contract with the customer; after it ends, deletion or return in accordance with the DPA within 30 days |
| Account device registry | active devices: for as long as the account exists; revoked or unused devices: 12 months from the last activity; earlier — when the account is deleted |
| Billing data | 5 years from the end of the tax year (tax regulations) |
| Technical and security logs | up to 12 months |
| Contact / CRM data (including demo booking data) | until you object or the purpose of the contact ceases |
| Newsletter | until consent is withdrawn |
| Backups | deleted on a rolling basis, within 35 days at the latest |
8. Your rights
You have the right of access to your data and the rights to rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interest and to withdraw consent at any time (without affecting the lawfulness of processing carried out before withdrawal).
To exercise your rights, write to privacy@aideasflow.com. We respond within one month. Where we process your data as a processor (employee data in the platform), we will forward the request to your employer and support its fulfilment.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
9. Security
We apply technical and organisational measures appropriate to the risk, including: encryption in transit (TLS), encryption of data at rest at the infrastructure provider, row-level access control in the database (RLS), separation of roles and permissions, two-factor authentication for Aideasflow personnel with access to AI diagnostic records, event logging and regular security reviews.
10. Changes to this policy
We will inform you of material changes on the website or by email and, for users of the platform, also in the platform. The current version is always available at aideasflow.com/privacy (English translation: aideasflow.com/en/privacy); the same version, marked with the same number, applies on the website and in all versions of the platform.
← Back to home