Privacy Policy

1. Who We Are

Ideaflore ("we", "us") is an educational platform being developed at the University of Bristol as an early-stage staff spin-out pilot. For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), the data controller is Farhad Babaee (trading as Ideaflore). You can reach us about any privacy matter at [email protected].

2. Data We Collect

We collect the email address, display name, and username you provide when your account is created. We also store content you create (posts, lecture notes, messages, ideaboards, poll responses) and the prompts and content you submit to our AI features. To operate and secure the platform we process basic usage and technical data, including timestamps, engagement counts, your IP address, and basic device and log information (for example, for security and abuse prevention).

If you report content, or your content is reported, we also process the report (its reason and any comment), an immutable snapshot of the reported content taken for review, and a record of any moderation decision. A reporter's identity is not shown to the person they reported, but is retained for integrity and abuse-prevention.

3. How We Use It & Legal Basis

We use your data solely to provide the platform's features — authentication, content display, messaging, Spaces (courses and groups), and AI assistance. Our lawful bases are (a) performance of our agreement to provide you the service, and (b) our legitimate interests in operating, securing, and improving the platform. We do not sell or rent your personal data, we do not share it for advertising, and we (Ideaflore) do not use it to train AI models.

4. AI Features

When you use AI features (such as the AI tutor or "Help me create"), the prompts you type and the relevant content are sent to Google's Gemini API to generate a response. Google processes this data as our service provider to return the result, and does not use these prompts to train its models. Because Google may process this outside the UK/EU (for example in the United States), the transfer relies on appropriate safeguards such as the UK Addendum to the EU Standard Contractual Clauses. Please avoid entering sensitive personal information into AI prompts.

5. Where Your Data Is Stored

We rely on a small number of service providers ("processors") to run Ideaflore:

• Supabase — database, authentication, and file storage, hosted on AWS in the UK/EU region. Files you upload are kept in private buckets accessible only to authorised members of the relevant Space, or to you.
• Vercel — application hosting and content delivery. Vercel Inc. is US-based and may process request metadata (such as your IP address) in the United States under appropriate safeguards.
• Resend — delivery of account emails (such as sign-in links, password resets, and invitations), which involves processing your email address.
• Google — the Gemini API, used only when you invoke an AI feature (see section 4).

6. Cookies

We use essential authentication cookies set by Supabase Auth to keep you logged in. No tracking or advertising cookies are used.

7. Interactive Content

Some posts and articles may contain user-created or AI-generated interactive HTML. This content is displayed inside a sandboxed frame on a separate user-content origin, so it is not treated as part of the main Ideaflore app and cannot access your Ideaflore session cookies. Embedded content should not ask for passwords, payment details, or other sensitive information. It may load limited third-party assets such as images, fonts, or scripts allowed by our security policy, which means those providers may receive normal browser request metadata such as your IP address and user agent.

8. Security

We protect your data with encryption in transit and at rest, row-level access controls in the database, and private storage buckets so content is only accessible to those you share it with. No system can be guaranteed perfectly secure, but we take reasonable measures to protect your information.

9. Retention

We keep your data for as long as your account is active. If you delete your account, or ask us to delete it, we remove your personal data within 30 days, except where we are required to keep limited records to comply with the law.

10. Your Rights

Under UK data protection law you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and the right to data portability. To exercise any of these, contact [email protected] and we will action your request within 30 days. You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO), at ico.org.uk.

11. Age

Ideaflore is intended for adults aged 18 and over. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.

12. Changes

We may update this policy from time to time. Material changes will be communicated via the platform or by email.

13. Contact

Privacy questions: [email protected].