Privacy policy

Who we are

Ideaor is a product of Idea Creator Limited Partnership, a limited partnership registered in Ohio, United States. In this policy, “we” and “us” mean Idea Creator Limited Partnership. You can reach us at hello@ideaor.com.

Who this policy covers

• Agencies and their teams who use Ideaor. For your account and your agency's settings, we decide how the information is used.
• People who message an agency's Facebook Page. Their messages and details belong to that agency. We process them only to provide Ideaor to the agency, on its instructions.
• Visitors to ideaor.com, including anyone who uses the chat on this website.

What we collect

• Your account. Name, email address, and a password stored only as a one-way hash we cannot reverse.
• Your agency. Business name, website, service area, services, contact details, how you like to sound, and the facts you keep under “What Ideaor knows about you”. When you ask Ideaor to learn from your website or Facebook Page, we read the public pages of your website and your Page's public About details to fill these in for you to check.
• Your Facebook connection. The Page you choose, its name and picture, and the access tokens Facebook issues. Tokens are encrypted before they are stored and are only decrypted on our servers at the moment a request is made.
• Messenger conversations. Messages sent to your Page, the sender's public Facebook name and profile picture, the replies sent on your behalf, and a short summary of each conversation written by Ideaor for your team.
• Leads. Names, phone numbers, email addresses, locations and notes, whether shared in a conversation or added by you.
• Posts and pictures. The posts you create, edit, schedule and publish, and their pictures. Pictures are stored at a link that is not listed anywhere, so they can be published to Facebook; anyone with that exact link can view the picture.
• Google Drive, if you connect it. Only the files you pick in Google's own file picker, and the email address of the Google account you connect. The rest of your Drive is never visible to Ideaor.
• Page performance. Figures Facebook reports about your Page and its posts, such as reach and engagement.
• If you use the chat on this website. What you write, and, so that the person answering can help you and we can stop abuse: your IP address, the rough location it suggests (country, region, city), and your browser and operating system. We do not know your exact whereabouts and we do not track you across other websites.
• Visits to this website. Which pages were looked at and when. We count visitors using a code made by scrambling the IP address with a secret and the day's date, so the same person cannot be recognised tomorrow or traced back. No cookie is set for this.
• Google Analytics, unless you say no. A short notice about it appears once on your first visit. If you press Allow, or leave the notice for ten seconds until it closes, Google Analytics records which pages you visit, roughly where you are (country and city), your device and browser, and how you found us. It sets its own cookies to do this. If you press No thanks, Google Analytics is not loaded at all. You can change your answer at any time with Analytics choice at the bottom of every page.
• Operational records. Sign-in attempts and security events, with secrets removed before anything is written down.

What we do not collect

Ideaor is built for non-medical care and is designed not to gather health information: the assistant is instructed to decline medical questions and suggest speaking to a doctor. We never see or store payment card numbers, and we do not record calls.

How we use it

• To run the service: writing posts, publishing the ones you approve, answering messages, and recording leads.
• To show you your own posts, conversations, leads and numbers.
• To keep accounts secure, including rate limiting and investigating suspicious activity.
• To answer you when you contact us, and to tell you about changes that affect your account.

We do not sell information, use it for advertising, or use your agency's content or your conversations to train AI models.

Artificial intelligence

Posts, replies, conversation summaries and the “learn from my website” feature are produced by AI models. When one is needed, we send the model only what that task requires: your brief, your agency's profile, the text of the conversation being answered, or the website and Page text being read. We never send your password or your Facebook or Google tokens.

Who helps us run Ideaor

We use a small number of providers, each only for its part of the service:

• Supabase stores the database and post pictures, and handles sign-in and account emails.
• Railway runs the application.
• OpenRouter, which passes requests to Google's Gemini models, writes text and pictures.
• Meta Platforms receives the posts you approve and the replies sent from your Page, because that is where they are published, and sends us the messages people write to your Page.
• Google Analytics, for visitors to this website who have not said no to it, counts visits so we can see which pages are useful. We do not use it for advertising.
• Google, if you connect Google Drive, provides the files you pick.

These providers may process information in the United States, Canada and other countries. We may also disclose information where the law requires it, or to protect people from harm.

Facebook information

Information we receive from Facebook, such as your Page, the messages people send it, their public names and pictures, and your Page's figures, is used only to provide Ideaor to your agency. We do not sell it, use it for advertising, or share it with anyone except the providers above. Disconnecting your Page deletes its stored tokens immediately, and you can ask us to delete everything else, as described below.

Google information

Ideaor's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Files you pick from Google Drive are used only to attach them to your posts. They are not used for advertising or to train AI models, and no person at Ideaor reads them unless you ask us to help with a specific file.

Cookies and browser storage

We use only the cookies Ideaor needs to work: to keep you signed in, to remember which agency location you are working in, and to protect the Google sign-in step. Your choice of light or dark mode, and your answer to the analytics notice, are kept in your browser. Unless you say no to analytics on this website, Google Analytics sets its own cookies (names starting with _ga) to count visits; you can change your answer at any time with Analytics choice at the bottom of every page. We do not use advertising or cross-site tracking cookies.

If you ask us for help

Every account has four words in Settings, Account. Nobody at Ideaor can open your account without them, and you choose whether to read them out. They are not a password: they cannot sign anyone in, and they work nowhere except our own support screen.

When you do give them to us, the visit is recorded and shown back to you in that same screen: who looked, when, and what they were helping with. Access is read-only and expires by itself after an hour. You can replace your four words at any time, which immediately stops the old ones working.

How long we keep it

Some things are deleted automatically once they have done their job:

• IP addresses on website chats: removed after 30 days, while the conversation itself remains.
• Website chats: deleted after 180 days.
• Records of which pages were visited: deleted after 13 months.
• Failed support-key attempts: deleted after 90 days.
• Records of support opening your account: kept for a year, so the history is there if you need it.

Your agency's posts, conversations and leads stay until you delete them or close your account. When an account is closed, we delete its data within 30 days, except anything the law requires us to keep.

How to delete your data

If you use Ideaor for your agency:

• Delete individual posts, conversations and leads in Ideaor at any time.
• Disconnect your Facebook Page under Settings, Facebook. Its tokens are deleted immediately and posting and replying stop.
• You can also remove Ideaor from Facebook itself: Settings & privacy, Settings, Business integrations, then remove Ideaor.
• To close your account and delete everything, write to hello@ideaor.com from the email on the account. We confirm once it is done, within 30 days.

If you messaged an agency's Facebook Page: ask that agency to delete your conversation and details, or write to hello@ideaor.com with your Facebook name and the name of the Page you messaged. We will delete what we hold about you for that Page within 30 days and let you know when it is done.

Your rights

Depending on where you live, you may have the right to see the information we hold about you, correct it, have it deleted, receive a copy, or object to how it is used. Write to hello@ideaor.com and we will answer within 30 days. You can also complain to the data protection authority where you live.

Security

Every agency's data is separated at the database level rather than by application code, so one account cannot read another's. Facebook and Google tokens are encrypted at rest. Traffic is served over HTTPS. No system is perfect, and we will tell you promptly if something happens that affects your information.

Children

Ideaor is a business tool and is not intended for anyone under 18.

Changes

If we change this policy in a way that matters, we will say so in the product before the change takes effect, and update the date at the top of this page.