ideas.soSign in

Privacy Policy

Last updated: 14 October 2026

ideas.so researches startup ideas. You write down an idea, answer a few questions about it, and we look at the competitors, the market and the demand for it. An idea you haven't released yet is something you'd rather keep to yourself, so this page says exactly what we keep, who else sees it, and how to make it go away.

ideas.so is run by IAMSULTAN LLC, a company licensed in the Sharjah Media City (Shams) Free Zone, United Arab Emirates. "We" and "us" on this page mean IAMSULTAN LLC. For anything on this page, write to [email protected].

What we keep about you

Your account. Your name, first and last name, email address, and your password as a one-way hash (we can't read it). Your profile picture, if you upload one. If you sign in with Google, the tokens Google gives us to confirm it's you.

Your sign-ins. For each signed-in browser: when it signed in, its IP address and its browser and operating system, as the browser reports them. A sign-in lasts seven days from the last time you used it. You can see your sign-ins in Settings.

Your workspaces. Each workspace's name and address, who is in it and with what role, and the invitations sent from it, including the invited email addresses.

Your ideas. What you write or dictate, the questions we ask about it, your answers, and the one-line brief written from them. Everything research finds for the idea: the competitors, the market figures, the searches and the posts, with links to where each came from. Which ideas you open and when, so the sidebar can show the ones you opened last.

How you use ideas.so. To see where people get stuck, we record the steps each visitor reaches: the landing page shown, the sign-up page shown, an account created and its email confirmed, setup finished, an idea saved (and whether it's your first or second), research started and how each section ended, and a plan or credits opened at checkout or bought. Each step carries your account's id once you have one, and nothing else about you: never your name, your email or the words of an idea, an answer or a search. These steps go to our analytics provider, in the European Union, which is set not to keep your IP address.

Billing. Which plan a workspace is on and the credits it has used. Payments are taken by Stripe through Autumn, our billing provider. We send Autumn the workspace's name and the email address of whoever buys, and we never see your card number.

Connected apps. If you connect an app such as an AI assistant to ideas.so, the app's name and address and the access you gave it.

Error reports and logs. When something breaks, the error, the page or request it happened on, and the browser and IP address it happened from. We remove email addresses and the values in web addresses before a report leaves our servers, and we don't attach your account to it. Our server logs record which address was requested, the answer and how long it took. They don't record your IP address or email.

Rate limits. To stop one address from flooding the service, we count requests per IP address for 1 to 15 minutes, then the count is gone.

Where your idea goes when it's researched

Research is done by an AI model reading the web for you. To do that, parts of your idea leave our servers:

  • The AI model reads your idea, your answers and the pages research finds. We reach the model through OpenRouter, which passes the request to Google's Gemini models. We don't attach your name, email or account to these requests.
  • Web search (Serper) gets the searches the model writes for your idea. A search uses words from your idea, for example "invoicing that chases late payers".
  • Search volumes (DataForSEO) get a short list of search phrases about your idea's product category, to ask Google Ads how often people search for them.
  • Page reading (Firecrawl) gets the web addresses of public pages research wants to read, such as a competitor's pricing page. It doesn't get your idea.
  • Company details (Hydrant API) get a competitor's web address, to look up when the company was founded and how big it is. They don't get your idea.
  • Our job runner (Temporal Cloud) keeps each research step while it runs, including the searches and the parts of your idea the model works from, and deletes them 7 days after the research finishes.

We don't use your ideas to train AI models. OpenRouter and Google handle what we send them under their own terms: OpenRouter's privacy policy and Google's Gemini API terms.

What's shared between workspaces, and what isn't

Your ideas, answers and findings are visible only to the members of the workspace they're in.

Two things research keeps are shared across every workspace. Both are about public information, and neither is linked to you or your workspace:

  • What a competitor is. When research reads a tool's website, we keep what the site says about the tool, its prices, its reviews, its company details and its icon. The next idea that meets the same tool reads it from there instead of fetching it again. Which workspace looked at which tool is kept only with that workspace's idea.
  • A cache of searches and pages. We keep each search and each fetched public page for 30 days, so the same search isn't paid for twice. A search's words can come from an idea, as above. The cache isn't shown to anyone and isn't linked to an account, a workspace or an idea, and an entry is deleted after 30 days.

Who processes data for us

We use providers to host, run and bill for the service: for the database, our servers, web traffic and file storage, running research, the AI model, web search, reading public pages, search volumes, company details, billing and payments, email, error reports and analytics. Each gets only what its part of the service needs, as this page describes.

Some of these providers process data in the United States. Where the law requires it, we rely on their standard contractual clauses or an equivalent safeguard.

We don't sell your data, we don't show ads, and we don't share your data with anyone outside these providers unless the law makes us.

Why we use it

  • To run the service you signed up for: your account, your ideas, research, billing and the emails it sends (sign-up, password reset, invitations). Under the GDPR, this is the performance of our contract with you.
  • To keep it secure and working: sign-in records, rate limits and error reports. This is our legitimate interest in a service that works and isn't abused.
  • To make it better: the steps you reach, so we can see where people get stuck. This is our legitimate interest in improving the service.
  • To meet the law: billing records we're required to keep.

We send you email only about your account and your workspaces. No newsletters unless you ask for one.

Cookies and browser storage

ideas.so sets four cookies, all on its own domains:

  • The sign-in cookie keeps you signed in for seven days.
  • onboarding-completed remembers that you've finished setting up, so you aren't sent back to it.
  • sidebar_state remembers whether you left the sidebar open.
  • The analytics cookie gives your browser a random id, so the steps one visitor reaches, from the landing page on, are counted as one person's. It lasts a year.

Your light or dark theme is kept in your browser's local storage. There are no advertising cookies.

Dictation. When you dictate an idea, your browser's own speech recognition turns your voice into text. In Chrome, for example, the audio goes to Google. That is your browser's processing, not ours, and ideas.so receives only the text.

How long we keep it

  • Your account: until you delete it.
  • Your ideas and their research: until you delete the idea, its workspace or your account.
  • Sign-ins: seven days after you last used them.
  • The shared cache of searches and pages: 30 days.
  • Research steps in our job runner: 7 days after the research finishes.
  • Database backups: 2 days. Server backups: 7 days.
  • Error reports: up to 90 days.
  • Which ideas you opened: until you delete the idea or your account.
  • Analytics steps: up to a year.
  • Billing records: as long as tax and accounting law requires.

Deleting your data

  • Delete an idea, and its questions, answers and research go with it.
  • Delete a workspace, and every idea in it goes with it. Only an owner can.
  • Delete your account in Settings, and we delete your profile, picture, sign-ins and connected apps. Your ideas are deleted too, except ideas in a workspace that still has other members: those stay with the workspace, no longer linked to you, because your teammates are working on them. A workspace you were alone in is deleted with everything in it. You can't delete your account while you're the only owner of a workspace other people are still in: make someone else an owner, or delete the workspace, first. The analytics steps you reached stay, under an id that no longer leads to anyone.

After a deletion, the data leaves our backups within 7 days and our job runner within 7 days. Billing records we're required to keep stay with our billing provider.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to stop using it for a purpose, or to send it to you in a form another service can read. Most of this you can do yourself in Settings. For the rest, write to [email protected] from your account's email address and we'll answer within 30 days.

If you think we've handled your data wrongly, tell us first and we'll try to put it right. You can also complain to the UAE Data Office, or, if you're in the European Union or the United Kingdom, to your data protection authority.

Who ideas.so is for

ideas.so is for people aged 18 and over. We don't knowingly keep data about anyone younger, and we'll delete it if we learn we have.

Keeping it safe

Everything travels encrypted. Passwords are stored as one-way hashes. Each part of the service holds only the keys it needs, and the database login the service uses can read and write data but can't change its structure.

Changes to this policy

When we change this policy, we'll update the date at the top. If a change affects what we do with your data, we'll email you before it takes effect.

Contact

IAMSULTAN LLC Sharjah Media City (Shams) Free Zone, Sharjah, United Arab Emirates [email protected]