1. Who we are
IdeaTome is operated by Avnish Rai, an individual in India, who is the “Data Fiduciary” for your personal data under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the “controller” under laws such as the GDPR where they apply. You can reach us about anything in this policy at support@ideatome.com.
2. What we collect
We collect only what the Service needs to work:
- Account details — your name, email address and, if you sign in with a social account, the basic profile it shares (such as your name and profile picture).
- Your content — the ideas, instructions and themes you enter, and the books, chapters, covers, coloring pages and export files generated for you.
- Billing records — your plan, subscription status, billing dates and a customer reference from our payment provider. Card numbers are entered directly with the payment provider; we never receive or store them.
- Usage records — your credit balance and history, the books you have started, and the cost of the AI processing each one used.
- Feedback — anything you send us through the feedback form or by email.
- Technical data — request logs and error reports (for example the page requested, the time, and a browser user-agent) needed to run, secure and debug the Service.
We do not collect sensitive personal data such as health, biometric or financial account data, and we ask you not to include personal data about other people in your ideas.
3. How we use it, and our legal basis
- To provide the Service — creating your account, generating and storing your books, producing your downloads, and managing credits and plans. This is necessary to perform our contract with you, and it is the purpose you consent to by using the Service.
- To keep it safe — rate limits, fraud and abuse prevention, and investigating errors. This is our legitimate interest in running a secure service.
- To communicate with you — a welcome email, receipts, and messages about your account, security, or changes to our terms. We do not send marketing email without your consent, and every marketing email will let you unsubscribe.
- To meet legal obligations — tax, accounting and responding to lawful requests.
We do not sell your personal data, we do not use it for advertising, and we do not use your content to train AI models.
4. How your content reaches the AI
To write your book, your idea, instructions and the book-in-progress are sent to OpenAI through its API, and the text and images it returns are stored in your account. Under OpenAI’s API terms, data sent through the API is not used to train OpenAI’s models by default, and may be retained by OpenAI for a limited period for abuse monitoring. Only what is needed to generate your book is sent.
5. Who processes your data
We use carefully chosen service providers who process data on our behalf and only on our instructions:
| Provider | What for | Where |
|---|---|---|
| Google Cloud (Cloud Run, Firestore, Cloud Storage) | Hosting the Service; storing your account, books and files | India (Mumbai region) |
| Clerk | Sign-in, account security and session management | United States |
| OpenAI | Generating text, covers and coloring pages | United States |
| Our payment provider | Processing subscription payments and receipts | Varies by provider |
| Cloudflare | Domain name service, network security and email forwarding | Global network |
| Resend | Sending account emails such as your welcome message | United States |
| Sentry (when enabled) | Error reports, with personal data scrubbed before sending | United States |
6. Transfers outside India
Your books and account records are stored in India. Some of the providers above process data in other countries, principally the United States, to provide their part of the Service. We transfer data only to countries not restricted by the Government of India under the DPDP Act, and we rely on each provider’s contractual commitments to protect it.
7. How long we keep it
- Account and content — for as long as your account is open.
- After you delete your account — it is deactivated immediately and your books disappear from your library. We delete the remaining copies of your personal data and content within 30 days, except where the law requires us to keep something longer.
- Billing records — as long as tax and accounting law requires, generally up to eight years.
- Logs and error reports — about 30 days.
- Download links — each one expires about ten minutes after it is created.
8. How we protect it
- All traffic to and from the Service is encrypted (HTTPS, with HSTS).
- Files are kept in private storage that is never publicly readable; every download is a signed link that expires within minutes.
- The database is reachable only by our servers — never directly from a browser — and every request is checked against the signed-in account, so no one can open another person’s books.
- Secrets are held in a managed secret store, access is limited to what each component needs, and administrative actions are recorded in an audit log.
9. Your rights
Under the DPDP Act you have the right to:
- obtain a summary of the personal data we process about you and how;
- have inaccurate or incomplete data corrected, completed or updated;
- have your personal data erased when it is no longer needed;
- withdraw consent at any time (withdrawal does not affect earlier processing);
- nominate someone to exercise your rights if you die or become incapacitated;
- have your grievances redressed by us, and then by the Data Protection Board of India.
If you are in the European Economic Area or the United Kingdom you also have rights of access, rectification, erasure, restriction, portability and objection under the GDPR, and may complain to your local data-protection authority.
To exercise any right, email support@ideatome.com from the address on your account. We will verify it is you and respond within 30 days at the latest.
11. Children
The Service is for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has created an account, tell us at support@ideatome.com and we will delete it.
12. Changes to this policy
When we change this policy we update the date at the top of the page. If a change is material — a new purpose, or a new kind of data — we will tell you by email or in the application before it takes effect.
13. Grievance Officer and contact
For any question, request or complaint about your personal data:
Avnish Rai, Grievance Officer, IdeaTome
Email: support@ideatome.com
Website: ideatome.com
We acknowledge complaints within 24 hours and aim to resolve them within 15 days. See also our Terms of Service and contact page.