Privacy Policy

This policy describes the personal-data processing identifiable in the current IDEAVORA platform. IDEAVORA is the public-facing operator name. The operator is responsible as controller for its account, membership-access and referral processing. Paddle has its own responsibilities for processing transactions under its privacy notice.

This is a review version: the controller’s required legal identity, verified contact details, provider transfer arrangements and operational retention criteria need completion before commercial launch. The brand name alone does not complete mandatory controller-identification requirements.

Account and authentication data include your email address, account identifier, password information handled by the authentication service, confirmation status, account creation and last-sign-in timestamps, and account restriction status. The administrator interface can see account status and membership summaries; it does not display your password.

Membership and payment records include the linked account identifier, payment provider and transaction identifiers, payment amount, currency, payment date, verification/event information, access status and relevant refund or chargeback adjustments. IDEAVORA’s application tables do not provide fields for full card numbers or card security codes; payment entry is handled by Paddle checkout.

Referral information includes referral identifiers, referring account identifiers, a transaction association, commission calculation amounts and review/hold/reversal status. If you use a referral link, the valid referral identifier is stored for that browser tab and may be associated with a server-created checkout.

Private resources and member attachments are stored for delivery to authorised members. Access checks and signed links process account and file identifiers. No separate per-member download-history table was identified in the current application; hosting and delivery services may process technical request information.

If you contact a verified support channel, the information you choose to provide is needed to address your request. The support mailbox, handling arrangements and retention rules remain to be confirmed; do not send unnecessary sensitive data.

Account and membership information is used to register and authenticate users, manage access, verify purchases and provide the contracted service. Contract performance is the intended legal basis where the processing is necessary for those purposes.

Security, access control, payment-event verification and fraud/duplicate-referral prevention support legitimate interests in protecting users and the service, subject to the required assessment and your rights. Payment records may also be needed for applicable accounting or legal obligations; the operator’s specific obligations must be confirmed.

Referral attribution and commission review require a documented legal basis and, where legally required for non-essential storage or tracking, valid consent. This review does not claim that a referral-consent mechanism is already implemented. Marketing analytics, advertising or optional communications must not be described as consented merely because you use the platform.

Providing an email address and authentication information is necessary to create and use an account. Without payment verification, paid membership cannot be activated. A referral identifier is not required to purchase membership.

The authentication client persists session information in browser storage so a signed-in session can be maintained and refreshed. Signing out and clearing browser site data affect that session. Removing necessary storage may prevent account access.

A referral identifier is stored in session storage for the current tab. You can clear it by clearing the site’s browser storage; this does not erase a referral association already recorded with a transaction. Browser behaviour can affect how long a tab session is retained.

Paddle checkout loads Paddle’s script when checkout is initiated and may use its own cookies or storage under its policies. Hosting, authentication and file-delivery services may receive connection information such as IP addresses, browser/device information and request data. Provider logging details and retention require confirmation.

No dedicated advertising or audience-analytics integration was identified in the application code reviewed for this version. That is not a claim that hosting or checkout collects no technical information. Optional tracking and any required preference controls need a deployment-level review before launch.

Lovable Cloud supplies the application’s hosted account, database and private-file infrastructure. The site also loads its configured fonts from Google Fonts and its branded media from the configured asset delivery service; those external requests can disclose connection information to the relevant providers.

Paddle processes checkout, billing, tax, invoicing and payment-support activity under its own policies. IDEAVORA sends the account identifier with server-created checkouts and receives transaction and adjustment information used for verification and access management.

External community, tool, social and resource links lead to services with their own privacy practices. Opening an external service is separate from using IDEAVORA; review its policy before providing information.

Disclosure to authorities or professional advisers may be required for applicable legal obligations or claims. No routine adviser-sharing workflow is established by this review version. No affiliate interface for disclosing buyers’ email addresses was identified.

The integrated providers may process information in locations outside your country, including outside the European Economic Area. Actual hosting regions, subprocessors and applicable transfer safeguards have not yet been verified for this deployment.

Before launch, the operator must confirm the relevant provider agreements, any adequacy decisions or contractual safeguards, and how users can obtain information about them. This page does not assert that a particular transfer mechanism or EU-only hosting is already configured.

No fixed account, payment, referral, support, log or backup retention schedule has been confirmed. Retention must be limited to what is necessary for the relevant service purpose, applicable legal duties or legitimate claims; category-specific criteria require completion before launch.

The current administrator functions can deactivate sign-in or delete an authentication account. Deactivation does not delete payment records. Deleting the authentication account is not a verified all-data erasure procedure for payment and affiliate records or provider backups.

The platform currently has no verified self-service privacy export or complete erasure workflow. Statutory requests still need to be handled through a verified operator channel. Short-lived download-link expiry is an access measure, not a file-deletion schedule.

Application data access is controlled by account sessions, membership checks and database authorization rules. Administrator operations require administrator authorization. Member files use private storage and time-limited signed access links. Payment handling verifies provider events before accepting them.

These controls do not guarantee absolute security. This policy does not claim a verified encryption-at-rest configuration, security certification, specific breach-detection system or guaranteed backup-deletion procedure. Avoid sharing credentials or private access links.

Where applicable, GDPR gives you rights of access, rectification, erasure, restriction, portability and objection, subject to its conditions and exceptions. Where processing depends on consent, you may withdraw it without affecting the lawfulness of earlier processing.

You may complain to a competent data-protection authority. For an operator established in Austria, the Austrian Data Protection Authority is a relevant authority. You do not have to contact IDEAVORA first to exercise your right to complain.

A verified operator privacy-request contact has not yet been established for this review version. Do not send identity documents to an unverified address. A request-handling channel and proportionate identity verification must be established before launch. Paddle-related requests can be made through the contact routes in Paddle’s own privacy notice.

The current application uses payment and eligibility checks to determine access and referral status. No separate advertising-profiling system was identified. The significance of automated decisions and any applicable safeguards still require operational review.

The review date is shown on this page. Material processing changes require appropriate notice before implementation and renewed consent where legally necessary. A page update alone does not create consent for optional tracking or authorise incompatible new uses of your data.