Privacy Policy
Version 1 · last updated September 19, 2026
On this page
Privacy Policy
This policy explains what personal data ideamaker collects when you use https://ideamakerbusiness.bob-the-worker.com, why, on what legal basis, how long we keep it, and how you can exercise your rights.
1. Who is responsible for your data
- Controller: ideamaker
- Registered office: 15 rue du test 33600 Pessac
- Contact for any privacy request: contact@bob-the-worker.com
- Data protection contact: contact@bob-the-worker.com
2. What we collect, why, and on what basis
| Purpose | Data | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|---|
| Create and operate your account | Email, password hash (Argon2id – never the password itself), display name, time zone, language, Google account identifier if you sign in with Google | Performance of the contract, Art. 6(1)(b) | For the life of the account |
| Deliver the paid subscription | Subscription status and period, payment events (amount, currency, subscription identifier). Card data is never transmitted to us – it stays with our payment provider | Performance of the contract, Art. 6(1)(b); accounting obligations, Art. 6(1)(c) | Account life; accounting records as required by French law |
| Product features you use: assistant chat, forum, mailbox | The messages, topics, replies and emails you write or receive in the app | Performance of the contract, Art. 6(1)(b) | Until you delete them or delete your account |
| AI features (summaries, labelling, replies) | The content of the messages processed by the model, plus a capped log of the prompts and answers | Performance of the contract, Art. 6(1)(b) | Call logs are purged automatically on the schedule set by the operator |
| Audience measurement (analytics) | Page views, clicks on tagged elements, time on page, device type, browser, operating system, country, referrer and campaign parameters, a session identifier and a visitor identifier | Your consent, Art. 6(1)(a) | 30 days |
| Session replay | A recording of the pages you view in the app, replayed as a reconstruction of the screen. All form inputs are masked, and passwords are never captured | Your consent, Art. 6(1)(a) – separate from analytics consent | 30 days, then the recording is deleted |
| Security and audit trail | The action performed, its time, the IP address and the browser user agent | Legitimate interest in securing the service, Art. 6(1)(f) | Purged on the schedule declared in this policy |
| Proof of acceptance of this policy and of the terms | Your account identifier, the document, the exact version accepted, a hash of the text you were shown, the language, and the date | Legal obligation to demonstrate consent, Art. 7(1) | 3 years after the account is closed |
We do not sell your data. We do not use it for advertising, and we do not run advertising or marketing trackers.
3. Cookies and local storage
Cookies, the consent mechanism and the exact list of what is stored in your browser are described in the Cookie Policy. Nothing that is not strictly necessary is written to your browser before you consent.
4. Who else processes your data
| Recipient | What it receives | Why |
|---|---|---|
| LemonSqueezy | Your email address and account identifier, at checkout and for subscription management | Payment and subscription processing |
| Google (only if you sign in with Google) | The sign-in exchange itself; we receive your Google profile email in return | Authentication |
| Our mail server (Amazon or a mail host chosen by the operator) | Outgoing and incoming email in the app mailbox | Sending and receiving email |
| The language model (Ollama, self-hosted by default) | The content submitted to AI features | Generating summaries, labels and replies. The operator can point the app at an external model provider; if that is done, this table is updated and the change is published as a new version of this policy |
| Our hosting provider Amazon | Hosting of the servers and of the database | Running the service |
The session replay engine (rrweb) runs inside the application and sends nothing to a third party – recordings are stored on our own infrastructure.
5. Transfers outside the European Union
Where a recipient listed above is established outside the European Economic Area, the transfer relies on the European Commission’s Standard Contractual Clauses or on an adequacy decision. You can ask us for a copy of the mechanism used at contact@bob-the-worker.com.
6. Your rights
Under the GDPR you may ask us to:
- access the data we hold about you, and obtain a copy of it;
- correct data that is inaccurate or incomplete;
- erase your account and your data (subject to the retention obligations stated above);
- restrict or object to a processing based on our legitimate interest;
- receive your data in a machine-readable format (portability);
- withdraw your consent to analytics or to session replay at any time – withdrawal is as easy as consenting, and does not affect what was lawfully done before it.
Write to contact@bob-the-worker.com. We answer within one month. You can also complain to the CNIL (www.cnil.fr), the French supervisory authority.
7. Security
Passwords are stored hashed with Argon2id. Access to the application requires a signed token. Secrets held by the operator are stored encrypted. Session recordings are kept on a private volume, never in a public location.
8. Children
The service is not intended for children under 15. If you believe a child has created an account, write to contact@bob-the-worker.com and we will remove it.
9. Changes to this policy
Every change is published as a new version of this document. The previous versions are kept so that we can always show which text you were given. When a new version is published you are asked to acknowledge it before continuing to use the app.
10. Contact
- ideamaker
- 15 rue du test 33600 Pessac
- contact@bob-the-worker.com
- 0666666666