idealexRavens / Privacy
Ravens Privacy Policy
This policy explains the personal data processed for Ravens access, accounts, AI requests, saved work, usage records and support.
Controller and scope
idealex operates Ravens and is the controller for personal data processed in connection with its hosted service, access requests and support. Ravens is an invite-only web application for applying saved AI prompts to text and images.
This policy covers the Ravens service and related idealex website and support processing. The contact details appear at the end of this policy.
Data we process
Access requests contain an email address, an optional note and a request timestamp. Accounts contain an email address, authentication records and preferences. Saved work includes prompt definitions and result schemas, submitted text or images, generated results, history and attachment metadata.
Operational data can include user or request identifiers, model, token counts, estimated cost, time, latency and status. A separate usage and cost ledger stores the user ID, an email snapshot, model, tokens, estimated cost and timestamp.
An email address is required to request access and receive sign-in links. Without it, we cannot provide those actions. Other submitted content is supplied by you for the task you choose.
Purposes and legal bases
We use access, account and submitted content to review access requests, authenticate users, run the requested AI task, save work and provide export or deletion controls. Necessary service processing and steps requested before access are based on Article 6(1)(b) GDPR.
Security, abuse prevention, service diagnostics, ordinary support and operational cost accounting rely on our legitimate interests in running and protecting the service under Article 6(1)(f). Where a specific legal obligation requires records to be retained, Article 6(1)(c) applies. Consent is used only where the relevant optional processing is expressly based on it.
AI processing
The selected prompt and submitted text or images are sent to the direct Anthropic API over an encrypted connection. The application does not add your account email, prompt names or saved history as separate provider fields. Personal information you put in a prompt, text or image is part of the submitted content.
Anthropic states that commercial/API inputs and outputs are not used for training by default, subject to its published terms and exceptions. Its standard API retention practice deletes inputs and outputs within 30 days, with exceptions including longer-lived features, contractual arrangements, usage-policy enforcement and legal obligations. These are provider practices, not a 30-day deletion period for saved Ravens work or its usage ledger.
Providers and transfers
The Ravens application and its data volume are hosted by Fly.io in Amsterdam. Anthropic processes AI requests, and Resend handles service email such as sign-in and access messages. Where error reporting or feedback is enabled, Sentry processes diagnostic context or feedback you submit.
An Amsterdam application volume does not mean all processing by these providers stays in the European Economic Area. International handling follows the applicable provider terms and transfer arrangements. Anthropic’s published data processing addendum includes standard contractual clauses where applicable. Contact idealex for information about safeguards relevant to your data.
Retention
Waiting-list requests are kept while administrators review them and manage access. They may be removed or promoted into an invitation. There is no automatic waiting-list expiry; you can request removal by email.
Account data and saved prompts, history and attachments remain until you delete them or the account, subject to the exceptions below. Operational diagnostics and support correspondence are retained as needed to investigate failures, protect the service, handle follow-up and resolve disputes.
The separate usage and cost ledger is retained for at least ten years under the current operational and accounting configuration. It survives account and history deletion and is excluded from the account JSON export. After the minimum period, administrators can remove eligible records separately; deletion is not automatic.
AI, hosting, email and diagnostic providers apply their own relevant retention practices and contractual terms. Deleting a Ravens account does not itself erase every provider record or copy you have exported.
Export and account deletion
Settings offers a JSON export of account data, saved prompts, history and attachment metadata. The export does not contain all original image bytes and excludes the separate usage and cost ledger.
Deleting the account removes the account and its active prompt, history and attachment records, outstanding sign-in tokens and stored attachment blobs. It does not delete the retained usage and cost ledger, exported copies or records retained separately by providers. Contact idealex about any remaining personal data or retention question.
Security
Saved history inputs and outputs and attachment blobs are protected by application-level encryption at rest. Email addresses, saved prompt definitions and preferences are outside that content-encryption layer. The application server can decrypt the protected content; this is not end-to-end or zero-knowledge encryption.
Operational logging is designed around identifiers, usage, latency and status rather than submitted content. Diagnostic and feedback features may process additional context where enabled.
Studio website and support
The separate idealex.nl site serves static pages without application cookies, browser storage, analytics, external fonts or collection forms. Cloudflare may process IP addresses and request metadata for delivery and security, under its practices and account settings.
Support email contains the sender’s address, message and attachments. We use this information to respond and retain it for handling, follow-up and applicable record-keeping. Send only information needed for your enquiry.
Your rights
Subject to applicable legal conditions, you may request access, correction, erasure, restriction or portability of your personal data. You may object to processing based on legitimate interests and withdraw consent where processing relies on consent. Some records may remain where retention is justified or required.
Use the contact below to make a request. We may need information to verify your identity and locate the records. You may also lodge a complaint with a supervisory authority, including the Dutch Autoriteit Persoonsgegevens. Waiting-list access requests are reviewed by administrators; Ravens generates AI output for the task you submit.
Changes to this policy
We will update this policy when relevant service processing changes. Provider practices may also change; the linked provider terms contain their current information.
Contact
For privacy questions, access-request removal or other data protection requests, contact idealex at: