Privacy policy
What the platform keeps about your account and how you use it, who else receives it, and how to have it erased. Each product’s own policy covers what you put into that product.
The short version
- Iridiom is the platform behind Brandstillery, Diagramma, Evalie, Hype Machine and Solon. It keeps your email and password once, for all of them; you’re set up in a product only when you sign in there.
- This policy covers that account and the platform. Each product’s own policy covers what you put into it.
- We don’t sell data or show ads.
- To have your account erased, email webmaster@iridiom.com.
Who we are
Iridiom is run by Probalia Ventures LLC, 240 Harriman Road, Irvington, NY 10533, USA (“we”, “us”). We decide how your account data is used, which makes us its controller. Email us at webmaster@iridiom.com.
This policy covers www.iridiom.com, app.iridiom.com, and the account you sign in with on any product that runs on Iridiom.
The products on Iridiom
Each product runs on Iridiom and uses the same sign-in. Its own privacy policy says what it collects from what you do in it, who receives that, and how long it’s kept:
- Brandstillery, run by Spotstillery LLC
- Diagramma, run by Probalia Ventures LLC
- Evalie, run by Probalia Ventures LLC
- Hype Machine, run by Probalia Ventures LLC
- Solon, run by Probalia Ventures LLC
For Brandstillery, we run the platform for Spotstillery LLC and handle what you put into Brandstillery on its behalf.
What we collect about you
Everything below comes from you, or from Stripe and your sign-in provider. We don’t buy data about you.
Your account
| Data | What it is, and why we have it | How long we keep it |
|---|---|---|
| Account details | Your name, email address and password, which we store only as a one-way hash. If you sign in with Google or Microsoft instead, the name, email address and profile picture they share with us. Also the workspace each product gives you, and who belongs to it. Used to sign you in and run your account. | Until you ask us to delete your account. |
| Sign-in and security records | Each sign-in, failed attempt and password-reset request, with the email address used, the IP address and browser details. Used to keep accounts secure and to limit repeated attempts. | 90 days, then deleted by a weekly clean-up. A count of failed attempts is kept on your account until you next sign in or change your password, and the time of the last failed attempt until your account is deleted. Counters that limit repeated attempts last at most an hour. |
| Purchases | What you bought, when, and how much you paid, plus the customer record Stripe keeps for each product you buy from: your email address and our internal account IDs. You type your card and billing details into Stripe’s own form, and they never reach us. Used to take payment, give you what you bought, and keep accounting records. | Kept as accounting records. We don’t delete them on request while tax or accounting law requires us to keep them. |
| What you agreed to | Which version of the terms of service and privacy policy you accepted, and when: when you sign up, when we ask you to accept a new version, and when you pay. Used to show what you agreed to. | As long as you have an account, and afterwards for as long as we may need to show what you agreed to. |
| Product news, if you ask for it | Only if you tick the box when you sign up or buy, or turn on Product news in Settings, for each product separately: your email address, the words you agreed to and when, and each time you unsubscribe. Used to send you occasional emails about that product: new features and offers. | Until you unsubscribe. After that, the record of what you agreed to and when you unsubscribed, for as long as we may need to show it. |
Records of use
| Data | What it is, and why we have it | How long we keep it |
|---|---|---|
| Records of use | A record of each request a product makes to our platform (your account, what was asked for and how long it took), and for each AI request, your email address, the model used, its size and its cost, never what was asked or answered. Used to run the service, control costs and investigate faults. | Kept as business records. If you ask us to delete your account, we remove your details from them. |
| Screening of AI requests | Requests to the AI and its answers are screened automatically for attempts to misuse it. When something is flagged, we keep which check matched and where in the text it was, never the text itself. Used to stop abuse. | 90 days, then deleted by the weekly clean-up. |
| Logs and error reports | Technical records of requests and errors. Some errors go to Sentry, our error-monitoring service. On app.iridiom.com’s own pages (sign-in, checkout and the frame around the app), Sentry may also record a small share of visits as a replay of clicks and page changes, with all text and anything typed hidden. It doesn’t record inside a product’s app. | Deleted by a weekly clean-up once they’re old enough: app logs after 7 days, error records after 90 days, audit records after 1 year. Error records we flag for an investigation are kept until we unflag them. What Vercel and Sentry keep follows their own retention. |
| Emails to us | Anything you send to webmaster@iridiom.com. Used to answer you and handle your requests. | As long as we need it to answer you or to show we handled your request. |
To have an account, you need to give us your name, email address and a password, or sign in with Google or Microsoft. To buy something, you give your payment details to Stripe. Without these we can’t provide Iridiom. Everything else is up to you.
What we use it for
- Running the service. Signing you in, taking payment, counting what your purchases have used, stopping abuse and fixing faults.
- Answering you. Support and privacy requests.
We don’t sell personal data, share it with advertisers, or show ads. We don’t use your data to train AI models.
Iridiom makes no decision about anyone that has legal or similarly significant effects.
Legal bases (UK and EU GDPR)
- Contract: running your account, and taking payment.
- Legitimate interests: security and preventing abuse; logs, error monitoring and page analytics.
- Consent: product news emails, only if you ask for them. You can withdraw it at any time, with the unsubscribe link in any of them or in Settings.
- Legal obligation: keeping purchase records, and answering rights requests.
Who else receives it
These providers process data for us, to run Iridiom. Each gets what its job needs.
| Who | What they do | What reaches them |
|---|---|---|
| Supabase | Database | Accounts, what you put into each product, purchase records and logs. |
| Cloudflare | Runs each product’s app, and stores files | Every request the app handles, including your name and email address, and what you put in. Stores the files you upload and the files the app makes. |
| Vercel | Hosting for www.iridiom.com and app.iridiom.com, and page analytics on both | Standard request data (IP address, browser, the page asked for) for both sites; everything a product’s app sends through our platform, including what goes to an AI provider and the requests we make for it to outside services; page views on both sites, with the links into the app clicked on www.iridiom.com; and load times on app.iridiom.com’s own pages. |
| Stripe | Payments | Your email address, our internal account IDs, what you’re buying and the amount, plus the card and billing details you type into Stripe’s form. |
| Resend | Account emails, such as welcome and password reset, and product news if you ask for it | Your name, email address and the email’s content, and whether you’ve asked for product news. |
| Sentry | Error monitoring | Error details and browser information. From a small share of visits to app.iridiom.com’s own pages, a replay of clicks and page changes with all text and form fields hidden. |
| Upstash | Limits on repeated requests, and short-lived caching | Your email address or IP address, as a counter that lasts at most an hour, and short-lived copies of some account settings. |
| Google or Microsoft | Sign-in, only if you choose it | Your sign-in with them. They send us your name, email address and profile picture. |
| Google (Fonts) | Serves typefaces on app.iridiom.com | Your IP address and browser details, when a page loads its fonts. |
| MailChannels | Receives email sent to webmaster@iridiom.com | The emails you send us. |
A product that uses AI also sends what you put into it to an AI provider. Its own policy names the provider.
We’ll also disclose data when the law requires it, to protect our rights or someone’s safety, or to a buyer if the business is sold. In a sale, this policy keeps applying until you’re told otherwise.
How long we keep it
The tables under What we collect about you give the period for each kind of data. In short:
- Logs are deleted by a weekly clean-up, at its first run after they reach their age:
- App logs: 7 days.
- Sign-in and security records: 90 days.
- Error records: 90 days (any we flag for an investigation are kept until we unflag them).
- Audit records: 1 year.
- Purchase records are kept for accounting.
- Backups. Our database provider keeps backups so data can be recovered after a fault. Data you’ve asked us to erase can remain in those backups until they expire.
Cookies and browser storage
www.iridiom.com sets no cookies. It counts visits with Vercel Web Analytics, without cookies: Vercel records the page, where you came from, your country, device and browser, and which links into the app you click. We don’t send it anything about who you are.
The app at app.iridiom.com uses the cookies and storage below. None of them is for advertising.
| Name | What it’s for | How long |
|---|---|---|
__Secure-Cookie | Keeps you signed in. | 24 hours. |
next- __Secure-Cookies | Protect the sign-in form, and return you to the page you were on. | Until you close the browser. |
__Secure- __Secure-Cookies | Complete a sign-in with Google or Microsoft safely. | 15 minutes. |
tenant-Cookie | Knows which product you’re signing in to. | 1 hour. |
marketing-Cookie | Carries your choice about product news through a sign-up with Google or Microsoft. | 15 minutes, or until the sign-up finishes. |
iridiom-Cookie | Remembers whether you chose light or dark. | 1 year. |
theme activeWorkspaceIdLocal storage | Your light or dark choice, and the workspace you last used. | Until you clear it. |
iridiom:Session storage | Which error notices you’ve already seen. | Until you close the tab. |
| Stripe’s own cookiesAt checkout | Set by Stripe to process payment and prevent fraud. | See Stripe’s privacy policy. |
app.iridiom.com also runs Vercel Web Analytics and Speed Insights, which count page views and measure how fast pages load, and Sentry, described under Records of use. Its pages load fonts from Google Fonts, so Google receives your IP address and browser details.
The same cookies are used on every product’s app address, each on its own address. Signing in on one doesn’t sign you in on another.
Deleting your data
- Everything else. To erase a project’s data, or your whole account, email webmaster@iridiom.com from the address on your account. If you also use another product that runs on Iridiom, say whether to erase your sign-in as well, which ends it for every product, or only what’s in Iridiom. We’ll confirm when it’s done.
Your rights
Depending on where you live, you can ask us to:
- tell you what data we hold about you, and give you a copy;
- correct it;
- erase it;
- limit how we use it;
- give it to you in a machine-readable form to take elsewhere; or
- stop using it where we rely on legitimate interests.
Email webmaster@iridiom.com. It’s free. We may ask you to confirm who you are first. We answer within one month. If a request is complex, we may take up to two more months, and we’ll tell you why.
If you’re in the UK or EU and not happy with our answer, you can complain to your data protection authority: the ICO in the UK, or the authority where you live in the EU.
US state privacy rights
If you live in a US state with a consumer privacy law, such as California:
- What we collect: identifiers (name, email address, IP address), commercial information (purchases), internet activity (sign-in and usage records, logs), and the content you give us. The sources and purposes are described above.
- Who receives it: only the service providers listed above, for those purposes. We don’t sell personal information, or share it for cross-context behavioral advertising.
- Sensitive information: we collect your Iridiom sign-in (email address and password), which the law counts as sensitive, and use it only to sign you in and keep your account secure. We don’t use it to infer anything about you.
- Your rights: to know, correct and delete what we hold. Email webmaster@iridiom.com, yourself or through an authorized agent. We’ll confirm who you are, answer within the time given under Your rights and never later than the law allows, and won’t treat you differently for asking. If we turn a request down, you can appeal by replying to our answer.
Security
Every page and request uses HTTPS. Passwords are stored only as one-way hashes. Card details never reach us.
No system is perfectly secure. If a breach affects your data, we’ll tell you and the relevant authorities as the law requires.
Where data is processed
We’re based in the United States, and our providers process data in the United States and in other countries where they operate. If you’re in the UK or EU, your data is transferred to the United States.
Children
Iridiom is for people 18 and over. We don’t knowingly collect data from anyone younger. If you think a child has given us data, email webmaster@iridiom.com and we’ll delete it.
Changes to this policy
If we change what we collect, who receives it or how long we keep it, we’ll update this page and the date at the top, and the next time you use Iridiom we’ll ask you to accept the new version.
Contact
Probalia Ventures LLC, trading as Iridiom
240 Harriman Road, Irvington, NY 10533, USA
webmaster@iridiom.com
See also the terms of service.