A business like IdeaNation should manage their legal risks by doing the following:

Create $$Terms of Service$$ agreements that require customers to give up all rights to privacy and data security.

Realize that it is impossible to manage customer privacy and data security so focus resources instead on defending legal action and reducing reputational harm.

Invest in data security and follow relevant laws that protect customer information and privacy.

Avoid any online presence and customer data collection since it is just too risky.

Ensure that all customer data is stored outside of places like Canada wherever there are no laws and rules about privacy and data security.