Privacy Policy

Codalio Inc. is responsible for the Personal Data described in this Policy. Our Privacy Officer is accountable for our privacy practices: Ehsan Mirdamadi, Privacy Officer · Codalio Inc., Health Science Building, 935 Ramsey Lake Rd, Sudbury, Ontario P3E 2C6, Canada · info@codalio.com

A. Information you give us

• Account information: your name, email address, username, password and other contact details when you create an account.
• Payment information: when you buy a subscription, our payment processor (Stripe) collects your card details. We do not store your full card number.
• User Content: what you submit to the Services, such as product ideas, prompts, PRDs, specifications, code, configuration files and other project information.
• Communications: what you send us when you contact us, fill in a form, book a meeting or ask for support.

B. Information we collect automatically

• Log and usage data: IP address, browser type, operating system, pages visited, timestamps and error logs.
• Device information: device identifiers and operating system.
• Cookies and similar technologies: set only as described in section 9, and, apart from strictly necessary cookies, only with your consent.
• Session recordings: in the Codalio app only, and only with your consent, as described in section 10.
• Service data and telemetry: operational metrics such as feature usage, build events and API calls, used to run, bill for and improve the Services.

C. Information from third parties

• Integrations you connect, such as GitHub, Supabase or Google, as you authorize.
• Payment processors: transaction confirmations and billing details.
• Business-contact and visitor-identification providers: if you accept advertising cookies, our website visitor identification provider (Apollo.io) may tell us which company or organization is associated with your visit, and may provide publicly available business contact information.

We use Personal Data to provide and maintain the Services (operating the platform, storing your projects, processing payments, authenticating users); communicate with you (service announcements, security alerts, invoices, support); understand and improve the Services (analyzing usage, fixing bugs, developing features), using analytics and session recordings only where you have consented; keep the Services secure and prevent fraud; send marketing about our products and events, which you can opt out of at any time; and meet legal obligations.

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on: performance of a contract (to provide the Services under our Terms of Service); legitimate interests (security, fraud prevention and essential service operation); consent (analytics, session recording, advertising and functional cookies, and marketing where required), which you may withdraw at any time; and legal obligations.

We do not sell your Personal Data. We share it only with:

• Service providers (sub-processors) that process it on our behalf under contract, by category: cloud hosting and infrastructure (AWS and Google Cloud for the Free plan and Codalio Cloud; Studio and Enterprise are hosted in Canada or in the client's chosen region, see section 12); payments (Stripe); AI model providers, through their business APIs (Anthropic, OpenAI, Google Gemini, and DeepSeek only if you choose it; see sections 8 and 12); product analytics (Segment, PostHog); website analytics (Google Analytics); CRM and marketing (HubSpot, Apollo.io); advertising measurement (Reddit).
• Integrations you connect, whose use of your data is governed by their own policies.
• Legal requirements, when we believe in good faith that disclosure is necessary to comply with law or protect safety and rights.
• Business transfers, in connection with a merger, acquisition or sale of assets.

Under California law, sharing data with advertising partners for cross-context behavioral advertising can count as "sharing". We do this only if you accept advertising cookies, and you can withdraw that choice at any time (section 11).

We use industry-standard safeguards, including encryption in transit (TLS) and at rest, role-based access controls, multi-factor authentication and security monitoring and logging. Your code stays in your own Git repository; build environments are short-lived and destroyed after a few days. No system is completely secure, and you are responsible for keeping your account credentials confidential.

We keep Personal Data only as long as needed for the purposes in this Policy. When you close your account, we delete your Personal Data within 30 days, except where we must keep it for legal or billing reasons or fraud prevention; backups are deleted within 90 days. Session recordings are deleted after 30 days. Analytics data is kept for 14 months.

We do not use your User Content (your ideas, prompts, PRDs, specifications or code) to train AI models, whether ours or anyone else's. We send prompts to AI model providers through their business APIs: Anthropic, OpenAI and Google (Gemini), whose API terms do not permit training on that data, and, only if you choose it, DeepSeek, whose API is operated from China under DeepSeek's own terms. DeepSeek is always optional and is never used unless you select it. To run and improve the Services we use only aggregated usage metrics, such as how often a feature is used, that do not include the content of your projects. On Codalio Studio and Enterprise, clients choose their models and can run them locally in their own environment (section 12).

When you first visit, a banner asks for your choice. Only strictly necessary cookies are set before you choose; everything else stays off unless you accept it. You can change your choice at any time through the Cookie settings link in the website footer. If your browser sends a Global Privacy Control signal, we treat it as a refusal of analytics and advertising cookies.

If you reject optional cookies, the website keeps working with necessary cookies only.

If you accept analytics cookies, we record how you interact with the Codalio app (clicks, scrolling and page changes) using PostHog, to find bugs and improve usability. Everything you type into form fields is masked and never recorded. We do not record sessions on codalio.com. Recordings are kept for 30 days and are viewed only by Codalio staff working on the product. You can stop recording at any time by withdrawing analytics consent in Cookie settings.

Depending on where you live, you may have the right to access your Personal Data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent. To use these rights, contact our Privacy Officer at info@codalio.com. We respond within 30 days and will not treat you differently for using them.

• Canada: you may also complain to the Office of the Privacy Commissioner of Canada.
• Quebec: tracking technologies that can identify, locate or profile you are off unless you turn them on. You may also ask about automated decisions that affect you and complain to the Commission d'accès à l'information du Québec.
• California: you may know, access, correct and delete your data and opt out of "sharing" for cross-context behavioral advertising by rejecting advertising cookies or sending a Global Privacy Control signal. We do not sell Personal Data and do not use sensitive personal information beyond what the Services need.
• EEA, UK and Switzerland: you may also complain to your local data protection authority.

Codalio is a Canadian company. Where your data is processed depends on the product you use.

Free plan and Codalio Cloud. Because we serve customers in markets around the world, our self-serve products use cloud hosting and AI model providers located outside Canada. Your Personal Data may be processed in Canada and in the United States, where several of our service providers operate. If you choose to use DeepSeek, which is always optional, the prompts and project content you send to it are processed in China.

Codalio Studio and Enterprise. These are Canada-first: deployments are hosted and data is processed in Canada by default. Clients can instead choose the region where their deployment is hosted, choose which AI models it uses, and even run models locally in their own environment, so their data stays where they decide. These choices are set out in the client's order form.

When we transfer Personal Data from the EEA, the UK or Switzerland to the United States or China, we use Standard Contractual Clauses or another approved safeguard.

The Services are not meant for anyone under 18, and we do not knowingly collect their Personal Data. If we learn that we have, we will delete it.

The Services may link to or integrate with third-party services such as GitHub. Their privacy practices are their own; please read their policies.

We may update this Policy. We will post the new version here with a new "Last updated" date and, for material changes, notify you by email or in the app before they take effect.

Questions or requests: Ehsan Mirdamadi, Privacy Officer, Codalio Inc., Health Science Building, 935 Ramsey Lake Rd, Sudbury, Ontario P3E 2C6, Canada · info@codalio.com