Privacy policy

1. Who is the controller C01

The controller of your personal data is , a sole trader established in Italy (the "Provider", "we"), which provides Codelux AI.

• Address: IT
• VAT number:
• Contact for privacy questions and requests:

This policy applies to the use of Codelux AI: the website, the apps, the console and the programs we provide. It follows Regulation (EU) 2016/679 (GDPR) and the Italian Personal Data Protection Code (Legislative Decree 196/2003).

2. When your organisation is the controller C02

1. When a business or other organisation uses Codelux AI for its own people or customers, the data it enters about other people (its employees, customers, contacts, visitors) is processed by us on its behalf. For that data the organisation is the controller and we are the processor, under the data processing agreement. Questions about that data should go first to the organisation.
2. For your account data, the sign-in security, billing and the use of the Service itself, we are the controller, as described in this policy.

3. Data we collect C03

• Account: name, email address, password (kept only as a hash), sign-in methods you link, language and theme, security settings, trusted devices.
• Organisation: name, members and their roles, plan and settings; invitations sent by email.
• Billing: billing name and address, tax identifiers, invoices, payments and their status. Card data is handled by Stripe; we receive only a reference, the brand and the last digits of the card.
• Usage and technical data: sign-in and security events, IP address, browser and device information, logs of requests and errors, usage figures needed for plans and credit.
• Support: the messages you send us and what is needed to answer them.
• Consent events: every consent given or withdrawn and every document accepted, with the document and version, date and time (UTC), IP address and where it happened (sign-up, banner, settings, invitation).
• Content you enter: the data you put in the Service. For the personal data of other people in it, see art. 2.

We receive these data from you, from your organisation, from the sign-in provider you choose and from your use of the Service. Providing the data needed for the account and the contract is necessary to use the Service; the rest is optional.

4. Data kept on your computer and the project list CX01

1. Stays local. The program keeps on your computer your memories, notes, event timeline, tasks and file locks (the timeline records who did what and when, including the name of the person or AI agent that did it). We do not receive this data. The plugin and the hooks talk only to the program on your own computer.
2. AI agents. The AI agent you use with Codelux AI and its provider process what is in the agent's context under your own account and terms; they are not our processors and Codelux AI sends them nothing.
3. Project list. Your account keeps on our servers the list of your projects: the name you chose, the local folder path (a path that may contain your operating-system user name, never the files), an internal identifier and whether it is enabled. It is sent when you add, rename, move or remove a project, so that your plan applies to it and the same list is in the program and in the console.
4. Licence check. A periodic heartbeat with a one-way hash of the device and of the program, to enforce the licence on your devices. Retention of the heartbeat logs: see art. 9. [TO BE CONFIRMED: retention of licence heartbeat logs, today 30 days]

5. Team data and connected tools CX02

1. Encrypted team data. On Team projects, shared memories, notes, timeline events and the other team data are sealed on the author's machine with the team key and reach our servers only as encrypted events, with the metadata needed to deliver them (team, project, author, time, size, key version). We cannot read them. The key is never sent to us. File-lock and presence information is processed in clear (a path relative to the project, never file contents) and is not kept beyond the session.
2. Manager. Tasks, standup reports and exports are produced and kept by the program on the users' machines and travel between teammates only as encrypted events. The owner or the organisation is the controller of these data about its members (art. 2).
3. Connected tools. If an administrator connects tools such as Slack or a work tracker, the connection runs from the administrator's own program, with a token stored encrypted on that machine and never sent to us. These services are chosen by the customer and are its own providers, not our sub-processors.
4. Single sign-on and provisioning. If the organisation sets up single sign-on (OpenID Connect or SAML) or SCIM provisioning, we process the identity data its provider sends, on behalf of the organisation.

6. Purposes and legal bases C04

We do not take decisions about you based solely on automated processing that produce legal effects on you, and we do not sell your personal data.

7. Recipients and sub-processors C05

1. Sub-processors. We use providers who process personal data for us (payments, network and storage, hosting, email delivery and, in some products, AI). The up-to-date list, with purpose, data, location and safeguards, is published at /legal/subprocessors. We choose them with care and bind them by contract.
2. Your organisation. If you use Codelux AI through an organisation, its owner and administrators can see your account data and activity in the organisation as the Service allows.
3. Sign-in providers you choose. If you sign in with an external provider or your organisation's single sign-on, that provider and we exchange only what the sign-in needs; for your account with it, the provider is an independent controller.
4. Authorities and advisers. We may disclose data when the law or an authority requires it, and to professional advisers bound by confidentiality, to the extent needed to defend our rights.
5. Business transfers. If the business is transferred, the data may pass to the new owner, who will be bound by this policy.

8. Transfers outside the European Economic Area C06

Some of our providers are located outside the European Economic Area (EEA), in particular in the United States. When personal data is transferred there we rely on one of these safeguards, as stated for each provider in the sub-processors list:

• an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified companies;
• the Standard Contractual Clauses approved by the European Commission, with additional measures where needed.

You can ask us for a copy of the safeguards at .

9. How long we keep data C07

Data needed to establish, exercise or defend a legal claim may be kept for as long as the claim can be made.

10. Your rights C08

Under articles 15 to 22 of the GDPR you have the right to:

• access your data and receive a copy (art. 15);
• have inaccurate data corrected and incomplete data completed (art. 16);
• have your data erased (art. 17), where the law allows;
• restrict the processing (art. 18);
• receive your data in a structured, commonly used, machine-readable format and transmit it to another controller (art. 20);
• object to processing based on legitimate interest, and at any time to marketing (art. 21);
• not be subject to a decision based solely on automated processing (art. 22).

You can use many of these rights yourself in your account ("Your data": export and deletion; Settings › Privacy and consents). For anything else write to ; we answer within one month. We may ask you to prove your identity.

You have the right to lodge a complaint with the supervisory authority: in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it), or the authority of the country where you live or work.

11. Consents and withdrawal C09

1. Where the processing is based on your consent (offers, gifts and promotions, newsletter and marketing, optional cookies, use of AI providers where the product asks for it), each consent is separate and optional.
2. You can withdraw any consent at any time in Settings › Privacy and consents, or from the link in the message. Withdrawal does not affect the lawfulness of the processing done before it.
3. Every consent, withdrawal and acceptance is recorded as an event that is added and never overwritten. With "Download my consents" in the same page you can get your history as a JSON or CSV file.

12. Cookies and similar technologies C10

We use cookies and similar technologies (such as the local storage of the browser) as described in the cookie policy, which lists them one by one. Those that are not strictly necessary are used only with your consent, which you can change at any time with "Manage cookies" in the footer of the pages and in Settings.

13. Minors C11

Codelux AI is not meant for people under 16. To create an account you must confirm that you are at least 16. If we learn that we hold data of a younger person without the consent required by law, we delete it. If you think this has happened, write to .

14. Security C12

We protect personal data with technical and organisational measures suited to the risk, including: encrypted connections; passwords kept only as hashes; sensitive values encrypted at rest; access limited to people who need it and recorded; separation of data between organisations; regular backups; and monitoring of the systems. No system is completely secure: if a breach puts your rights at risk we tell you and the authority as the law requires.

15. Changes to this policy C13

When we change this policy we publish a new version. We tell you by email with a summary of the clauses that changed and the date on which the new version takes effect, and at your next access after that date the Service shows you the changes and asks you to confirm that you have read them. Every version stays available with its date. The clauses have stable identifiers so that you can see exactly what changed.