GDPR Compliance

1. Data Protection Principles

We adhere to the core principles of GDPR Article 5 regarding your personal data:

• Lawfulness, fairness, and transparency: We process data only with a valid legal basis, such as contract performance or legitimate interest.
• Purpose limitation: We collect and process telemetry and prompt context strictly for code assistance and model inference, never for secondary advertising or model training.
• Data minimization: Client-side secret sanitization automatically redacts API keys, credentials, and tokens before any request leaves your workstation.
• Accuracy: We take every reasonable step to ensure account and billing data is accurate and up to date.
• Storage limitation: Checkpoints are stored locally within VS Code internal storage, and remote session vectors can be permanently expunged at any time.

2. Rights of Data Subjects & Right to Erasure

Under GDPR Articles 15–22, you hold comprehensive rights over your personal data:

• Right to be informed: You have the right to clear, transparent information about how your data and code snippets are handled.
• Right of access & portability: You can inspect or export your usage summaries, account profile, and credit balances.
• Right to rectification: You can update your account details at any time.
• Right to erasure ("Right to be Forgotten"): Under GDPR Article 17, you can permanently erase all account records, usage logs, and stored workspace memory embeddings. This is accessible via one-click in the Codor VS Code extension settings drawer ("Erase All Data") or via our dedicated REST endpoint (DELETE /v1/auth/me/data).
• Right to restrict processing: You can disable semantic search, git diff inclusion, and auto-indexing directly from extension preferences.

3. Zero Model Training Guarantee

We maintain a strict zero-retention, zero-training policy for proprietary source code. Your code snippets, diffs, terminal outputs, and file edits are strictly transmitted for inference and are never used to train or fine-tune public foundation models.

4. EU Data Hosting & Sub-Processors

Our core database, vector search infrastructure, and authentication services are hosted within the European Union (EU/EEA). Payment processing is executed by PCI-DSS compliant providers: Stripe Payments Europe, Ltd. (EU) and NOWPayments. Where external LLM inference providers are utilized, processing occurs under Standard Contractual Clauses (SCCs) with strict confidentiality agreements.

5. Data Protection Officer & Inquiries

If you have any questions about our GDPR compliance or wish to submit a formal Data Subject Request, please contact our Data Protection Officer at [email protected].