Bu belge hukuki inceleme altındaki bir taslaktır. Vurgulanan bölümler hâlâ tamamlanıyor.
Qodea Privacy Policy
Version: 0.1 (draft) · Last updated: publication date
The short version
- We use your data to provide the service: your account, your projects, the AI that builds them and the hosting that publishes them.
- What you write in the chat and in the steps is sent to AI providers: Anthropic (U.S.) and DeepSeek (China). The values of your environment variables and keys are never sent to the AI.
- We store data on Amazon Web Services servers in the U.S.
- We don't sell your data or show ads. We only use cookies needed to keep you signed in.
- The data of people who use the sites you publish is yours: we store it on your behalf.
- You can ask us to access, correct or delete your data at contacto@qualic.dev.
1. Who is responsible for your data
Qualic LLC, a Delaware limited liability company ("Qualic", "we", "us"), with its address at domicilio de Qualic LLC, provides the Qodea service at qodea.dev.
- Privacy contact: contacto@qualic.dev
- Data protection officer: DPO name and contact, if appointed
- EU representative (Art. 27 GDPR): name and address, or confirm not required
- UK representative (Art. 27 UK GDPR): name and address, or confirm not required
2. Two different roles
Qualic is the controller of the data of people who use Qodea to build projects: your account, what you write, your projects and how you use the service. This policy explains that processing.
Qualic is a processor of End Users' data: the people who sign up or enter data on the sites and apps you publish with Qodea. There, you are the controller (the project owner) and we process that data only to host and run your project, following your instructions and the Data Processing Agreement. See section 11.
3. What data we process
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Email and password. The password is handled by our authentication service (Amazon Cognito) and we don't see it. If you sign in with Google: your email, your name and whether Google verified the email. | You, or Google if you choose it |
| What you write and upload | Your idea, your answers to the 7 steps, chat messages, and the text, images and files you upload. | You |
| Your projects | Designs, plans, code and versions generated by the AI; project settings; subdomain and custom domain. | You and the AI |
| Environment variables | Names and values. Values are stored encrypted. | You |
| Usage and billing | AI credits used (which model, how many tokens and their cost; not the text), daily usage counters per account, metered usage of each project (visits, data transfer, compute, function calls, storage), your plan. | Generated by Qodea |
| Technical logs | Access logs of published sites (date and time, requested page, bytes sent, response code and domain) confirm whether the IP address is logged; the current configuration does not include it; build logs; your project's backend logs. | Generated by Qodea |
| Payments (once enabled) | Your card details are processed by Stripe, Inc. which billing data Qualic receives and stores | You, through Stripe |
| Communications | Emails we send you (for example, verification codes) and emails you send to support. | You and Qodea |
Please don't put other people's personal data, sensitive data or confidential information that your project doesn't need into the chat or the steps: that text is sent to AI providers (section 5).
4. Why we use your data and on what legal basis
| Purpose | Data | Legal basis (GDPR and similar laws) |
|---|---|---|
| Create and keep your account, sign you in | Account | Performance of the contract |
| Generate, change, build and publish your projects with AI | What you write and upload, your projects, variable names | Performance of the contract |
| Host your projects and let you download their code | Your projects, environment variables | Performance of the contract |
| Meter usage, apply each plan's limits and spending caps | Usage, technical logs | Performance of the contract |
| Charge you (once payments are enabled) | Payments, usage | Performance of the contract and legal obligations (tax and accounting) |
| Security, fraud and abuse prevention, daily limits | Account, usage, technical logs, content of reported projects | Legitimate interest in protecting the service, our customers and third parties |
| Service notices (changes, limits, security) | Account | Performance of the contract |
| Support | Communications and whatever data needs to be reviewed | Performance of the contract |
| Comply with the law and respond to authorities | What the law requires | Legal obligation |
Argentina (Law 25,326): we process your data with your consent, which you give when you sign up after reading this policy, and as needed to perform our contract with you.
We don't: advertise, sell data, build marketing profiles, or make automated decisions with legal or similarly significant effects on you. We don't send marketing emails today; if we start, we'll ask for your consent where the law requires it, and you'll be able to unsubscribe from every message.
5. Artificial intelligence
5.1. To build your project, we send our AI providers what you write (your idea, your answers, your chat requests) and the project context they need (for example, the plan, the existing code and the names of your environment variables).
- Anthropic (Claude), in the U.S.: designs and plans.
- DeepSeek, in China: writing code. see the DeepSeek decision points before publishing
- Later we may add Amazon Bedrock (AWS). We'll tell you in advance by updating this policy.
5.2. We never send the AI the values of your environment variables or your keys. Before any text goes to the AI, a filter hides secrets.
5.3. Qualic doesn't use your data to train AI models. What each provider does:
- Anthropic doesn't train models on data it receives through its API and, under its policy, deletes inputs and outputs within 30 days, except those flagged for safety or abuse.
- DeepSeek, under its privacy policy, stores data in China and may use it to improve its models. confirm whether Qualic requested the training opt-out and whether DeepSeek accepted it in writing; if not, decide whether to keep using DeepSeek before publishing
5.4. Qodea is an AI system: when you use the chat or the steps, you are interacting with an AI, and the content Qodea generates is produced by AI. Review it before you publish it.
6. Who we share your data with
We don't sell your data. We share it only with these providers, who process it on our behalf to provide the service (the current, more detailed list is in Subprocessors):
| Provider | What for | Where it processes the data |
|---|---|---|
| Amazon Web Services, Inc. | Infrastructure: accounts (Cognito), database (DynamoDB), files (S3), site delivery (CloudFront), compute (Lambda), builds, logs, key encryption, verification emails | U.S. (us-east-1 region). CloudFront delivers sites from servers in several countries. |
| Anthropic, PBC | AI for designs and plans | U.S. |
| DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) confirm the entity the API is contracted with | AI for writing code | China |
| Neon, LLC (Databricks group) confirm the contracting entity | Databases (Postgres) of generated projects | U.S. (us-east-1 region) |
| Stripe, Inc. | Payments (once enabled) | U.S. |
Google only receives or gives us data if you choose to sign in with Google. In that case Google is responsible for its own processing under its privacy policy.
We may also share data: with authorities when the law requires it; to defend our rights or people's safety; and with whoever acquires Qodea, if that happens, with the same level of protection.
7. International transfers
Qualic LLC is a U.S. company. Your data is stored and processed in the U.S. (AWS, Anthropic, Neon and Stripe) and in China (DeepSeek, only the text and code sent to write code). Our team works from Argentina and accesses from there the data it needs to run the service and support you. confirm from which countries the team has access
Argentina does not consider the U.S. or China to provide an adequate level of data protection. The European Union recognizes an adequate level in the U.S. only for companies certified under the EU-U.S. Data Privacy Framework, and does not recognize China. So:
- Argentina: by accepting this policy you give your express consent for your data to be processed in the U.S. and China, which do not have an adequate level of protection according to the AAIP. With our providers we apply the contractual safeguards in this section. When you transfer your End Users' data to us from Argentina, we use the AAIP model clauses provided for in the Data Processing Agreement.
- European Union, European Economic Area, United Kingdom and Switzerland: we use the European Commission's Standard Contractual Clauses (and the UK Addendum) or another valid safeguard, such as the provider's certification under the EU-U.S. Data Privacy Framework where it exists. confirm the safeguard signed with each provider, especially DeepSeek
- You can ask us for a copy of the safeguards at contacto@qualic.dev.
8. How long we keep data
| Data | Period |
|---|---|
| Account, projects, content and environment variables | While you have the account. When you close it, we delete them within period, e.g. 30 days. if there are backups, when they are deleted |
| Trial designs you didn't turn into a project | 30 days |
| Daily usage counters per account | 2 days |
| Build logs | 14 days |
| Access logs of published sites | period |
| Your project's backend logs | period; currently no expiry is configured |
| Metered usage and billing data | statutory accounting and tax period |
| Data sent to AI providers | Anthropic: up to 30 days (longer if flagged for safety). DeepSeek: period; its policy sets none for the API |
We may keep data longer if the law requires it or if it is needed for a claim or an abuse investigation.
9. Security
Among other measures: environment variable values and database connection strings are stored encrypted with keys managed in AWS that rotate automatically; sensitive values are not shown again after they are saved; text sent to the AI goes through a secrets filter; session cookies are secure and cannot be read from JavaScript; and generated code is built in an isolated environment with no access to other customers' data.
No system is 100% secure. If an incident affects your data, we'll notify you, and the authorities where the law requires it.
10. Your rights
You can ask us for:
- Access to your data and a copy of it.
- Rectification of inaccurate data.
- Erasure of your data.
- Objection to processing based on our legitimate interest.
- Restriction of processing.
- Portability: receiving your data in a commonly used format. You can already download your projects' code as a .zip.
- Withdrawal of consent where consent is the basis, without affecting earlier processing.
How to ask: write to contacto@qualic.dev from your account email. We may ask for information to confirm your identity. It's free.
Deadlines: we answer within the time limits set by the law of your country. In Argentina: 10 calendar days for access and 5 business days for rectification, update or erasure. In the EU and UK: 1 month, extendable for complex requests. In Brazil: up to 15 days. In Mexico: 20 days. In other countries, the period set by their law.
Complaints: if you're not satisfied with our answer, you can complain to the data protection authority of your country (see section 14).
11. Data of the users of the sites you publish
11.1. If your project has accounts or forms, your End Users' data is stored in your project's database (Neon, U.S.) and passes through AWS infrastructure. You are the controller: you decide what data is collected and why, and you must inform your users with your own privacy policy.
11.2. We process that data only to host and run your project. We don't use it for our own purposes, we don't sell it, and we don't send it to the AI unless you put it in the chat. confirm that no Qodea flow sends data from the project database or the backend logs to the AI
11.3. If you are an End User of a site made with Qodea and want to exercise your rights, contact the owner of that site. If you write to us, we'll pass your request on.
12. Cookies
Qodea uses only necessary cookies to keep you signed in. We don't use advertising or analytics cookies, so we don't ask for consent for them.
| Cookie | What for | Duration |
|---|---|---|
__Host-qd_id |
Keep you signed in | 1 hour |
__Host-qd_rt |
Renew your session without asking for your password again | 30 days |
__Host-qd_oauth |
Protect Google sign-in | 10 minutes |
They are all Qodea's own session cookies, secure (HTTPS only), HttpOnly (they can't be read from JavaScript) and not shared with other sites. If we add other cookies, we'll update this policy and, if they aren't necessary, ask for your consent first.
The sites you publish with Qodea may use their own cookies (for example, their users' sessions). Disclosing them is the site owner's responsibility.
13. Children
Qodea is only for people 18 and older. We don't knowingly collect data from minors. If you believe a minor has given us data, write to us and we'll delete it.
14. Information for your country
Argentina. You can access your data free of charge at intervals of no less than six months, unless you show a legitimate interest in doing so sooner (Art. 14(3), Law 25,326).
THE AGENCY FOR ACCESS TO PUBLIC INFORMATION (AAIP), as the supervisory authority under Law 25,326, has the power to handle complaints and claims from anyone whose rights are affected by a breach of the rules in force on personal data protection. (Required notice under AAIP Resolution 14/2018; the original Spanish text is in the Spanish version of this policy.)
confirm with counsel whether Qualic LLC must register the database with the AAIP's National Database Registry; if so, add: "Our database is registered under number …"
European Union, EEA and United Kingdom. If you are in the EU or the UK, we process your data on the legal bases in section 4. You have the rights in section 10 and can complain to the supervisory authority of the country where you live or work (in the UK, the ICO).
Brazil. You have the rights under Article 18 of the LGPD, including knowing who we share your data with, and you can complain to the ANPD.
Mexico. You can exercise your rights of access, rectification, cancellation and objection (ARCO) at contacto@qualic.dev. You can complain to the Secretariat for Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), the data protection authority. simplified privacy notice for Mexico
Chile, Colombia, Peru, Uruguay and other Latin American countries. You have the rights your local law gives you, which you can exercise as described in section 10, and you can complain to your local data protection authority.
United States. Qualic LLC is a U.S. company. We don't sell or share your personal data for advertising, and we don't use sensitive data to infer characteristics about you. If you live in a state whose privacy law gives you rights (for example, California), you can exercise them as described in section 10, and we won't discriminate against you for doing so.
15. Changes to this policy
If we change something important (for example, a new AI provider or a new destination country), we'll notify you by email and in Qodea before the change applies. The date at the top shows the last update.
16. Contact
- Privacy: contacto@qualic.dev
- Address: domicilio de Qualic LLC