Privacy Policy

1. Who we are

Codebase.run is operated by 1xTeam sp. z o.o. ("we", "us"):

This Policy covers our website and AI-assisted software-development service. We are the data controller for website, account, customer-relationship and security processing. For personal data in projects processed solely on a customer’s instructions, we act as processor or sub-processor. This Policy does not replace a required data processing agreement (DPA) or the customer’s privacy notice.

2. Data we process

Account and contact data: GitHub ID and login, GitHub App installation and access metadata, names, emails, optional phone numbers and correspondence. Where relevant, this includes billing details and transaction records.

Project data: connected repository content and metadata, issues, comments and pull-request discussions; task instructions, agent messages and events, tool results, logs, patches and screenshots; and project-environment images, snapshots and caches. These materials may contain personal data about contributors and others.

Technical and usage data: connection information, including IP addresses, browser and device information, website interactions, operational logs, task duration, costs and token usage.

Data comes from you, GitHub, project participants and service operation. Providing it is voluntary, but we need certain information to provide accounts, tasks and responses. Avoid unnecessary personal data, sensitive information and live production datasets in tasks and test environments.

3. Why we process data

For processing where we act as controller, our GDPR legal bases are:

• Contract — Article 6(1)(b): providing individual users’ accounts and services, and requested pre-contractual steps.
• Legitimate interests — Article 6(1)(f): business-customer administration, general enquiries, service operation and security, troubleshooting, resource measurement and legal claims.
• Legal obligations — Article 6(1)(c): complying with applicable accounting, tax and other legal requirements.
• Consent — Article 6(1)(a): optional website analytics.

We use contact details for enquiries and service communications, not marketing. We do not make solely automated decisions about individuals with legal or similarly significant effects.

4. AI processing and customer content

We use OpenAI through a centrally managed ChatGPT/Codex account. Task instructions, relevant repository content and tool outputs, potentially including personal data and screenshots, are sent to OpenAI.

Codebase.run does not use customer project content for model training, platform development or benchmarks. Task analysis serves only the relevant customer. Platform-development benchmarks use open-source projects.

5. Recipients and international transfers

Providers include Railway (application and database hosting), DigitalOcean (workers, images and snapshots), GitHub (authentication, repositories and results), OpenAI (AI processing), Google (Analytics and Search Console), and Telegram (technical notifications).

Authorized administrators may access project data and logs when necessary for operations, support or security. Task visibility follows GitHub repository permissions. Published results follow repository visibility, including public visibility for public repositories. Tasks may interact with external services configured for the project.

We do not sell personal data or share it for targeted advertising. Disclosures may also be necessary for legal obligations, valid legal requests or protecting legal rights.

Railway hosts our application and database in Amsterdam, the Netherlands. DigitalOcean stores environment images in Amsterdam; snapshots and workers are in Frankfurt, Germany. Other provider processing may occur outside the European Economic Area, including in the United States.

6. Cookies and website analytics

Essential cookies or similar storage support website functionality and remember preferences. With your consent, Google Analytics measures visits, scrolling and clicks leading to the app, using identifiers and browser/device information. Website analytics remains off until you allow it.

Analytics cookies and your consent choice are configured to expire after 180 days. You can refuse or withdraw consent through Cookie Preferences in the footer; withdrawing permission stops measurement and removes this website’s analytics cookies, but does not erase previously collected data or affect earlier lawful processing.

We do not enable advertising personalization or Google signals. Analytics page addresses exclude query strings and fragments, and form contents are not sent to analytics. Search Console provides website search-performance reports.

7. Retention, deletion and security

Account data is retained for the life of the account; project records and reusable environments for the relevant project service; and enquiries until resolution and necessary follow-up. Longer retention is limited to legal obligations, unresolved security incidents or claims, and ends when that need expires.

Droplet-local logs are kept for up to seven days, subject to size limits. Other logs and task histories do not share this automatic expiry. Images, snapshots and caches can outlive workers and follow project retention.

Request deletion at hello@codebase.run; requests are handled manually. Disconnecting a repository or uninstalling the GitHub App does not erase stored data automatically. Account deletion does not automatically remove published GitHub content. Customer-controlled project data follows the customer’s lawful instructions and applicable retention requirements.

Security measures include restricted administrative access, HTTPS, SSH, private-network database connectivity and encryption of selected credentials. No system can guarantee absolute security.

8. Your rights

Subject to applicable law, you may request access to, correction or deletion of your personal data, restriction of processing, and a portable copy. You may object to processing based on legitimate interests and withdraw consent at any time.

Contact hello@codebase.run. We may verify your identity. Requests are normally free. We respond within applicable deadlines: normally one month under the GDPR, with permitted extensions explained within that month.

For customer-controlled data, we help route requests to the customer and assist its response. Where local law provides, you may use an authorized agent or appeal our decision by contacting us. We do not discriminate for exercising privacy rights.

You may complain to the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), or another competent data protection authority, including where you live or work.

9. Age and changes

Codebase.run accounts are intended for people aged 18 or over. Contact us if you believe a person under 18 has created an account or provided personal data through it.

Updates will be published here with a revised date. We will provide additional notice or obtain consent where legally required.