Privacy Policy

This Privacy Policy explains how Codemation B.V. ("Codemation", "we", "us") collects, uses, and protects personal data when you visit codemation.eu or use the Codemation app. We are based in the Netherlands and process personal data in accordance with the EU General Data Protection Regulation (GDPR).

1. Who we are

Codemation B.V. is a company registered in the Netherlands with the Dutch Chamber of Commerce (KvK) under number 42196131. You can reach us about privacy matters at privacy@codemation.eu.

We are responsible (the "controller") for the data about you as our customer and as a visitor of our website. For the content you bring into Codemation, such as the emails, calendar items and spreadsheets in the apps you connect, you or your company decides what happens to it and we process it on your behalf (as a "processor"). Our Terms of Service contain the agreement that covers this.

2. What data we collect

Account data. Your name, email address and company details when you sign up, including when you sign in with a Google or Microsoft account.
What you create in Codemation. Your automations, the files you upload, and your conversations with Concierge, our AI assistant.
Data from apps you connect. When you connect an app such as Gmail, Google Calendar, Google Sheets, Outlook, OneDrive, Slack or WhatsApp, we access the data that app lets you share with us, and only when you or one of your automations asks for it. See Data from connected apps.
Payment data. Your subscription and invoices. Payments are handled by our payment provider; we never see or store your full card details.
Usage and technical data. Which features you use in the app, error reports, and standard server data such as IP address and browser type, to keep the service secure and working and to improve it.
Messages to us. Your email address and what you write when you contact us.

3. How we use your data

To provide Codemation: run your automations, let Concierge answer your questions and carry out the tasks you ask for, and keep your workspace available.
To manage your account, subscription and invoices, and to help you when you contact us.
To keep the service secure and to find and fix problems.
To improve the product, using usage statistics about how features are used, not the content of your emails, files or conversations.
To comply with legal obligations, such as keeping invoices.

We do not sell your data and do not use it for advertising.

4. How Concierge uses AI

Concierge and some automation steps use AI models to understand your request and do the work. To answer a request, we send the information needed for that request, such as your question and the email or spreadsheet it is about, to an AI model provider. The provider processes it only to produce the answer, under a contract that does not allow it to use your data to train its models. We do not use your data, or data from the apps you connect, to train AI models either.

We keep a record of what Concierge did for each request, so that we can investigate problems you report. That record is deleted together with your account.

AI can make mistakes. Check what Concierge proposes before you rely on it; see our Terms of Service.

5. Data from connected apps

You decide which apps to connect, and you can disconnect them at any time in Codemation. For each app, we only ask for the access the features need:

Gmail and Outlook: read and search your emails, read attachments, create drafts and organise labels or folders, when you ask Concierge to or when your automation does. Concierge prepares drafts and does not send emails itself; an automation sends emails only if you set it up to do so.
Google Calendar and Microsoft Calendar: read your calendars and events, and create, change or answer events when you ask for it.
Google Sheets: read and update the spreadsheets you point Codemation to, for example to add a row.
OneDrive: find, read and save files when you ask for it.
Slack and WhatsApp: read and send messages in the conversations your automations are set up for.

We store the access keys these apps give us in encrypted form. The content we read is used to answer your request or run your automation. It appears in your Concierge conversation or automation results, which you can delete, and is not used for anything else. No one at Codemation reads your app data unless you ask us to for support, it is needed for security, or the law requires it.

Google user data. Codemation's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, data from your Google account is used only to provide the features you use in Codemation, is not used for advertising, is not sold, and is not used to develop, improve or train generalised AI or machine-learning models. You can also remove Codemation's access at any time in your Google Account under Third-party apps and services.

The same applies to data from your Microsoft account. You can remove access at myapps.microsoft.com.

6. How we protect your data

We protect your data, and especially the access keys and content that come from apps you connect such as Gmail, Google Calendar, Google Drive and Google Sheets, with these measures:

Encryption in transit. All traffic between your browser and Codemation, and between Codemation and the apps you connect, is encrypted with HTTPS (TLS). Connections to our databases are encrypted as well.
Encryption at rest. The access keys that connected apps give us (OAuth tokens) are encrypted with AES-256-GCM, using a dedicated key that is stored separately from the database and that only the service connecting to your apps can use. Our databases are encrypted at rest.
Hosting in the EU. Our servers and databases run at Scaleway in Amsterdam, the Netherlands. Backups are stored at Scaleway in Paris, France.
Separation between customers. Every workspace has its own database and runs in its own process, and network rules stop workspaces from reaching each other. Every request is checked so that you can only reach your own workspace. Your automations receive only a short-lived access key, never the long-term key.
Limited staff access. Only a small number of authorised engineers can access our production systems. Our admin tools can only be reached from our own network, and when a staff member views the content of a customer's run, this is recorded in an audit log.
Keeping as little as possible. Content read from your apps is used to carry out your request. Run details are deleted automatically one day after the run, unless you choose to keep them longer for an automation. Concierge conversations are deleted 90 days after they were last used, and system logs after 2 to 30 days.
Disconnecting and deleting. When you disconnect an app, we delete its access keys immediately. You can also withdraw Codemation's access in your Google account at any time, at myaccount.google.com/permissions. When you delete your workspace, we delete its database, files and connections.
AI providers. To answer a request, we send the content needed for it to the AI model providers we use, Anthropic and Fireworks AI. Their terms do not allow them to use it to train their models. We never use data from Google APIs to develop, improve or train generalised AI or machine-learning models.

7. Legal bases

We process your data because it is necessary to provide the service you signed up for (our contract with you), for our legitimate interests in keeping the service secure and improving it, to comply with legal obligations such as keeping invoices, and with your consent where we ask for it, for example when you contact us to be kept informed.

We share data only with service providers that help us run Codemation, each bound by a data processing agreement and allowed to use the data only for us: hosting and databases (in the Netherlands, with backups in France), AI model providers, a service that monitors AI requests, email delivery, payment processing, product analytics and error reporting, document reading, and network and bot protection. When you connect an app, we also exchange data with that app's provider on your instruction.

Some of these providers may process data outside the European Economic Area. Where that happens, we use the safeguards required by EU law, such as the European Commission's Standard Contractual Clauses. We do not sell your personal data.

9. Retention

Your account data and automations are kept while your account exists. Concierge conversations are deleted automatically 90 days after they were last used, and you can delete them yourself at any time.
When you cancel, we delete your data within 30 days, giving you time to change your mind or ask us for a copy.
Invoices and payment records are kept for 7 years, as Dutch tax law requires.
Website visit statistics are kept in aggregate only.

10. Your rights

Under the GDPR you have the right to access, correct, delete, restrict and object to the processing of your personal data, and the right to receive it in a portable format. To use these rights, email privacy@codemation.eu. You can also file a complaint with your data protection authority; in the Netherlands that is the Autoriteit Persoonsgegevens.

If you are a customer of one of our customers and their emails or files mention you, please contact that company first: they decide how your data is used, and we will help them handle your request.

11. Cookies and analytics

Website. This website uses only the cookies strictly necessary to serve the pages you request, and no analytics or marketing cookies. To see which pages are visited and which campaign a visit came from, we count page views, sign-up and demo clicks, composer actions, contact-form submission outcomes and video playback milestones in PostHog (EU), together with the campaign parameters in the link you arrived with (utm_source, utm_medium, utm_campaign, utm_content, utm_term). We also record the landing-page code when present. We do not send the contents of contact forms or composer text to analytics. Website analytics does not use cookies or persistent browser storage, so a visit cannot be linked to an earlier one or to you.

App. The Codemation app uses cookies that are needed to keep you signed in. Inside the app, we measure which features are used, linked to your account, to improve the product. We do not send the content of your emails, files or conversations to analytics. When you delete your account, this usage data is deleted too.

12. Changes

We may update this Privacy Policy. Before an important change takes effect, we will let you know by email or in the app. The "Last updated" date above always shows the current version.

13. Contact

Questions about this policy or your data? Email privacy@codemation.eu.