codai privacy & data

The data controller is Interactive Media Solutions S.R.L. (IMS SRL)

Email address, display name, avatar URL and the identifier returned by your sign-in provider

Per-request usage records (model, token counts, cost, timestamps, key and device identifiers), plan, credit balance and Stripe customer identifier.

The messages you send, the model responses, tool calls and tool results

API keys (we store only a hash and a short prefix), key names, device name and model, a randomly generated device identifier

Request metadata (timestamps, status codes, latency, IP address, user agent)

Providing the Service: authentication, routing your requests to models, running tasks, syncing sessions between your devices, billing.

Security, fraud and abuse prevention, rate limiting, spend caps, debugging outages.

Account, API keys, devices and session events: for as long as your account exists.

Per-request usage records and audit log entries: 30 days, then deleted automatically.

Technical logs: 30 days.

Our own infrastructure runs on Google Cloud in region europe-west1 (Belgium); your account, usage and session data are stored there.

those transfers rely on the providers’ Standard Contractual Clauses and EU-US Data Privacy Framework certification.

those transfers rely on the providers’ Standard Contractual Clauses and EU-US Data Privacy Framework certification.

The same list is published at codai.ro/subprocessors, where changes are announced 30 days in advance.

Google Cloud Data Processing Addendum

your account can be deleted in the dashboard at hub.codai.ro (Settings → Data & privacy → Delete account; sign-in stops at once and your data is erased after a 7-day window

Under the GDPR you have the right to access your data, to have it rectified or erased, to receive it in a portable format

to withdraw consent at any time without affecting past processing

You can lodge a complaint with the Romanian supervisory authority, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

We do not sell personal data and we do not share it with advertisers or data brokers.