Legal

Privacy Policy

Effective date: August 9, 2026 Last updated: August 9, 2026

QuantumDesk LTD ("QuantumDesk," "we," "us," or "our") operates Codebase. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our websites, applications, APIs, project builder, preview and publishing tools, and related services (the "Service").

1. Information we collect

Account and authentication information

We may receive your email address, name, profile image, account identifiers, authentication-provider identifiers, wallet address if you choose a wallet login, and account preferences. Your authentication provider does not give us your password.

Projects and communications

We process prompts, chat history, uploaded or generated files, project metadata, build logs, previews, publishing choices, support messages, and other content you provide. Do not put secrets or unnecessary personal information in prompts or projects.

Usage and device information

We collect records needed to operate and secure the Service, such as IP address, browser and device information, request and session identifiers, timestamps, feature usage, model selection and routing metadata, build outcomes, error reports, and abuse-prevention signals.

Billing information

Stripe processes payment-card details. We receive limited billing information such as customer and subscription identifiers, plan, transaction status, billing country, and tax information needed for support, accounting, and fraud prevention. We do not store full payment-card numbers.

2. How we use information

We use personal information to:

provide, personalize, maintain, and secure the Service;
process prompts, generate projects, run builds, and publish projects at your direction;
authenticate users and manage accounts, plans, credits, and payments;
provide support and send service, billing, and security communications;
diagnose failures, measure reliability, prevent fraud and abuse, and enforce our Terms;
improve features using aggregate, de-identified, or operational data; and
comply with law and protect users, QuantumDesk, and others.

We do not use your prompts, project files, or generated code to train our own or third-party foundation models without your explicit permission.

3. AI processing

Codebase uses in-house and third-party AI infrastructure. To perform a build or edit, we send the prompt, relevant conversation context, and project files needed for that request to the selected model provider or a documented fallback provider. The product identifies the selected model and records routing or fallback information for operational accountability.

Model availability changes over time. Providers may include Codebase-operated open-weight model infrastructure and commercial model APIs shown in the model picker or build receipt. We limit the information sent to what is reasonably needed to complete the request and contractually or technically configure provider retention and training controls where available.

4. When we disclose information

We disclose information only as reasonably necessary to operate the Service or for the purposes below:

AI infrastructure and model providers process prompts and relevant project context to perform requested generation.
Convex provides application data infrastructure.
Stripe processes payments, subscriptions, refunds, and billing events.
Cloudflare and our hosting infrastructure deliver and protect the Service.
Sentry receives limited error and diagnostic data when error monitoring is enabled.
Identity providers receive or provide information when you choose their sign-in method.
Deployment and integration providers process information when you direct Codebase to connect or deploy to them.
Professional advisers, authorities, or transaction participants may receive information when required by law, needed to protect rights and safety, or necessary for a merger, financing, reorganization, or sale.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising and do not use third-party advertising trackers in the Service.

5. Legal bases for users in the EEA, UK, and Switzerland

Where applicable, we process information:

to perform our contract with you, including operating your account and requested builds;
for legitimate interests such as service security, fraud prevention, reliability, support, and product improvement, balanced against your rights;
with consent for optional communications or processing where consent is required; and
to comply with legal obligations.

6. Data retention

We retain account and project information while your account is active and for as long as reasonably necessary to provide the Service. You can delete projects and request account deletion from Settings. Deletion requests are reviewed so we can preserve records that must be retained for billing, tax, fraud, security, dispute, or legal purposes.

Deleted information may remain for a limited period in backups, logs, or disaster-recovery copies before aging out. Public projects may have been forked into another user's account; deleting or unpublishing the original does not delete those independent copies. Billing, transaction, security, and audit records may be kept longer when reasonably necessary or legally required.

We avoid promising a single deletion period because different records have different operational and legal requirements. We will respond to verified privacy requests within the period required by applicable law.

7. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal information; object to or restrict certain processing; withdraw consent; or appeal a privacy-request decision.

Account Settings provides data-export and reviewed account-deletion controls. You may also submit a request to [email protected]. We may need to verify your identity before completing a request. Authorized agents may be required to provide proof of authority.

Residents of the EEA, UK, or Switzerland may complain to their local data protection authority. California residents may request access, correction, or deletion and have the right not to receive discriminatory treatment for exercising applicable rights. Because we do not sell or share personal information for behavioral advertising, there is no sale or sharing to opt out of under our current practices.

8. Cookies and similar technologies

We use cookies and local storage that are necessary for authentication, security, preferences, session continuity, and core product operation. We may use limited first-party measurements or error reporting to understand service reliability. We do not use cross-site advertising cookies or fingerprint users for advertising.

Browser privacy signals differ in meaning. Where a legally recognized signal such as Global Privacy Control applies, we treat it as an opt-out of sale or sharing; our current practice is not to sell or share such information.

9. Security

We use administrative, technical, and organizational safeguards designed to protect information, including encrypted transport, access controls, isolation for build workloads, and encryption for stored project secrets. No service is perfectly secure. You are responsible for protecting account credentials and for not placing secrets in prompts or public projects.

10. International processing

QuantumDesk operates from the United States, and our service providers may process information in the United States and other countries. Where required, we use legally recognized transfer safeguards or rely on another permitted transfer mechanism.

11. Children

Codebase is for users who are at least 18 years old. We do not knowingly collect personal information from children. If you believe a child has used the Service, contact us and we will investigate and take appropriate action.

12. Changes to this Policy

We may update this Policy as the Service or law changes. We will post the new version and effective date. For material changes, we will provide reasonable advance notice by email or in the Service when practical.

13. Contact

The controller responsible for this Policy is:

QuantumDesk LTD

Email: [email protected]