Privacy Policy — Codeback

This Privacy Policy explains how Codeback collects, uses, and protects personal data. We aim to be clear and to respect your rights under the GDPR and similar laws.

1. Who we are

The data controller is [COMPANY LEGAL NAME], [REGISTERED ADDRESS] (company number [COMPANY NUMBER / SIREN]). For any privacy question, contact [CONTACT EMAIL].

2. Data we collect

Account data — your email and name, and, if you choose Google sign-in, the basic profile information Google shares (name, email, profile picture).
Campaign data (advertisers) — ad text, links, bids, budgets, targeting, and performance metrics.
Impression & click telemetry — events needed to bill and measure ads, including which tool, operating system, and editor language are in use, plus timing and counts. We do not collect or read the content of your code, files, prompts, or project.
Payout details (developers) — information needed to pay you, collected and held by our payment processor (see below).
Technical data — basic logs and security signals such as IP address and request metadata.

3. Cookies & similar technologies

Language preference — a NEXT_LOCALE cookie remembers your chosen language.
Authentication — a session cookie keeps you signed in.
Analytics — we use Datyze, a privacy-friendly visitor analytics tool, to understand aggregate site usage.
Anti-bot — we use Cloudflare Turnstile on login to protect against automated abuse.

4. Payment data

Advertiser payments are processed by Lemon Squeezy as merchant of record, and developer payouts are processed by Stripe. These processors handle card and payout details directly under their own privacy policies. Codeback does not store card data.

5. How we use data

to provide, operate, and secure the Service;
to run the ad auction, serve ads, and measure performance;
to bill advertisers and pay developers;
to detect and prevent fraud and invalid traffic;
to communicate with you about your account and the Service; and
to comply with legal obligations.

6. Legal bases (GDPR)

Contract — to provide the Service you signed up for (accounts, campaigns, payouts).
Legitimate interests — to secure the Service, prevent fraud, and improve the product (balanced against your rights).
Consent — where required, for example certain analytics or marketing; you can withdraw consent at any time.
Legal obligation — to meet accounting, tax, and other legal requirements.

7. Who we share data with

We share data only as needed with trusted providers, including:

Payment processors — Lemon Squeezy (advertiser payments) and Stripe (developer payouts);
Analytics — Datyze;
Security — Cloudflare (Turnstile);
Sign-in — Google, if you choose Google OAuth; and
Hosting and infrastructure providers that run our platform.

We do not sell your personal data.

8. International transfers

Some providers may process data outside your country, including outside the EEA. Where this happens, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

9. Retention

We keep personal data only as long as necessary for the purposes above, then delete or anonymise it. Account and billing records may be kept longer where required by law (for example, tax and accounting rules).

10. Your rights

Subject to applicable law, you have the right to:

access the personal data we hold about you;
rectify inaccurate data;
request erasure of your data;
receive your data in a portable format;
object to or restrict certain processing; and
withdraw consent where processing is based on consent.

To exercise any of these, email [CONTACT EMAIL]. You also have the right to lodge a complaint with your local data protection authority.

11. Children

Codeback is not intended for anyone under 16 (or the minimum age in your country). We do not knowingly collect data from children.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version here and, for material changes, take reasonable steps to notify you.

13. Contact

Data controller: [COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Email: [CONTACT EMAIL].