Privacy Policy
Version 1.0.3 · 5 November 2026
1. Who we are
Codeliance is operated by CODELIANCE LIMITED, a company incorporated in Ireland under company number 795846 ("Codeliance", "we", "us"). Codeliance is a service that helps organizations evaluate their online platforms against regulations such as the EU Digital Services Act. This policy covers the Codeliance service and our website, codeliance.com.
This policy explains how we handle personal data in two roles:
- As controller, for the people we deal with directly: people who create or are invited to a Codeliance account, people who request a free scan, people who visit our website, and people who contact us.
- As processor, on behalf of our customers, for personal data that appears in what a customer asks us to evaluate. This includes the content of their platform that our evaluation captures, the evaluation credentials they give us, and the files they upload as evidence. The customer is the controller of that data. Our agreement with the customer governs it, and this policy describes it only so that you know what happens to it. A free scan is run at a prospect's request before any agreement exists, so for a free scan we act as controller.
2. What we collect
When you create an account: your full name, work email address and a password. We store the password only as a salted hash (we cannot read it). You also give the name of your company and your platform's web address. We record when you joined, when you last signed in, how many times you have signed in, and whether you signed in with your email address or your username.
When you sign in with Google: Google tells us your Google account's identifier, your email address (only one Google has verified), and your name. We keep the identifier and the email address to recognize you next time, and use your name for your profile. We ask Google for nothing else. We receive no password, contacts or other Google data.
When you are invited to a company's account: the inviting administrator gives us your email address and your role. When you accept, you give us your name and a password.
While you use Codeliance: we keep the time zone you choose, or the one your browser reports. We keep what you and your colleagues write into the service, such as status updates, acknowledgements, comments, deadlines and reports. We keep your conversations with the in-app AI compliance advisor. We record who did what, so that a company's compliance history names its authors. We count the AI-assisted actions each account starts, so that we can apply usage limits. We record each request made with an API key, including the address it came from.
When you request a free scan: the web address to scan, your confirmation that you may have it scanned, what kind of service it is, your company's size, and your email address. We also note which marketing campaign link brought you to us, if any. We record when the scan ran, when we emailed you the report, and whether you opened the report or clicked to book a call. We do not keep your IP address with your scan request. We hold it in memory for one minute to limit how often scans can be requested, and we share it with Cloudflare to check that the request comes from a person (§4). As with any visit to the service, it also appears in our server logs (§6).
When you join the waitlist or ask about a plan: your email address, your company's name, and anything you write to us. For a plan enquiry, this also includes your role and team.
When you book a demo: your name and email address and, if you give them, your company's name and size, the regulations you are in scope for, and what you would like to cover. We record the version of this policy you agreed to. We send your request to our team by email.
When you buy a paid plan: payment is taken by Stripe on its own pages. Stripe receives your email address and your payment details and, where tax is collected, your billing address and tax number. We do not receive or store card details. We keep the identifiers Stripe gives your company's customer record and subscription, and a record of the billing events Stripe sends us.
When you visit our website (codeliance.com): we measure visits with a privacy-friendly analytics service, currently Umami, which uses no cookies and does not follow you from site to site. For each page view it receives the page's address and title, the page you came from, your browser's language and your screen size. Like the providers that host and deliver the website, it also receives your IP address and browser type, as any web request carries them, and works out your country and device type from those. If you give us your details to ask for a demo or to be contacted, for example on a form at one of our events, we keep what you give us, such as your name and email address, and use it to get in touch with you about Codeliance, including by email. A "book a call" link opens Google Calendar's booking page, which is Google's.
About your platform (customer data we process for you): your platform's name, address, description and classification answers. It also includes the evaluation credentials you give us (the login details of an account on your platform), which we store encrypted and use only when an evaluation runs. During an evaluation, our automated agent browses your platform the way a user would. It captures evidence such as screenshots, page snapshots, network traces and recordings. That evidence contains whatever your platform shows at the time, which can include other people's personal data. It is also where we keep files you upload as evidence, and your company logo. If you submit a document for a pre-launch review, such as a product requirements document, we keep its text.
Codeliance is a service for businesses, used by people at work. We do not knowingly collect data about children, and we do not collect special-category data on purpose.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis (GDPR Art. 6(1)) |
|---|---|
| Providing your account and the service: signing you in, running evaluations, storing your company's records, taking payment for a paid plan, sending the emails the service depends on (password reset, invitations, assignments, deadline reminders, scan results) | Performance of our contract with you or your company (b) |
| Running a free scan you asked for, and emailing you its report | Steps taken at your request before entering into a contract (b) |
| Following up on a free scan, a plan enquiry or a request for a demo or contact, about our paid service | Our legitimate interest in offering our service to businesses that have shown interest (f) |
| Counting visits to our website, to understand interest in Codeliance | Our legitimate interest in knowing how our website is used, measured without cookies (f) |
| Keeping the service secure: bot protection, rate limits, API-key audit logs, malware scanning of uploaded files, and applying usage limits | Our legitimate interest in protecting the service and its users (f) |
| Keeping a company's compliance history intact after a person leaves it | The customer's and our legitimate interest in an accurate audit trail (f) |
| Meeting legal obligations, such as accounting records or responding to authorities | Legal obligation (c) |
We do not sell personal data. We email you about your account, a scan you requested, or an enquiry or request you made. If you would rather we did not follow up on a scan, an enquiry or a request, tell us at hello@codeliance.com and we will stop.
We do not make decisions about individuals by automated means that have legal or similarly significant effects on them. Our automated evaluations assess platforms, not people.
4. Who we share it with
We use these service providers (sub-processors). Each receives only what it needs:
| Provider | What for | What it receives | Where |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting, database, file storage, backups, email delivery (SES), malware scanning (GuardDuty) | All data described in §2 | EU: Ireland, with backup copies in Germany |
| AWS Bedrock (models by Anthropic) | The AI that runs evaluations, the in-app advisor, the review of evidence you submit, pre-launch reviews, platform-type detection and scan summaries | Evaluation instructions, the pages the agent browses, advisor conversations, the evidence you attach to a status update (including its files), documents you submit for a pre-launch review, and your platform's public homepage text | EU regions |
| Stripe | Taking payment for paid plans | Your email address and payment details and, where tax is collected, your billing address and tax number | Ireland and the United States |
| Cloudflare | Bot protection (Turnstile) on the free-scan, contact and demo forms, and delivering our website | Your IP address and the browser signals Turnstile collects. For the website, your IP address, browser type and the pages you request | Cloudflare's global network |
| Render | Hosting our website | Your IP address, browser type and the pages you request | Render's cloud |
| Umami | Measuring visits to our website | What §2 lists for a website visit | Stored in the EU |
| Tavily | A web search that helps identify what kind of service a platform is | The platform's web address | United States |
| Google (sign-in) | "Continue with Google", if you choose it | Your sign-in with Google. Google knows you signed in to Codeliance | Under Google's own terms |
| Google Workspace | Our staff email and documents | Notices to our team about new sign-ups, enquiries and scan results, which include your name, email address and company. The details you give when you ask for a demo or contact | Google's data centers |
Evaluation credentials are never sent to the AI. The AI sees only the names of the credentials, not their values. Evidence files you attach to a status update are read by the AI when it reviews that update, and a document you submit for a pre-launch review is read by the AI for that review. When you message the advisor, it reads everything on the page you have open, except sensitive information such as credentials, which is removed before the page reaches it. It is not given the files behind the page.
We may also disclose data when the law requires it, or to a buyer of our business, which would be bound by this policy.
5. Where it is stored and transferred
We store your data with AWS in the EU, in the Ireland (eu-west-1) region. We keep backup copies in the Frankfurt (eu-central-1) region. The AI models run through AWS Bedrock's EU cross-region profiles, which keep processing within EU regions.
Stripe, Cloudflare, Render, Umami, Tavily and Google may process data outside the European Economic Area. Where they do, the transfer relies on a safeguard the GDPR recognizes, such as the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
6. How long we keep it
| Data | How long |
|---|---|
| Your account | While your account is active. When you ask us to delete it, we erase your personal details (§8). |
| A company's records and evidence | While the company is a customer. After that, we delete or anonymize them when the company asks us to. |
| Evidence files you or we delete | Removed from live storage straight away. Removed from our storage versioning within 7 days. |
| Database backups | 30 days |
| Unclaimed free-scan requests | 12 months, then deleted |
| Waitlist entries, plan enquiries and requests for a demo or contact | Until you ask us to delete them |
| Billing records | The Stripe identifiers, while the company is a customer. Invoices and payment records, for as long as tax and accounting law requires. |
| Invitations | Kept with the company's records, including after they expire (30 days after sending) |
| Working copies on our evaluation servers: what an evaluation captured (screenshots, transcripts, page content) and advisor conversations | Deleted 30 days after their last activity. This does not remove the evidence and conversations you see in Codeliance, which are separate copies kept with the company's records (above). |
| Notes our evaluation agent keeps about how a platform is laid out, which can quote text shown on it | Until we delete them at the company's request |
| Operational records of each evaluation (identifiers, timings, costs; no page content) | Kept permanently for service analysis. They contain no names or email addresses. |
| Server logs of your use of the service | Up to 30 days |
7. Cookies and browser storage
We currently use no advertising or analytics cookies, and nothing that follows you from site to site. Our website currently sets no cookies (§2). The Codeliance service sets these:
| Name | Purpose | Duration |
|---|---|---|
sessionid |
Keeps you signed in | 1 week |
csrftoken |
Protects forms against cross-site request forgery | 1 year |
tz |
Remembers your browser's time zone so that dates show in your local time | 1 year |
messages |
Shows one-off confirmation messages | Until shown |
| Cloudflare Turnstile | Checks that a request from the free-scan, contact or demo form comes from a person (on those forms only) | Set by Cloudflare |
Your browser also keeps some interface preferences locally, such as a collapsed sidebar or column order. The advisor keeps its current conversation in your browser until you close the tab. None of this is sent to anyone.
8. Your rights
You have the right to access your personal data, to correct it, and to have it erased. You can ask us to restrict its processing, to give it to you in a portable form, or to stop using it where we rely on legitimate interests. You can correct your name, email address and time zone yourself in your profile. For anything else, write to hello@codeliance.com.
When we erase an account, we remove your name, email address and time zone. We also remove your API keys, the link to your Google account, your advisor conversations, your notifications, your plan enquiries, any waitlist entry or demo request under your address and any pending invitations to you. Records you created for your company stay with the company, attributed to "Former member". This is because they form part of its compliance history. A report your company stored before then is a fixed record of its date, and keeps any name it printed, such as an obligation's owner. Anything you typed into those records is the company's, and we review requests to change it, or a stored report, case by case. Notifications your colleagues received that mention you stay with them. Emails already sent cannot be recalled. For those in our own inboxes, we delete them on request. An administrator must remove you from your company before your account can be erased.
We complete an erasure request within 30 days, across all our systems. Some copies are not deleted one by one but expire by age within that time: server logs, database backups, and the working copies on our evaluation servers (§6).
Where we process data as a customer's processor (§1), we pass your request to that customer and help them answer it.
You can complain to the Data Protection Commission (Ireland, dataprotection.ie) or to the supervisory authority where you live.
9. Security
We encrypt all connections to Codeliance (HTTPS, with HSTS). Our servers, database, file storage and backups are encrypted at rest. Evaluation credentials are additionally encrypted in our database. Uploaded files are scanned for malware, and files found to be malicious are withheld. Evidence files can only be downloaded by members of the company they belong to, through links that expire after 15 minutes.
10. Changes and contact
If we change this policy, we will post the new version here with a new version number and date. If a change is significant, we will tell account holders by email before it takes effect. Questions go to hello@codeliance.com.