Privacy policy

This policy explains what personal data MakeThemCode handles, why, and what you can do about it. The service is published by Romaric Guth EI, 19 rue de la liberté, 92150 Suresnes, France, who is responsible for this data. Contact: contact@romaricguth.com.

Your repositories and conversations may themselves contain personal data. We only handle it on behalf of the organisation running the project, to provide the service. A data processing agreement is available on request.

1. What we collect

• Your account: name, email address, password (stored hashed), the projects you belong to and what you may do in them.
• Your GitHub connection: the GitHub accounts the app is installed on and the repository of each project. The GitHub token used to list your repositories stays in your browser, encrypted, for 8 hours.
• Your sessions: the messages you send to the assistant, the files you attach, its answers and the changes it makes. Your changes are committed to the repository with your name and email address as their author.
• The settings of a project: among them its environment variables, stored encrypted and given to its sandboxes.
• Usage and payments: the requests made to the AI model with their cost, the payments of a project and who made them. Card details go to Stripe and never reach our servers: we only see the brand and the last four digits of a saved card.
• Technical data: the logs of our servers, such as IP addresses and the time of requests, kept for security and troubleshooting.

2. Why we use it

• To provide the service you signed up for: accounts, sessions, changes to your repository (contract).
• To bill the usage and keep the records the law asks for (contract and legal obligation).
• To keep the service secure and prevent abuse (legitimate interest).
• To send you the emails the service needs (confirmation, invitations, password, billing), and now and then news about the product, which you can unsubscribe from in each email (legitimate interest).

We do not sell personal data and do not use it for advertising.

3. Who receives it

The other members of your projects see your sessions, unless you chose not to share a conversation.

We rely on these providers, who only receive what their part of the service needs:

• IONOS SARL: hosting of the application and its database.
• Modal Labs (United States): the sandboxes, which hold a copy of the repository and the environment variables of the project while a session runs.
• Anthropic or OpenAI (United States), depending on the model in use: the conversation with the assistant and the parts of the code it works on. According to their API terms, they do not use this data to train their models.
• GitHub (United States): the commits and pull requests made in your name.
• Stripe (Ireland): payments.
• Brevo (France): the emails we send, and the list of our users.

Some of these providers process data outside the European Union. These transfers are covered by the safeguards they offer: the EU-US Data Privacy Framework or standard contractual clauses.

4. How long we keep it

• Your account: until you ask us to delete it.
• Conversations: 30 days after the last change of their session, or for as long as its changes are under review.
• Sandboxes: deleted when their session ends or is left idle.
• Sessions without their conversation, usage and payments: as long as the project exists, and for the 10 years the law requires for accounting records.

5. Cookies

We only use the cookies the service needs: the one that keeps you logged in, short-lived ones while you confirm your email address or connect GitHub, and your interface preferences. There are no advertising or analytics cookies, which is why no consent banner is shown. Stripe sets its own cookies on its payment page.

6. Security

Connections are encrypted, passwords are stored hashed and environment variables encrypted. The key we use with the AI model provider never enters a sandbox, and your GitHub access is only given to a sandbox for the time of a clone or a push.

7. Your rights

You can ask for a copy of your data, have it corrected or deleted, object to its use or ask that it be limited, and receive it in a portable format. Write to contact@romaricguth.com: we answer within a month. You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

8. Changes

We may update this policy. A significant change is announced by email before it applies.