Privacy Policy

Who we are

CodeGPT is an AI coding agent run by Nubri GmbH, Liebenowzeile 22, 12167 Berlin, Germany (info@nubri.co), the controller for the data described here.

What we store

• Your account: email address, a hashed password, whether you confirmed your email, plan, request counts and Stripe customer number. Stripe handles card details.
• Your work: workspaces and the files the agent writes, your conversations with the agent, and, if you add one, your own xAI API key (encrypted).
• Contact form: your name, email address and message, sent to us by email.

AI processing

Your requests, the conversation and the relevant project files are sent to Anthropic's Claude models on Amazon Bedrock (AWS); if you added your own xAI key, to xAI instead. AWS does not use this data to train models. Code the agent runs is executed in an isolated sandbox on our server.

Why, and on what basis

We process data to provide the service (Art. 6(1)(b) GDPR), and to keep it secure, limit abuse of free requests and see which pages bring visitors (Art. 6(1)(f) GDPR). Free requests are counted per email inbox for that reason.

Who processes data for us

• Amazon Web Services (hosting, Claude models, email)
• xAI (only with your own key)
• Stripe (payments)

Transfers to the United States rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. We do not sell data.

Retention and deletion

We keep data while your account exists; you can delete workspaces yourself at any time. To delete your account and everything in it, email info@nubri.co from your account address; we do it within 30 days. A record that an inbox already received free requests is kept so they are not granted twice. Invoices are kept as tax law requires (up to 10 years).

Cookies and storage

We set no cookies. Your browser's local storage holds your sign-in token (if you sign in), your settings, a random visitor ID and where you first came from; we record the pages a visit starts on and the sign-up steps. No advertising or third-party tracking.

Server logs

Our web server logs each request: IP address, time, the address requested, the response, and your browser's user agent. We use the logs to keep the service running and secure (Art. 6(1)(f) GDPR); they are deleted automatically after at most 8 days.

Your rights

You can ask for access to, correction, deletion, restriction or export of your data, and object to processing based on legitimate interests: email info@nubri.co. You can also complain to a data protection authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.