1. Controller
The controller responsible for data processing on this website is:
NEXT LEVEL CONSULTING & SOLUTION - FZCO
Email: privacy@dynamicode.ai
2. What Data We Collect and Why
Account Data
When you register for an account, we collect your email address, name, and password (stored as a bcrypt hash). This data is necessary for the performance of our contract with you (Art. 6(1)(b) GDPR).
Project and Usage Data
We store the projects you create, task data, file contents, configuration settings, and activity logs. This data is processed to provide you with the development platform services as described in our terms (Art. 6(1)(b) GDPR).
Payment Data
Payment information is processed by our payment provider Stripe. We store only a reference to your Stripe customer ID and subscription status. We do not store credit card numbers or bank details on our servers. Legal basis: Art. 6(1)(b) GDPR.
Affiliate Referral Data
If you consent to marketing cookies and visit through a creator link, FirstPromoter stores a referral and tracking identifier for up to 60 days. If you enter a creator code, we process that code as part of checkout. We associate a qualifying membership purchase with the referring creator to calculate commissions, prevent fraud, and handle refunds. Link-based tracking relies on your consent under Art. 6(1)(a) GDPR; creator codes entered during checkout are processed to apply the requested offer and administer the resulting transaction under Art. 6(1)(b) and (f) GDPR.
GitHub Account Data
If you choose to link your GitHub account, we store your GitHub username and an OAuth access token to enable code repository operations. You can unlink your GitHub account at any time from your settings. Legal basis: Art. 6(1)(a) GDPR (consent).
Connected Google Services
When you connect Google, we store the authorizing account identity, OAuth credentials and your selected service accounts for the project. Depending on the services you choose, we access Search Console search performance, Analytics traffic and event reports, Ads campaign reports, Merchant product and account information, Business Profile location details, YouTube channel and video information, or Google Play app and release information. We use this data to provide the reports and account-management features you request. Permissions are requested when you choose a service. Consent is the legal basis for connecting your Google account (Art. 6(1)(a) GDPR).
If you ask an AI assistant to work with a connected service, relevant tool results and your instructions are sent to the AI provider configured for that assistant. Results may be retained in project chats, task records or reports under the project-data retention rules below. OAuth credentials are kept server-side and are not included in those tool results. Uploads, business-detail changes and app releases use the permissions and approvals associated with the requested action. When you choose “Set up for me”, we request the additional permissions needed to create Analytics properties and web streams or verify Search Console websites. With your confirmation, we can also create supported Merchant or Ads accounts. Setup records retain resource references and request outcomes to prevent duplicate creation; disconnecting does not delete resources created in your Google account.
DynamiCode uses Google user data only to provide the requested features. We do not sell it, use it for ad targeting, or use it to train general-purpose AI models. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Human access is limited to your consent, necessary security investigations or legal obligations.
Disconnect a service in the project connection settings to remove its stored connection credentials. You can also revoke Google authorization in your Google Account connections. Disconnecting does not delete reports or conversations you have already saved, or content published to Google. For deletion of retained DynamiCode data, use the account-deletion process below or contact us at privacy@dynamicode.ai. YouTube features use YouTube API Services; the YouTube Terms of Service and Google Privacy Policy also apply.
Server Logs
Our servers automatically log IP addresses, browser user agents, and timestamps for security and operational purposes. These logs are retained for up to 30 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security).
Cookies
We use essential cookies for authentication and session management. With your consent, we may also use analytics cookies to understand how our platform is used. You can manage your cookie preferences at any time. Legal basis: Art. 6(1)(a) GDPR (consent) for non-essential cookies; Art. 6(1)(f) GDPR for essential cookies.
3. Data Retention
We retain your data as follows:
- Account data: For the duration of your account and 30 days after deletion request.
- Project data: For the duration of your account and deleted within 30 days after account deletion.
- Payment records: 10 years as required by tax regulations.
- Server logs: Up to 30 days.
- Consent records: For 3 years after consent was given or revoked, as evidence of compliance.
4. Your Rights
Under the GDPR, you have the following rights:
- Right of access (Art. 15): You can request a copy of the personal data we hold about you.
- Right to rectification (Art. 16): You can request that inaccurate data be corrected.
- Right to erasure (Art. 17): You can request deletion of your account and all associated data. Use the “Delete Account” feature in your account settings. After a 30-day grace period, all data will be permanently deleted.
- Right to data portability (Art. 20): Your code is always accessible through your linked Git repositories.
- Right to restrict processing (Art. 18): You can request that we limit how we process your data.
- Right to object (Art. 21): You can object to processing based on legitimate interests.
- Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you can withdraw it at any time.
To exercise any of these rights, contact us at privacy@dynamicode.ai.
You also have the right to lodge a complaint with a supervisory authority if you believe your data is being processed unlawfully.
5. Third-Party Processors
We use the following third-party service providers to operate our platform:
- Hetzner Online GmbH (Germany) — Cloud infrastructure hosting for development containers and application servers. Data is processed within the EU.
- Stripe, Inc. (USA) — Payment processing. Stripe is certified under the EU-U.S. Data Privacy Framework.
- FirstPromoter (USA) — Affiliate click, referral, commission, and payout administration. Referral tracking is activated only after marketing-cookie consent.
- GitHub, Inc. (USA) — Source code hosting and OAuth authentication. GitHub is certified under the EU-U.S. Data Privacy Framework.
- Infisical, Inc. (USA) — Secrets management for secure storage of API keys and credentials within your development environments.
6. Data Transfers Outside the EU
Where data is transferred to service providers outside the EU/EEA (Stripe, FirstPromoter, GitHub, Infisical), such transfers are protected by the EU-U.S. Data Privacy Framework, Standard Contractual Clauses (SCCs), or equivalent safeguards as required by Chapter V GDPR.
7. Security Measures
We implement appropriate technical and organizational measures to protect your data, including:
- Encryption in transit (TLS/HTTPS) and at rest
- Tenant isolation through Kubernetes namespaces and row-level security
- Bcrypt password hashing
- Regular security audits and access controls
- Network-level firewall rules restricting access to internal services
8. Changes to This Policy
We may update this privacy policy from time to time. If we make significant changes, we will notify you via email or through a notice on our platform. Continued use of the service after changes constitutes acceptance of the updated policy.
Contact
For any questions about this privacy policy or our data practices, contact us at: privacy@dynamicode.ai