Privacy policy

This policy explains what personal data MakeThemCode handles, why, and what you can do about it. The service is published by Romaric Guth EI, 19 rue de la Liberté, 92150 Suresnes, France, who is responsible for this data. Contact: contact@romaricguth.com.

Your repositories and conversations may themselves contain personal data. We only handle it on behalf of the organisation running the project, to provide the service. A data processing agreement is available on request.

1. What we collect

• Your account: name, email address, password (stored hashed), the projects you belong to and what you may do in them.
• Your GitHub connection: the GitHub accounts the app is installed on and the repository of each project. The GitHub token used to list your repositories stays in your browser, encrypted, for 8 hours.
• Your sessions: the messages you send to the assistant, the files you attach, its answers and the changes it makes. Your changes are committed to the repository with your name and email address as their author.
• The settings of a project: among them its environment variables, stored encrypted and given to its sandboxes.
• Usage and payments: the requests made to the AI model with their cost, the payments of a project and who made them. Card details go to Stripe and never reach our servers: we only see the brand and the last four digits of a saved card.
• The address of a developer: the email address a visitor enters on our home page to send their developer a message about MakeThemCode. It is only used to send that message: we do not add it to our contacts.
• Technical data: the logs of our servers, such as IP addresses and the time of requests, kept for security and troubleshooting.
• Audience measurement: the pages visited and actions such as creating a project, sending a message or a payment, never their content, with the browser, device, country and referring site. It is measured with Umami on our own server, without cookies: the IP address only gives the country and an anonymous identifier, and is not stored.
• Session recordings and heatmaps: on part of the visits, how the pages are displayed and used: clicks, scrolling, mouse movements and the pages opened. They let us replay a visit and see where pages are clicked, to find what gets in the way. What you type in a field is masked. They are recorded with Umami on our own server, without cookies, and never on the page of a confirmation or password link.

2. Why we use it

• To provide the service you signed up for: accounts, sessions, changes to your repository (contract).
• To bill the usage and keep the records the law asks for (contract and legal obligation).
• To keep the service secure and prevent abuse (legitimate interest).
• To send the message a visitor writes to their developer from our home page (legitimate interest of the visitor).
• To know how the site is used and improve it, with the audience measurement, session recordings and heatmaps (legitimate interest).
• To send you the emails the service needs (confirmation, invitations, password, billing), and now and then news about the product, which you can unsubscribe from in each email (legitimate interest).

We do not sell personal data and do not use it for advertising.

3. Who receives it

The other members of your projects see your sessions, unless you chose not to share a conversation.

We rely on these providers, who only receive what their part of the service needs:

• IONOS SARL: hosting of the application and its database, and the emails we send when Brevo is unavailable.
• Modal Labs (United States): the sandboxes, which hold a copy of the repository and the environment variables of the project while a session runs.
• Anthropic or OpenAI (United States), depending on the model in use: the conversation with the assistant and the parts of the code it works on. According to their API terms, they do not use this data to train their models.
• GitHub (United States): the commits made in your name, and the pull requests of your changes.
• Stripe (Ireland): payments.
• Brevo (France): the emails we send, and the list of our users.

Some of these providers process data outside the European Union. These transfers are covered by the safeguards they offer: the EU-US Data Privacy Framework or standard contractual clauses.

4. How long we keep it

• Your account: until you ask us to delete it.
• Conversations: 30 days after the last change of their session, or for as long as its changes are under review.
• Sandboxes: deleted when their session ends or is left idle.
• Sessions without their conversation, usage and payments: 10 years, the time the law requires for accounting records, also after the project is deleted.
• Commits: they stay in the history of the repository, which belongs to the project. We cannot delete them.
• Your address in our list of users at Brevo: until you unsubscribe or your account is deleted.
• Session recordings: 30 days.
• Server logs: up to a limited volume, beyond which the oldest are replaced by the newest.

5. Cookies

We only use the cookies the service needs: the one that keeps you logged in, short-lived ones while you confirm your email address or connect GitHub, and your interface preferences. There are no advertising or analytics cookies, which is why no consent banner is shown. Stripe sets its own cookies on its payment page.

6. Security

Connections are encrypted, passwords are stored hashed and environment variables encrypted. The key we use with the AI model provider never enters a sandbox, and your GitHub access is only given to a sandbox for the time of a clone or a push.

7. Your rights

You can ask for a copy of your data, have it corrected or deleted, object to its use or ask that it be limited, and receive it in a portable format. Write to contact@romaricguth.com: we answer within a month. You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

8. Changes

We may update this policy. A significant change is announced by email before it applies.