CommentCoderThis policy explains how CommentCoder collects, uses and protects your personal data when you use its website and services. We follow the principles of data minimisation, transparency and security.
1. Data controller
Controller: Codartifact OÜ, Harju maakond, Tallinn, Kesklinna linnaosa, Tartu mnt 67/1-13b, 10115 Estonia.
Contact: [email protected].
Data protection officer: Thomas Collart, [email protected].
2. Data collected
We may collect the following categories of data:
- Account data: email address, hashed password, name where provided, and technical session identifiers.
- Learning data: courses followed, progress, completed exercises, XP and activity on the platform.
- Payment data: billing information and subscription status transmitted or processed through Stripe. We do not store full payment card numbers.
- Communication data: support emails, messages sent through forms and newsletter preferences.
- AI tutor conversations: questions sent to Thomas, generated answers, code excerpts and information about the current exercise; see section 4.
- Technical data: IP address, connection logs, device type, browser and pages visited.
- Cookies and trackers: non-essential trackers are used only in accordance with your consent; see the cookies section.
We do not intentionally collect sensitive data within the meaning of the GDPR.
3. Purposes and legal bases
- Providing the service, including account creation, course access, progress and subscriptions: performance of a contract.
- Payment and billing: performance of a contract and legal obligations.
- Customer support: performance of a contract or legitimate interests.
- Security and prevention of fraud and abuse: legitimate interests.
- Product improvement and audience statistics: legitimate interests or consent, depending on the tracker.
- Educational or marketing emails: consent or legitimate interests, with the ability to unsubscribe at any time.
4. Recipients and service providers
Your data may be processed by providers needed to operate the service, including:
- Vercel Inc., for frontend hosting.
- Infrastructure or VPS providers, for the backend and database.
- Stripe, for payments and subscription management.
- Brevo or an equivalent email provider, for sending emails.
- PostHog, for audience and product analytics, after consent where required.
- OpenRouter and the relevant language model provider, for the Thomas tutor.
- Error monitoring or uptime monitoring providers where applicable.
These providers act under our instructions and appropriate contractual safeguards. We do not sell your personal data.
Thomas AI tutor
When you use Thomas, your question, the exercise instructions and revealed hints, and an excerpt of your code are sent to OpenRouter and the language model provider to generate an answer. We configure this provider not to use your data for training or resale. These exchanges may be processed outside the European Union; see section 5.
You can view and delete your conversations at any time in your settings or by deleting your account. Conversations are also included in your data export.
5. Transfers outside the European Union
Some providers may be located outside the European Union, for example in the United States. Where applicable, we ensure that appropriate safeguards are in place, such as standard contractual clauses, adequacy decisions or equivalent mechanisms.
6. Retention periods
As an indication:
- Account and progress data: kept while the account is active, then deleted or anonymised within a reasonable period following a deletion request, subject to legal obligations.
- Billing data: kept for the period required by accounting and legal obligations.
- Technical logs: kept for a limited period necessary for security and diagnosis.
- PostHog analytics data: kept for up to 12 months, unless a different configuration is indicated where applicable.
- Newsletter data: kept until you unsubscribe or delete your account.
The account deletion page provides further details about deletion requests and data that may be retained.
7. Your rights
Under the GDPR, you have rights of access, rectification, erasure, restriction of processing, objection and data portability. You may withdraw your consent at any time and provide instructions concerning your data after your death.
To exercise your rights, contact [email protected]. We may request proof of identity where there is reasonable doubt about the requester's identity.
You may also complain to a competent supervisory authority. In France, this is the CNIL.
8. Cookies and trackers
The Website may use essential cookies or trackers for authentication, security and consent preferences. Audience measurement trackers such as PostHog are used only after consent where required.
PostHog may collect browsing data, including pages visited, duration, device and browser, to improve the product. You can manage consent through the cookie controls in the website footer where available, or through your browser settings.
Refusing non-essential cookies may limit some measurement features without preventing the main use of the service.
9. Security
We take reasonable measures to protect your data, including HTTPS, access controls, hashed passwords, separation of services and application security practices.
No transmission or storage of data on the Internet is entirely secure, and we cannot guarantee absolute security. If a security incident presents a high risk to your rights, we will inform affected people and the competent authorities where required by law.
10. Children's data
The service is not intended for children under 15 without the involvement of a person holding parental responsibility. If you believe that a child has provided data without permission, contact us so that we can delete it.
11. Changes to this policy
This policy may be updated to reflect legal, technical or organisational changes. The update date appears at the top of the page. Substantial changes may be announced on the Website or by email.
12. Mobile application (Android and iOS)
This policy also applies to the CommentCoder mobile application distributed through Google Play and the App Store. The processing described above applies, with the following clarifications.
Data collected in the Application: in addition to section 2, technical and diagnostic data may include device type and model, operating system and app version, language, and error and performance logs. Data stored locally on your device may include favourites, saved mistakes and preferences. This data may be kept only on the device for offline operation and is deleted when the Application is uninstalled.
Purchases and subscriptions: in-app purchases and subscriptions are processed by Google Play or the App Store, where applicable through RevenueCat. We receive subscription status and transaction identifiers, but do not receive or store your banking details.
Purposes and legal bases: these are the same as in section 3. Educational notifications rely on your consent, which you can withdraw at any time in the Application or device settings.
Recipients: in addition to section 4, Google Play, Apple and RevenueCat process data for distribution and purchase management.
Trackers: the Application does not place cookies. It may use technical identifiers and usage measurement data, including PostHog, to improve the product, after consent where required. You may refuse this measurement without preventing the main use of the service.
Deletion: you can delete your Account directly in the Application settings. Associated data is deleted according to section 6. Local data is deleted when you uninstall the Application. You can also request deletion without the Application by following the account deletion instructions.
The rest of this policy also applies to the Application.
13. Contact
For questions about personal data, email [email protected].
Codartifact OÜ, Harju maakond, Tallinn, Kesklinna linnaosa, Tartu mnt 67/1-13b, 10115 Estonia.