Privacy Policy

01Who we are

The data controller is Interactive Media Solutions S.R.L. (IMS SRL), CUI 37237457, Reg. Com. J18/241/2017, Str. 23 August nr. 1B, Et. 1, Ap. 8, Târgu Jiu, jud. Gorj, România. In this policy "codai", "we" and "us" refer to this controller. Full identification details are on the Imprint page (codai.ro/imprint).

Contact for privacy matters: [email protected]. Security reports: [email protected]. We have not appointed a Data Protection Officer because the size and nature of our processing do not require one under Article 37 GDPR.

This policy covers the codai gateway (ai.codai.ro), the identity service (auth.codai.ro), the web console (codai.ro), the dashboard (hub.codai.ro), the codai Android app, the codai desktop app and our command-line tools and SDKs (together, the "Service").

02AI transparency (EU AI Act)

codai is an AI system within the meaning of Regulation (EU) 2024/1689 (the AI Act), and we comply with the transparency obligations of its Article 50. When you use the apps you interact with an AI agent; the apps tell you so at first run.

Text produced by codai is generated by a machine-learning model and can be wrong. Responses of our API that carry model output (chat, messages, audio, images, video) include the machine-readable HTTP headers `x-codai-ai-generated: true` and `x-codai-generator`, so that downstream software can recognise them as AI-generated; generated images also keep the provenance markings embedded by the model provider.

If you publish AI-generated content, you are responsible for labelling it where the law requires.

03What data we process

Android password fields are hidden from accessibility services by the operating system, so codai cannot read them. The Android app bundles no analytics SDK and no advertising SDK; its only reporting library is the crash reporter described under "Crash reports", which stays off unless you enable "Send crash reports".

04Android app and Accessibility permission

The codai Android app can operate other apps on your phone (open apps, tap, type, read what is on screen). Android requires an Accessibility Service for this. The Accessibility permission is optional: without it codai works as a plain chat app.

• What it reads: the accessibility tree of the foreground app (visible text, labels, control names and positions) and, when a task needs to see the screen, a screenshot. Screen content is read only while a task you started is running; codai does not read your screen in the background.
• What happens with it: a summary of the screen is sent to the AI backend you configured — the codai gateway by default, or your own provider key — so the model can decide the next step. Steps handled by the on-device model (codai-nano / Gemma) are processed entirely on the phone and nothing is sent anywhere.
• Sensitive apps: banking, wallet and password-manager apps and any message send, payment or settings change require you to confirm an on-screen "ask card" first. Messaging apps default to "ask every time" and can be blocked entirely.
• Microphone: used only while you use voice input, turn on the wake word or record a transcript. Wake-word detection runs on the device; after the wake word or a mic tap, the audio of what you say is sent to the codai gateway for speech-to-text (Microsoft Azure AI Foundry, East US 2, under a data processing agreement), transcribed and then discarded — it is not used for training. Recordings you make for Transcripts are covered in the next section. Notifications: used to show task progress and to let you answer questions from a task; if you grant notification access, notification text is read only for automations you create or when you ask.
• Turning it off: Android Settings → Accessibility → codai → Off, or uninstall the app. Screen content is not stored on our servers beyond the session transcript described below, and only if Session sync is on.

We do not use the Accessibility Service to collect data for advertising, analytics, profiling or any purpose other than performing the task you asked for. The app source code is public under the Apache-2.0 licence so you can verify this.

05Recordings and transcripts

When you use Transcripts, the app records the microphone (and, on desktop, the computer’s sound if you choose it) only while you record, with a visible recording indicator. You must have the consent of the other people you record where the law requires it.

• Audio is uploaded to a Google Cloud Storage bucket in the EU (europe-west1), encrypted with a key dedicated to recordings, and transcribed by Google Gemini on Vertex AI (global endpoint) under Google’s data processing terms. The summary and insights are written by the same models as the rest of the Service.
• Audio is deleted automatically 30 days after the recording. Transcripts, speaker names you set and insights are kept until you delete them or your account.
• You can delete a recording at any time; account deletion removes all recordings, and the account export includes every transcript (not the audio).
• Recordings are not used for training unless you turn on "Use my data to improve codai".
• Share links: if you create a public link to a transcript, anyone who has the link can read it, read-only — the title, speaker names, transcript text, summary, key points and actions; never the audio, your name, email or account. A link can expire after a period you choose, and you can revoke it at any time; deleting the transcript removes its links. We store only a fingerprint (SHA-256) of the link, so we cannot show it again or recover it.

06Custom voices (codai Studio)

What. If you create a custom voice, you record two short clips in the app, in one session of at most 5 minutes: a fixed consent statement read word for word (for some languages it includes your first and last name), and a short sample of your normal voice. We process the two recordings, the voice profile created from them (the data the voice engine needs to speak in your voice), a consent record (account, language, voice provider, date and time, the versions of the consent statement and of our consent text, a cryptographic fingerprint of each recording, and how closely your reading matched the statement), and the narration you generate with the voice. Uploading a pre-recorded file is not possible.

Why and legal basis. To create and use the custom voice you ask for. The basis is your consent (Article 6(1)(a) and Article 7 GDPR), given with a separate tick box and the spoken statement. You can withdraw it at any time by deleting the voice in Settings. Withdrawal does not affect audio you already made. We keep the consent record and the consent recording to be able to prove your consent and to defend legal claims (Articles 6(1)(f) and 7(1)). We check only that the consent statement was read correctly (speech-to-text). We never use your voice to identify or authenticate you, and we never compare voices.

Who and where. English and Romanian custom voices are created and spoken by codai’s own voice engine (the open-source Chatterbox model by Resemble AI, run by us; for Romanian, a version we trained ourselves on public, openly licensed speech recordings, never on your voice), on our Google Cloud servers in europe-west1 (Belgium, EU); Google Cloud EMEA Ltd hosts it as our processor and never gets access to it as a voice service. Where offered instead, custom voices are created by Microsoft Azure AI Speech Personal Voice (Microsoft Ireland Operations Ltd) as our processor, in the West Europe region (Netherlands, EU), once Microsoft enables the feature for codai; for these voices Microsoft also checks that the consent recording and the voice sample are the same speaker (a check Microsoft makes as our processor; codai itself never compares voices). For every custom voice, Gemini on Google Vertex AI in europe-west1 (EU) transcribes the consent recording so we can check it matches the statement. All of this happens in the EU, under each provider’s data processing terms.

How long. The voice sample and the working copies of both recordings are deleted within 24 hours. The voice profile is kept, encrypted, until you delete the voice or your account (for Microsoft voices we also delete the voice and the consent at Microsoft), and voices unused for 12 months are deleted automatically. The consent recording (encrypted) and the consent record are kept for as long as the voice exists and for 3 years after it is deleted, only to prove consent, and are then deleted. Encrypted backups may keep deleted data for up to 8 days.

Training. Your recordings and voice profile are never used to train codai’s, Google’s, Microsoft’s or Resemble AI’s models, even if "Use my data to improve codai" is on.

Your rights. Access, rectification, erasure, restriction, portability of the consent record, objection to the retention of the consent proof, and a complaint to ANSPDCP, as described under "Your rights". If someone else used your voice without your consent, see the Digital Services Act page ("voice/likeness" notice) or use the voice-revocation form at hub.codai.ro/voice-revocation.

07Studio share and review links

Share links: if you create a view link to a codai Studio creative, anyone with the link can see the compiled preview (texts, images, video, audio and fonts used) and, if you allow it, remix it into their own codai account; never your name, email or account. Links can expire, you can revoke them at any time, and we store only a SHA-256 fingerprint of the link.

Review links: people you invite with a review link do not need an account. We collect the display name they type, their comments and replies, where on the creative they pinned them, and any approval or change request, with the date and version. This is visible to you and to everyone holding a review link to that creative. Their browser remembers the name locally (codai-reviewer-name) so they do not retype it.

Roles: for a business account, the account holder decides whom to invite and is the controller of the review content; we process it on their behalf under our Data Processing Agreement. Otherwise, and in every case for security, rate limiting, abuse prevention and handling legal notices, the controller is codai (see "Who we are"). Legal basis: legitimate interest of the link owner and of the people they invite in reviewing the work together, and our legitimate interest in security (Article 6(1)(f) GDPR); for the link owner, performance of the contract (Article 6(1)(b)).

To limit abuse we use the visitor’s IP address only as a short-lived rate-limit counter (about one minute, never stored in our database); our technical logs keep it for 30 days.

Reviewers can ask the link owner, or us at [email protected], to access, correct or delete their comments; the link owner can delete comments at any time.

08Linking your account with Brivio (and other platforms)

You can link a codai account to your account on another platform, today Brivio (brivio.ro). Linking happens only when you start it from that platform and confirm it on our screen. If you have no codai account yet, we create one for you at that moment; before it is created you accept codai’s own Terms of Service and this Privacy Policy on a separate screen.

• What we receive from the platform: your verified email address, your Brivio user identifier and, if the platform sends them, your name and the name, identifier and tax identification code (CUI) of your organisation. We also receive a one-time identifier of the link request, kept only as long as needed to stop the request from being reused.
• What we store: your codai account (created with the email and name above, if you did not have one), the link itself (the platform, your Brivio user identifier and email address), the installation of the platform as an app on your codai account with the permissions you granted, and the record that you accepted our Terms and Privacy Policy (versions, date and time).
• What we share with the platform: the status of the installation (installed, permissions changed, uninstalled), sent to it as webhook notifications, and only the data covered by the permissions you granted — for example API keys created for it on your account, usage and costs, the status of your subscription and the limits or overrides it sets, and, if you allow it, the projects you select. Nothing else.

Why and on what legal basis: to perform the link you asked for and to provide the Service through the linked platform (Article 6(1)(b) GDPR, performance of a contract). Security checks on the link request rely on our legitimate interest in preventing account takeover (Article 6(1)(f) GDPR).

Who is responsible: codai and Brivio are separate services. Each has its own terms and its own privacy notice, and each is responsible for the data it holds for its own service: Brivio for your Brivio account and for what it does with the data it receives from codai, codai for your codai account. Today both services are operated by the same company, Interactive Media Solutions S.R.L. (see "Who we are"); data passes between the two services only as described here.

How long: the link and the installation are kept until you unlink or uninstall; then the link record is deleted and the permissions and API keys issued to the platform are revoked. Your codai account remains until you delete it. The record of your acceptance of our Terms and Privacy Policy is kept as proof for as long as your codai account exists, like every other acceptance. Data the platform already received is governed by its own privacy notice.

How to unlink: at hub.codai.ro → Security → Connected apps → Disconnect, from the linked platform, or by writing to [email protected].

09Why we process it and on what legal basis

We do not build advertising profiles.

10Training our models

We use your own messages, tool outputs and pass/fail verdicts of your tasks to train codai’s own models (for example codai-mini and codai-nano) only if you turn on "Use my data to improve codai" (dashboard at hub.codai.ro → Settings → Privacy, app → Settings → About, or the first-run screen). It is off by default. The legal basis is your consent (Article 6(1)(a) GDPR). Replies generated by third-party models (Anthropic, Google, OpenAI, xAI and others) are never collected as training data. More in our AI & models policy (codai.ro/ai-policy).

You can withdraw at any time from the same places; we stop collecting from that moment and data collected under your consent is deleted within 30 days of withdrawal. Withdrawing does not affect the lawfulness of processing before withdrawal.

Screen content read through Accessibility, BYOK traffic and end-to-end-encrypted sessions are never used for training.

11Referral program

You can choose a username (3–20 lowercase letters, digits or underscore). If you agree, your username also serves as your referral code and appears in your invite link (codai.ro/r/<username>). We only use it that way after you tick the referral consent in the dashboard (hub.codai.ro → Referrals); the legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw there at any time. Withdrawing stops new referrals from being attributed to you; existing relationships stay recorded for the reasons below. The code travels only in the link itself (a `?ref=` parameter) to the sign-up page; we do not set a cookie to remember it.

When someone signs up with your code we record the referral relationship — who invited whom, the code used, when, and its status — so that we can pay the credits and answer disputes. The invited person sees your username; you see how many people you invited and the reward status, never their identity.

• Welcome credit: every new account receives 10 € of wallet credit.
• Referral credit: the invited person receives 10 € at signup with a valid code; the inviter receives 10 € once the invited person has spent 2 € of real usage. Limits: 10 rewarded referrals per month, 50 in total, and at most 100 € of promotional credit per account.
• All promotional credit expires 90 days after it is granted. Credit has no cash value and cannot be paid out.

To prevent abuse of the program without asking anyone for identity documents, we store at signup a salted hash of the device identifier, a salted hash of the network part of your IP address (/24 for IPv4, /64 for IPv6), a salted hash of the browser or app user-agent string, and the domain of your email address. We do not store the raw IP address and we do not perform identity verification (no KYC). When inviter and invitee share a device, network cluster or payment-method fingerprint, or the email domain is a disposable-mail service, the referral is held as "flagged" and reviewed manually; credits are then granted or refused. The legal basis for this abuse prevention is our legitimate interest (Article 6(1)(f) GDPR) in not paying out credit for fake accounts; you may object at [email protected].

Retention: the signup fingerprint and the referral relationship are kept for as long as your account exists and are deleted with it. Wallet ledger entries are kept with your account and, once anonymised, as part of our billing records (see Retention).

12Crash reports

The desktop app, the Android phone app, the Wear OS app and the VS Code extension can each send crash reports to Sentry (Functional Software, Inc., our processor) — but only if you enable "Send crash reports" in that app. It is off by default, also for existing installs where you never changed the setting. The legal basis is your consent (Article 6(1)(a) GDPR); you can withdraw it at any time by switching it off again, without affecting earlier processing. Where: desktop and Android app → first-run screen or Settings → About → "Send crash reports"; watch → Settings → "Send crash reports"; VS Code → setting `codai.telemetry` (VS Code’s own telemetry level also applies: nothing is sent when it is off or below "error"). Builds without a crash reporter (forks, development builds) send nothing.

A report contains the error, its stack trace, the app version and edition (Google Play or GitHub), the operating system or device model; desktop reports also carry a random install identifier. Before anything leaves the device, API keys, access tokens and file paths are removed from the text; the report carries no user or account identifier, no screenshots or screen layout, no session replay, no performance tracing and none of your prompts, model outputs, messages, files or session content.

Sentry stores the reports in its EU data region (see codai.ro/subprocessors) and deletes them after at most 90 days.

13Website analytics

codai.ro and hub.codai.ro count page views and a few steps of the sign-up funnel (pricing page viewed, sign-up started, account created, checkout started, first API key created) with Umami, an open-source analytics tool that we host ourselves on Google Cloud in the EU. No third party receives this data.

It is cookieless: no cookie is set and no identifier is stored in your browser. The page address is recorded without its query string or fragment. To tell visits apart, the tool combines your IP address and browser user-agent with a secret that changes regularly into a one-way hash; the raw IP address is not stored, only the approximate location derived from it (country, region, city), plus browser, operating system, device type, screen size, language and the referring website. If your browser sends the Do Not Track signal, nothing is collected.

Sign-up source: when you first open one of our sites, the browser keeps for that tab only (sessionStorage, deleted when the tab closes) the campaign tags of the link you came from (utm_source, utm_medium, utm_campaign) and the domain of the referring website. If you then create an account, this value is saved once on your account as its sign-up source, so we know which channels bring customers. It contains no identifier and is deleted with your account.

The legal basis is our legitimate interest in measuring and improving our websites and marketing in aggregate (Article 6(1)(f) GDPR); you can object at any time through the privacy contact in "Who we are", or simply turn on Do Not Track. Analytics records are kept for at most 13 months.

14Where your data goes

Our own infrastructure runs on Google Cloud in region europe-west1 (Belgium); your account, usage and session data are stored there. Prompts, outputs and tool results are sent for inference to Google Vertex AI (global endpoint, and Model Garden endpoints in us-west2) and Microsoft Azure AI Foundry (Sweden Central and East US 2), so they can be processed outside the EU; those transfers rely on the providers’ Standard Contractual Clauses and EU-US Data Privacy Framework certification. Business accounts on EU data residency, which we enable on request (there is no self-service setting yet), are the exception: their model inference runs only on Google Vertex AI in the EU (the eu multi-region or europe-west1). Transactional e-mail and fiscal invoices go through Brivio (EU). The same list is published at codai.ro/subprocessors, where changes are announced 30 days in advance.

Bring-your-own-key (BYOK): if you configure your own OpenAI, Anthropic, Google Gemini or OpenRouter key in an app, your prompts and outputs are sent directly from the app to that provider under that provider’s terms. codai is not a party to that processing. Some of these providers are in the United States; transfers rely on the provider’s Standard Contractual Clauses or EU-US Data Privacy Framework certification.

We do not sell personal data and we do not share it with advertisers or data brokers. We disclose data to authorities only when legally required.

15How long we keep it

• Account, API keys, devices and session events: for as long as your account exists. You can delete individual sessions and devices from the dashboard (hub.codai.ro) or in-app; deleting your account deletes them all.
• Per-request usage records and audit log entries: 30 days, then deleted automatically. The last user message stored with a usage record is truncated to 500 characters and erased after 7 days.
• Technical logs: 30 days.
• Studio share links, review comments, reviewer names and approvals: until the link owner deletes them, the creative or the account; deleting a creative removes them within 30 days.
• Links with other platforms (for example Brivio) and the app installations they create: until you unlink or uninstall; then the link record is deleted.
• Custom voices: voice sample ≤ 24 hours; voice profile until you delete it (or 12 months without use); consent recording and record for the life of the voice + 3 years.
• Database backups: daily backups kept for 7 days plus 7 days of point-in-time recovery logs, so deleted data disappears from backups within 8 days.
• Billing records: as long as Romanian tax and accounting law requires (currently 10 years for invoices).
• Local data on your phone or computer (encrypted settings, local session database, optional trace/debug files — kept in the app’s private storage on the Google Play build, and in Downloads/codai-nano/ only on developer/GitHub builds with tracing turned on): under your control; removed when you uninstall or delete them.

16Your rights

Under the GDPR you have the right to access your data, to have it rectified or erased, to receive it in a portable format, to restrict or object to processing based on legitimate interest, and to withdraw consent at any time without affecting past processing.

Most of this you can do yourself: sessions, devices and API keys can be deleted from the dashboard (hub.codai.ro) and the apps; your account can be deleted in the dashboard at hub.codai.ro (Settings → Data & privacy → Delete account; sign-in stops at once and your data is erased after a 7-day window; step-by-step at https://codai.ro/account/delete). For anything else, email [email protected] — we answer within one month.

You can lodge a complaint with the Romanian supervisory authority, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro, or with the authority of the EU country where you live.

17Security

API keys are stored only as hashes. Traffic is encrypted in transit (TLS). Data at rest is encrypted by Google Cloud. Access to production systems is limited to the controller. The apps store credentials in the platform’s encrypted storage (Android EncryptedSharedPreferences, OS keychain on desktop).

Report vulnerabilities to [email protected]. We will confirm receipt and keep you informed.

18Cookies

Our sites use only strictly necessary cookies and storage: sign-in session and security cookies (codai.ro console, hub, pay, auth.codai.ro), the language and theme you choose, the Cloudflare Turnstile bot check on sign-up, and the cookies Stripe sets on pay.codai.ro during checkout for fraud prevention. We do not use tracking, advertising or analytics cookies; the only analytics script is our self-hosted, cookieless Umami (see Website analytics), and referral links no longer set a cookie. Because every cookie we use is strictly necessary (Law 506/2004 art. 4(5)), no cookie banner is shown. The full inventory — name, purpose, lifetime — is in the Cookie Policy at codai.ro/cookies.

19Children

The Service is intended for people aged 18 or over. We do not knowingly process data of anyone under 18; if you believe we have, email [email protected] and we will delete it.

20Changes to this policy

We will notify you by email or in the dashboard at least 14 days before a material change takes effect. The version number and "Last updated" date at the top of this page identify the current text.