1 Who is responsible for your data?
| Role | Information |
|---|---|
| Controller | Codebite Oy Business ID 3135024-9 (VAT FI31350249) Tyynylaavankuja 2 B35, Helsinki, Finland |
| Privacy contact | contact@codebite.fi |
2 What we collect and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Your account | Name, e-mail, hashed password and organisation, or your GitHub username and e-mail if you sign in with GitHub. E-mail addresses of people you invite to your team. | Contract (Art 6 (1)(b)) | Account lifetime + 30 days |
| Billing | Transaction ID, cardholder name, billing address (held by our payment processor) | Contract (1)(b) & legal obligation (1)(c) | 6 years |
| Security | Logs of requests to the platform and your apps (IP address, user agent, request path, timestamp), including where you sign in from | Legitimate interest (1)(f) in keeping the Service secure | 7 days; audit logs 60 days. Data about malicious activity may be kept longer to block repeat attacks. |
| Support | Your e-mails to us | Legitimate interest (1)(f) | 24 months |
| Your apps, databases & build output | Code, configuration and data you deploy, and what we generate from it for you (container images, build logs, SBOMs) | We act as your processor (Art 28); you are the controller of personal data in your apps and databases | Current image + 30 days; database backups 7 days; deleted 30 days after your account ends |
We do not use analytics or tracking. GitHub, Slack and Discord, if you connect them, are your own providers and process data under their own terms.
3 Where your data is stored and who receives it
Your data is hosted in the European Economic Area, in Finland. We share it only with the service providers we need to run Apply.Build (hosting, e-mail delivery and payments), listed with their locations and transfer safeguards on our Sub-processors page. Transfers outside the EEA are protected by the EU's Standard Contractual Clauses.
4 Security
Each app runs in its own isolated micro-VM behind a web application firewall. Data is encrypted in transit and at rest, and the platform is continuously monitored.
5 Cookies
We only use cookies needed for the dashboard to work (your login session and sidebar preference). No advertising or analytics cookies.
6 Your GDPR rights
You have the right to access, rectify, erase and port your personal data, restrict or object to processing, and lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi). Requests: e-mail contact@codebite.fi - we respond within 30 days.
7 Automated decision-making
We do not perform automated decision-making that produces legal or similarly significant effects.
8 Changes to this Policy
We will notify you of significant changes to this Policy by e-mail or in the dashboard.