Skip to content
idiacode
Français

Version 2.3.0, effective 5 November 2026

Privacy policy

Information only. This document is an English translation of the French version, provided for information only. The French version is the only binding version.

This document takes effect on the date it is put online at www.idiacode.com.

This policy informs the persons whose personal data is processed in connection with the idiacode service, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

1. Controller

The controller is the company TEKKENGREG, SAS, whose registered office is located at 12 Rue de la Part Dieu, 69003 Lyon, France, identified in the legal notice.

Contact: contact@tekkengreg.com, or by post to the registered office.

2. Data protection officer

No data protection officer has been appointed. Questions about personal data are to be sent to contact@tekkengreg.com, or by post to the registered office.

3. Data processed

  • Account: email address; date on which the email address was verified; password, stored as a hash; dates of creation, update and deletion of the account; name, if it is filled in in the account (it is not requested at sign-up). No IP address is recorded by the website with the account.
  • Emails sent by the website: the recipient email address, that of the account or, during a change of address, the new address; for each link sent, its hash, never the link itself (EG-DATA-06), its use, the address concerned, including a new address awaiting confirmation, and its dates of issue and expiry; the dates on which the emails were sent (EG-DATA-07).
  • Subscription: identifiers assigned by the payment provider (customer, subscription, price, product), offer subscribed to, status and dates of the subscription. Neither amount nor payment method. Identifier and type of the payment events received by the website.
  • Browser: the session cookie and the language cookie (see section 9). On an address of the website without a language prefix, the preferred language declared by the browser (Accept-Language header) is read to choose the language of the page, without being stored by the website (see section 9).
  • Payment: the website sends the payment provider the email address and the identifier of the account. The payment provider itself collects, on its own pages, the payment method, the billing address and, where applicable, a tax number. This data does not pass through the website.
  • Access key: one key per account, issued from the dashboard, with or without a subscription. An account that does not yet have an access key only obtains one of the Free offer if its email address is verified (EG-ACCT-02). The key follows the offer of the account: that of the subscription as long as it is active or its payment is being retried, the Free offer otherwise. The website stores, for each account, the link with its access key: the identifier of the key, as a hash, the date of its creation and, where applicable, the date on which it was displayed to the user. The language model access point attaches the access key, the usage budget, the cumulative usage of the month, the usage of the period of the 5-hour session limit and the usage of the week of the weekly limit to a technical identifier of the account, without email address or name. The website reads these usages again from the language model access point, by this technical identifier, each time the Usage page of the dashboard is displayed, to show the user of the account, for each limit, the share used, its state and, where applicable, its reset time.
  • Use of the language models: the access key; the content of the requests and of the responses, sent to the language model provider, without being stored by the idiacode language model access point (EG-DATA-01); usage metadata: access key as a hash, model used, volume consumed, timestamps, status of the request, IP address of the request as seen by the language model access point, and the name and version of the client software as declared by the request (User-Agent header).
  • Visits to download.idiacode.com and docs.idiacode.com: these addresses make available to everyone, without an account, the idiacode desktop application, the update information that this application consults there once installed, and the documentation of the service. When they are visited, the IP address and the technical data of the request, such as the address requested, may appear in the technical logs of the service.
  • Technical logs: the IP address may appear in the technical logs of the service.

The email address and the password are necessary to create the account: without them, the account cannot be created. The payment data is necessary to subscribe to a paid offer.

4. Purposes and legal bases

The data is processed for the following purposes, each based on the performance of the contract concluded with the user (Article 6(1)(b) of the GDPR):

  1. create and manage the account; verify that the user controls the email address of their account, a condition for subscribing to a paid offer (EG-ACCT-01) and for obtaining a first access key of the Free offer (EG-ACCT-02); confirm a new address by a link sent to that address, before it replaces the old one; allow the password to be reset; limit how often emails are sent; allow the user to subscribe to an offer, to change it and to cancel it; keep the state of the subscription up to date from the events sent by the payment provider;
  2. create and manage the access key of each account, according to the offer subscribed to as long as the subscription is active or its payment is being retried, according to the Free offer otherwise, and apply its monthly usage budget, its 5-hour session limit and its weekly limit; allow the user to track their usage against these limits;
  3. send the user's requests to the language models, return the responses to the user and count the usage against their access key.

The data of visits to download.idiacode.com and docs.idiacode.com (section 3) is processed to serve their readers the desktop application, its update information and the documentation, and to ensure the security of these addresses. This processing is based on the legitimate interest of TEKKENGREG (Article 6(1)(f) of the GDPR): serving this public content, visited without an account, and securing the service.

The technical logs are attached to the processing operations above, visits to download.idiacode.com and docs.idiacode.com included, and to them alone.

5. Recipients

The data is disclosed to the following categories of recipients:

  • host: Scaleway SAS, which hosts the infrastructure of the service;
  • email delivery provider: Scaleway SAS, through its transactional email service, which delivers the emails sent by the website. It receives the recipient address, the subject and the content of the email, link included (EG-NET-02);
  • language model provider: provider that runs the language models to which the service sends the user's requests. It receives the content of the requests and produces the responses that are returned to the user;
  • payment provider: Stripe, which handles the subscription, the payment, the change of offer and the cancellation of the subscription. It receives the email address of the account, and itself collects, on its own pages, the payment data entered by the user.

6. Transfers outside the European Union

The service is hosted in the European Union, in France, by Scaleway SAS. The user's requests are sent, for running the language models, to the language model provider. The place where they are run, and whether or not a transfer outside the European Union takes place on that occasion, are not yet established by documented proof: this policy does not guarantee them. The emails are sent from the Paris region of the email delivery provider (EG-NET-02), which states that it processes them in France: sending them does not involve any transfer outside the European Union. Payment may involve a transfer, described below.

Transfer related to payment

Stripe acts as a processor for the payments it handles on behalf of TEKKENGREG. The responsible Stripe entity depends on the jurisdiction. Data may be transferred outside the European Union, in particular to the United States. These transfers are governed by the standard contractual clauses adopted by the European Commission and by the EU–US Data Privacy Framework, which was the subject of an adequacy decision of the European Commission of 10 July 2023. For more information, see Stripe's privacy policy: https://stripe.com/fr/privacy. A copy of the safeguards governing these transfers may be requested at contact@tekkengreg.com.

7. Retention periods

  • Account: as long as it exists. The date on which the address was verified is kept as long as the account exists; it is replaced when a new address is confirmed. When the user deletes the account, the email address, the name, the password hash and the date on which the address was verified are erased; the links sent by email, pending address included, the dates on which the emails were sent and the recorded subscription are deleted (EG-DATA-05). A technical identifier and the dates of creation, update and deletion of the account are kept, without any identity data.
  • Links sent by email: until they are used or replaced by a new link, otherwise at least until they expire, that is 24 hours, or 1 hour for the password reset. Beyond that, they are deleted when the next link is sent or used (EG-DATA-06).
  • Dates on which the emails were sent: at least 1 hour. Beyond that, they are deleted when the next link is sent (EG-DATA-07).
  • Subscription: as long as the account exists.
  • Identifiers of the payment events: at least 30 days. Beyond that, they are deleted when a following subscription event is processed (EG-DATA-04).
  • Session cookie: 1 day, renewed at each visit.
  • Language cookie: 365 days from the choice of the language by the user, without automatic renewal; a new choice replaces it.
  • Language declared by the browser: not stored by the website.
  • Content of the requests and of the responses: not stored by the idiacode language model access point (EG-DATA-01); for the language model provider, see below.
  • Usage metadata of the language models recorded for each request, IP address included: deleted beyond 90 days (EG-DATA-02). The other usage metadata that the database of the language model access point may keep, such as usage totals or the trace of a request in error, do not yet have a set retention period; no automatic deletion is in place yet.
  • Usage counters of the limits: the counters of the usage per period of the session limit and per week of the weekly limit, attached to the technical identifier of the account, and the counter of the usage per declared client software expire, in the shared memory of the language model access point, at most 8 days after their last update, including after the deletion of the account. The record of the usage per limit kept in the database of the language model access point does not yet have a set retention period; no automatic deletion is in place yet.
  • Access key, link between the account and its key, budget and cumulative usage: as long as the account exists; no automatic deletion is in place yet. At the end of the subscription, the access key is kept and moves to the Free offer. A key replaced by the user is revoked.
  • Technical logs: their retention period is not yet set by a documented rule of the service; this policy does not guarantee any.
  • Database backups: daily, kept for 7 days.
  • Data held by the language model provider: the provider receives the content of the requests and produces the responses. Their retention on its side is not yet established by documented proof; this policy does not guarantee that they are not retained.
  • Data held by the email delivery provider: according to its documentation, the content of the email is deleted after its delivery or its permanent rejection, otherwise after 36 hours of temporary failures, 72 hours if it is classified as spam, 15 days if the sending domain is blocked, and its encrypted backups are kept for 7 days; the sending metadata (recipient address, subject, status, timestamps) are kept by the provider as long as the idiacode sending domain is active with it.
  • Data held by Stripe: according to its own privacy policy (https://stripe.com/fr/privacy).

8. Security

The following measures are in place:

  • connections to the website and to the language model access point are encrypted (HTTPS);
  • the password is stored as a hash (bcrypt), never in clear text;
  • the session cookie is signed, inaccessible to the scripts of the page and sent over HTTPS only;
  • the databases are on a private network, without public access, encrypted at rest, and their connections are encrypted;
  • the databases of the website and of the language model access point are separate, without cross access;
  • the secrets of the service are kept outside the software images;
  • the authenticity of the events received from the payment provider is verified by their signature;
  • the links sent by email are single-use and time-limited, and only their hash is stored (EG-DATA-06);
  • the password reset request receives the same response, whether or not an account matches the address entered (EG-SEC-01).

9. Trackers

The website sets two cookies, both exempt from consent (Article 82 of French Law No. 78-17 of 6 January 1978):

  • session, necessary for authentication. It carries the identifier of the account, it is signed and valid for 1 day, renewed at each visit. It is strictly necessary for the service requested by the user.
  • lang, which remembers the display language chosen by the user by means of the website's language selector. It carries only that language, fr or en, without any identifier. It is only set when the user chooses a language, and it is valid for 365 days, without automatic renewal. It is only used to open the website in that language when the user follows an address without a language prefix.

Without a language cookie, on an address without a language prefix, the website opens the page in whichever of the two languages, French or English, the browser prefers according to the Accept-Language header, and in English if it asks for neither. This header is read without being stored by the website. The website loads no third-party script and no other tracker.

The emails sent by the website contain no image, no remote resource and no tracking link; their only link leads directly to the website (EG-TRACE-01). According to its documentation, the email delivery provider adds no tracking pixel to them and does not rewrite the links.

This paragraph does not cover the payment and subscription management pages hosted by Stripe, to which the website redirects the user.

10. Automated decision

The service carries out no profiling. The use of the language models is limited automatically by the 5-hour session limit, the weekly limit and the monthly usage budget associated with the access key: a request beyond one of these limits is refused. The access key automatically moves to the Free offer when the subscription ends or is no longer active, except while a payment is being retried, and to the offer subscribed to by a new subscription.

11. Your rights

You have, under the conditions provided for by the GDPR:

  • a right of access to your data;
  • a right to rectification;
  • a right to erasure;
  • a right to restriction of processing;
  • a right to object;
  • a right to portability of your data;
  • where the processing is based on your consent, the right to withdraw it at any time, without affecting the lawfulness of the processing based on consent carried out before its withdrawal.

These rights are exercised at the address contact@tekkengreg.com, or by post to the registered office.

You also have the right to lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés).