Your code is yoursΩ

We are the controller for your account, authentication, billing, per-request usage metadata, site data, crash reports, feedback, and stored background-agent/batch text — this policy is the notice for that data. We act as a processor for the content you submit to run a request (your prompts and code): there, you are the controller, and we process on your instructions under our Data Processing Addendum. Contact us at [email protected]. We have not appointed a DPO — our core activity is not large-scale regular and systematic monitoring of data subjects or large-scale processing of special-category data, so the GDPR Art. 37 obligation does not apply — and as an EU-established controller we need no Art. 27 representative. Full controller identity and address: § 15 Contact.

• You own your code. We don’t train on it, and we don’t sell your personal data.
• To answer you, the content you submit is sent to third-party AI model providers to generate a response.
• For interactive chat we keep only per-request metadata — but background/cloud agents, batch jobs, feedback, and crash reports do store the text you submit, so they can work.
• Application data at rest is in the EU (Germany); some providers operate in the US/globally under safeguards.
• Strictly-necessary cookies only; analytics are server-side and cookieless. You have full GDPR rights.

• Account & identity — email; display name (via our authentication provider).
• Billing — billing address, country, VAT ID, a payment token, transaction history. Your full card details are handled by our payment provider and never reach Omega’s servers.
• Content you submit — prompts, code, selections, images you send to the assistant (see the next section).
• Usage & telemetry — per-request metadata: model used, token counts, cost, latency, cache flags, error codes. No interactive-chat content is stored — only this metadata.
• Technical — IP address, approximate location/country, device/user-agent, sign-up IP.
• Support & diagnostics — feedback you send; crash reports.

From others (Art. 14): we may receive a fraud/abuse risk indicator relating to your payment from our payment provider, used to prevent fraud and abuse (see automated decisions). Is it required? Providing your account, billing, and the content you submit is necessary to enter into and perform the contract — to create an account, bill you, and run your requests — and without it we cannot supply the Service.

In transit, by necessity. To generate a response, the content you submit is sent to third-party AI model providers, most based in the United States. They are independent providers governed by their own terms, which we do not control.

• Not stored for interactive chat — we keep only the usage metadata above, not the text of your prompts or the model’s replies.
• Not used to train. We do not train our own models on your code or prompts. We access every provider through its commercial API, and the API terms of each provider we route to (Anthropic, OpenAI, Google, xAI) state that customer API content is not used to train their models. If a provider changes that position, we will stop routing to it or tell you before we do.
• Where content is stored (we don’t claim to store nothing): background/cloud agents store the task prompt and repo reference for the job; batch jobs store prompts until the batch completes; feedback and crash reports contain what you submit.
• BYOK routes requests with your own key under that provider’s terms; local models keep content on your machine.

Please don’t submit special categories of personal data (Art. 9 — health, biometric, political, religious, etc.) in prompts. Where such data appears in customer content, we process it only as a processor on your instructions, and you, as controller, are responsible for a valid Art. 9(2) condition.

• Contract (Art. 6(1)(b)) — creating and operating your account, authenticating you, delivering the IDE, and running your requests as the contracted service; and charging for the Service.
• Legal obligation (Art. 6(1)(c)) — keeping invoices and accounting records for tax (Bulgarian accounting/tax law).
• Legitimate interests (Art. 6(1)(f)) — keeping the Service secure and reliable, preventing fraud and abuse, and measuring/improving performance using metadata. Those are the specific interests we pursue.

Where we rely on legitimate interests, you may object (see your rights). We do not rely on consent for the core Service, and our analytics are cookieless and server-side.

We disclose data to categories of recipient — we do not name vendors here; the current named list is at /subprocessors:

• AI model providers — to process your submitted content and generate responses.
• Payment & tax provider; authentication provider; hosting/infrastructure provider (EU data at rest).
• Analytics, logging & monitoring (server-side, cookieless); email; encrypted backups; CDN/DNS/security.
• Source-hosting / code-review provider — only if you use the optional pull-request review integration.
• Authorities or advisers where required by law or to defend legal claims.

We do not sell your personal data.

Application data at rest is in the EU (Germany). Some recipients (AI model providers, authentication, email, CDN) operate in the US or globally, so using the Service involves transfers outside the EU/EEA. We make those transfers only under a Chapter V mechanism: adequacy where available (for example, recipients certified under the EU–U.S. Data Privacy Framework, to the extent covered), and otherwise appropriate safeguards — in particular the European Commission’s Standard Contractual Clauses. You can request a copy of the safeguards we rely on by emailing [email protected].

• Billing & tax records — 10 years, as required by Bulgarian accounting and VAT law (payroll records, where applicable, 50 years). This includes invoices and the per-request usage records that evidence what we charged you.
• Account data — for the life of your account. Delete your account from the dashboard and it is deleted/anonymised immediately; if we terminate an account under the Terms, we apply the same deletion. Records the law requires us to keep (see above) are the only exception.
• Usage & telemetry metadata (model used, token counts, cost, latency, error codes — never prompt or code content) — kept with our billing records above, because it is the evidence behind every charge.
• Crash reports — 12 months. Feedback you send us — 24 months. Both are then deleted automatically.
• Operational logs — rotated automatically and kept at most 90 days.
• Interactive chat content — not retained. Background-agent / batch prompts — until the job completes (content is scrubbed within 24 hours of the job finishing; stuck or abandoned jobs are purged within 7–30 days).

Over data for which we are the controller, you have the rights to access (Art. 15, including transfer/safeguard information), rectification (16), erasure (17 — qualified, as we may keep records the law requires or that we need to defend legal claims), restriction (18), objection to legitimate-interests processing (21), portability (20), withdrawal of consent where consent applies, and not to be subject to a solely-automated decision (22 — see below). For content we process as a processor, we route or assist your request to the controller.

To exercise a right, email [email protected]. We respond without undue delay and within one month (extendable by two further months for complex requests, with notice), free unless a request is manifestly unfounded or excessive. You can also delete your account yourself from the dashboard (Settings): your account record is erased or anonymised without undue delay, active subscriptions are cancelled, and sign-in is revoked — except records we are legally required to keep, such as billing and tax records (Art. 17(3)(b)).

To protect the Service against fraud and abuse, an automated fraud/abuse risk signal — including one received from our payment provider — can trigger an automatic suspension of your account before a person reviews it. This is a solely-automated decision that may significantly affect you (temporary loss of access). Its legal basis is that it is necessary to perform and protect our contract with you (Art. 22(2)(a)).

You have the right to obtain human intervention, express your point of view, and contest the decision (Art. 22(3)) — a suspension is reviewed by a person with authority to reinstate your account; contact [email protected]. We do not publish the detection criteria, and this measure does not target children or use special-category data.

We set only strictly-necessary cookies (to keep you signed in and remember that you passed the preview access gate). No advertising, retargeting, or cross-site tracking cookies; analytics are server-side and cookieless. Full detail is in the Cookie Policy.

We protect personal data with encryption in transit and at rest for sensitive material, access controls and least-privilege internal access, and EU hosting (Germany) for application data at rest. We run a vulnerability-disclosure programme. We describe our security posture at a general level only.

The Service is not directed to children under 16, and we do not knowingly collect their data. This 16+ bar is a deliberate, conservative choice: it sits above Bulgaria’s national floor of 14 for a child’s own consent to information-society services (ЗЗЛД Art. 25c; the GDPR Art. 8 default is 16) — so 16 is our own stricter bar, not the Bulgarian statutory minimum. The automated measure above does not target children.

We may update this policy — we’ll post the new “last updated” date and flag material changes. If we intend to process your data for a new purpose, we will tell you before we do so.

Controller: OmegaHQ Ltd, VAT BG208869476 — 29 Golyamokonarsko Shose Blvd, Tsaratsovo 4204, Maritsa Municipality, Plovdiv Province, Bulgaria — [email protected]. You may complain to the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни, КЗЛД) — Sofia 1592, bul. “Prof. Tsvetan Lazarov” No. 2; [email protected]; cpdp.bg — or to your local supervisory authority or the courts (GDPR Art. 77; ЗЗЛД Art. 38).