Privacy Policy

The person or entity operating the service under the unlimitedcodex brand is the data controller for personal data collected through the website, account, dashboard, support, and direct customer relationship. The contracting provider may also be identified in Stripe Checkout, invoices, or order communications. Privacy questions and data-rights requests may be sent through the contact form or to [email protected].

Payment processors, authentication providers, Telegram, and other third parties may act as separate controllers for data they collect under their own terms. We act as a processor only where a separate written data-processing agreement expressly establishes that role.

This Privacy Policy describes the general processing carried out for unlimitedcodex. It covers visitors, account holders, workspace members, customers, referral partners, support contacts, and people interacting with enabled Telegram features. It does not replace a shorter activity-specific notice shown when a form, checkout, marketing consent, or other collection activity requires separate information or consent.

A specific notice, consent text, data-processing agreement, or signed order form controls for the processing activity it expressly covers. Consent is requested separately where consent is the legal basis and may be withdrawn without affecting earlier lawful processing.

We collect information you provide when you register, configure a workspace, purchase a package, request a demo, contact support, use a referral program, or otherwise communicate with us.

When you use the website or API, systems may process IP address, request time, route, browser or client type, device and network signals, cookie or session identifiers, authentication result, API-key reference, endpoint, selected model, status code, latency, token counts, estimated cost, concurrency and rate-limit signals, and security events. Some network information may be processed transiently by our application, hosting provider, or network-protection provider without being stored in the main application database.

Standard API usage records are designed to store operational metadata such as endpoint, model, status, latency, token counts, and workspace or key references rather than prompt and response content. This does not apply to content you deliberately place in support tickets, contact messages, webhook payloads, or other features that store the submitted text.

API inputs and outputs must be processed and transmitted to provide the requested response. They may pass through infrastructure and upstream AI providers necessary for the selected model. Those providers may process technical data and content under contractual terms and applicable law. Do not submit data unless you have the required authority and the selected service path is suitable for it.

Do not submit payment-card data, passwords, private keys, authentication headers, health records, biometric data, government identifiers, children's data, criminal records, trade secrets, or other sensitive or regulated data unless a separate written agreement expressly permits that category and appropriate safeguards are in place.

We obtain data directly from you, workspace owners and administrators, your browser or API client, authentication providers you choose, Stripe and payment events, referral links, enabled Telegram interactions, support communications, and infrastructure or security providers. We may also receive lawful fraud, sanctions, abuse, or dispute information from payment providers, authorities, or affected parties.

We process account, workspace, API, support, and billing data to create and perform the service contract; authenticate users; deliver access; manage subscriptions; provide support; and take requested pre-contract steps. We process records needed for invoices, taxes, accounting, regulatory requests, and lawful authority demands to comply with legal obligations.

We process proportionate usage, security, referral, and operational data for legitimate interests in securing accounts, preventing fraud and abuse, enforcing package boundaries, protecting shared capacity, diagnosing failures, maintaining evidence, improving reliability, and establishing, exercising, or defending legal claims. We use consent where required for optional marketing, non-essential tracking, or a transfer that cannot rely on another lawful mechanism. Where Turkish data-protection law applies, processing relies on the applicable conditions under Law No. 6698; where another regime applies, the equivalent lawful basis is used.

Accounts may use password authentication or enabled third-party sign-in providers such as Google or GitHub. We process provider account identifiers, tokens, scopes, verification data, and session records needed to complete sign-in and protect the account. Third-party sign-in is governed by the provider's privacy terms. Session cookies and security tokens are necessary to keep users signed in, continue intended navigation, prevent forgery, and enforce access controls.

Stripe hosts checkout and the customer billing portal and processes card and payment data. We receive limited customer, subscription, invoice, charge, refund, dispute, and payment-status references needed to provision service, reconcile accounts, provide invoices, recover failed payments, prevent fraud, calculate referrals, and meet accounting duties. Stripe may act as an independent controller or processor depending on the activity. Review Stripe's own privacy information before payment.

We use essential cookies or local storage for authentication, locale selection, security, referral attribution, return paths, and remembering dismissed interface elements. Essential technology is used because the site or requested feature cannot operate reliably without it. Optional analytics or marketing technology, if enabled, is handled according to applicable consent requirements.

Browser settings can remove or block storage, but doing so may sign you out, lose preferences, break referral attribution, or prevent protected features from working.

Client-side forms may place lightweight event names and non-sensitive interaction context into a first-party data layer. The application is designed not to place names, email addresses, company names, prompts, passwords, tokens, secrets, or API keys in those browser events. A separate first-party conversion record may store an opaque local identifier, event classification, package, cadence, amount, currency, billing reason, renewal flag, timestamp, and source when a verified Stripe invoice is paid.

No statement in this policy means every optional analytics or advertising destination is active. If a new external destination is enabled, we will evaluate consent, notice, data minimization, and transfer requirements before sending personal data.

We send transactional messages necessary for registration, security, password reset, payment, provisioning, delivery, renewal, failed-payment recovery, maintenance, and material service notices. These messages are part of operating the account and are not disabled by a marketing opt-out.

Promotional email is sent only where permitted. Marketing messages include an unsubscribe mechanism, and suppression records are retained so the opt-out can be honored. You may still receive essential service and legal notices after unsubscribing from marketing. Email delivery providers process sender, recipient, content, delivery status, and technical metadata.

Referral links may process the campaign code, program version, immutable rate and terms snapshots, click time, destination, referring host, locale, claim expiry, and keyed one-way fingerprints of limited network, browser, or device signals for thirty-day attribution, rate limiting, replay prevention, and abuse review. The application is designed not to retain raw IP address or raw user-agent in the referral click, claim, attribution, or terms-acceptance record. Security HMACs are limited signals and are not displayed to referral partners.

We retain campaign status and audit history; click, claim, and attribution records; the invited account's eligibility and masked identifier; successful invoice and subscription references; standard price, discount, commission, tax-exclusion, hold, availability, reversal, negative-balance, package-credit, and payout allocation records; and the evidence needed to prevent double spending. Financial and audit records are append-only or archived rather than deleted where needed for accounting, disputes, fraud prevention, legal claims, and preservation of legacy V1 snapshots.

For the level system, we process the participant's current and highest level, the number of distinct qualified active paid referrals, calculation and grace-period timestamps, level-change events, campaign eligibility, and disqualification reasons. The count is recalculated from subscription, invoice, refund, dispute, account-status, payment-source, and risk state so lifetime clicks or inactive accounts do not incorrectly increase an incentive limit.

For manual Bank or Wise payouts, we process the participant's legal name, country, selected method, and payment instructions. These fields are encrypted using AES-256-GCM with a production-managed key kept separately from the database, and the dashboard displays only a masked summary. Authorized staff may access the decrypted information only for identity, tax, sanctions, fraud, accounting, payout, or legal review. Raw identity-document copies are not intended to be stored in the application or sent through Telegram.

Referral partners receive only campaign analytics and information reasonably needed to understand attribution and earnings, such as aggregated clicks and conversions and masked invited-customer identifiers. Campaign names are private operational labels shown only to the participant and authorized administrators and are not sent to product analytics. The invited customer is not shown the participant's name or email by default.

Risk controls may compare account, email, workspace, Stripe customer, payment-instrument fingerprint, verified identity, country, network, device, velocity, disposable-email, and multi-account signals. Where supported by the payment provider, a payment-instrument fingerprint is normalized and transformed with a keyed one-way HMAC before storage; the application does not need the card number or security code for this comparison. Same account, controlled identity, payment instrument, or verified self-referral may be blocked. Shared IP address or device information alone is treated as a review signal rather than conclusive proof. Material payout decisions may be reviewed by authorized personnel.

Referral data is disclosed to Stripe where necessary to apply a server-side coupon and verify checkout, subscription, invoice, refund, or dispute state; to Bank or Wise and banking intermediaries when a cash payout is approved; and to professional advisers or authorities where required for tax, accounting, sanctions, fraud, claims, or law. We do not expose payout details in public links, analytics events, email marketing, or Telegram alerts.

Private administrator alerts may send limited events such as registration, paid package, renewal, payment failure, refund, and referral commission through a secured Telegram bot. Customer email addresses are masked. Payment-card details, full API keys, raw IP addresses, raw user-agents, passwords, and provider secrets are not intentionally sent in these alerts.

When a group or channel administrator explicitly activates a publishing bot, we store identifiers, public chat details, approval state, policy, campaign, and delivery results needed to operate it. Privacy mode is used where configured; the service does not intentionally archive general group conversations or member lists. Public assistants process commands or allowed mentions needed to return fixed product and support content and retain minimized hashes and delivery records for rate limiting, replay protection, and abuse control. A group or channel administrator may pause or revoke publishing at any time. Telegram independently processes interactions under its own terms. Never send secrets to a bot.

We disclose personal data only as reasonably necessary for the stated purposes, subject to contracts and access controls where appropriate. Recipient categories may include hosting and database providers, network and security providers such as Cloudflare, payment providers such as Stripe, email providers such as Resend, authentication providers such as Google or GitHub when selected, Telegram for enabled bot interactions, upstream AI infrastructure needed to answer API requests, professional advisers, auditors, insurers, acquirers in a lawful business transaction, and public authorities where legally required.

Workspace owners and authorized members can access workspace data according to their roles. We do not sell personal data for money. We do not disclose personal data to unrelated parties for their independent direct marketing without a lawful basis and required consent.

Some providers, infrastructure, support channels, or upstream services may process data outside your country, including countries with different data-protection laws. Where transfer restrictions apply, we use an available lawful mechanism such as an adequacy decision, approved contractual safeguards, binding rules, a statutory exception, or explicit consent when that is the appropriate basis.

A transfer mechanism does not eliminate operational risk. We minimize transferred fields, restrict access, and avoid placing secrets in optional channels. Contact us if you need available information about the categories of transfer safeguards relevant to your account.

We keep personal data only for as long as reasonably necessary for the purpose collected, the active customer relationship, security, reconciliation, backup cycles, dispute limitation periods, and legal duties. Retention is determined by record type, sensitivity, account status, fraud risk, contractual need, and applicable tax, accounting, payment, consumer, and data-protection rules.

Account and workspace records generally remain while the account is active and for a reasonable period afterward. Billing, invoice, dispute, referral, and audit records may be retained longer where required for financial obligations or legal claims. Security and usage records are kept for operational and evidentiary needs and may be aggregated or de-identified. Marketing suppression records may be retained to honor opt-outs. Expired sessions and reset tokens may be removed on shorter technical schedules. Deletion from backups may occur during normal rotation rather than immediately.

We use measures appropriate to the service and data, including access control, scoped roles, password hashing, hashed or encrypted credential records where applicable, key prefixes instead of full-key display, TLS, input validation, rate limits, audit trails, secret filtering, signed payment webhooks, environment separation, least-privilege administration, and operational monitoring. Manually delivered credentials are sent through the designated delivery path, and self-service keys should be copied when shown and then stored securely by the user.

No system is completely secure. You are responsible for protecting your devices, email account, workspace members, and API keys. Notify support immediately if you suspect unauthorized access. We may rotate credentials, revoke sessions, restrict access, or preserve evidence while investigating.

We investigate suspected personal-data incidents and take reasonable containment, remediation, and documentation steps. Where applicable law requires notice to a regulator, affected person, processor, or business customer, we provide that notice within the required conditions and timeframe. You must promptly provide accurate information and cooperation when an incident may involve your credentials, systems, workspace, or submitted data.

Depending on applicable law, you may have rights to learn whether data is processed, request access or a copy, understand purposes and recipients, correct inaccurate or incomplete data, request deletion or restriction, object to certain processing, withdraw consent, request portability, complain to a competent authority, and seek review of qualifying automated decisions. Turkish data subjects may exercise applicable rights under Article 11 of Law No. 6698.

Send requests through the contact form or [email protected]. Describe the right, account email, and relevant context without sending passwords or API keys. We may verify identity and authority, ask for clarification, refuse or limit requests where law permits, and retain data needed for legal obligations, fraud prevention, security, disputes, or the rights of others. We will respond within the legally applicable period.

Account deletion does not necessarily erase every record immediately. We may retain invoices, payment and tax evidence, fraud and security records, consent or suppression evidence, dispute files, audit trails, and records needed to establish, exercise, or defend claims. Data associated with other workspace members or a business customer may remain under that customer's instructions. Where full deletion is not required, we may restrict, minimize, de-identify, or isolate the record.

Automated systems may authenticate requests, enforce scopes and allowlists, apply rate limits, identify payment state, detect retry storms, prevent referral duplication, or flag suspected abuse. These controls can temporarily deny or limit service. We do not intend to make decisions producing legal or similarly significant effects solely through automated profiling where applicable law grants a right to human review. Contact support if you believe a material restriction was incorrect.

The service is not intended for children or people who lack legal capacity to enter the service agreement. We do not knowingly solicit children's personal data. If you believe a child provided data without valid authorization, contact us so we can investigate and take legally appropriate action.

We may update this policy when services, providers, security practices, or law change. The page shows the latest update date. If a change materially affects how existing personal data is used, we will provide additional notice or request consent where required. Earlier versions may be retained for audit and dispute purposes.

For privacy questions, rights requests, or complaints, use the website contact form or email [email protected]. Include enough information to identify the relevant account or interaction, but never send a password, full API key, authorization header, payment-card number, or unnecessary personal data. You may also complain to the competent data-protection authority, including the Turkish Personal Data Protection Authority where Law No. 6698 applies.