PureCode AI

GDPR overview

There is no GDPR implementation to report. A search across every page and document collected returns zero occurrences of "GDPR" or "General Data Protection". No privacy policy is published either: the footer prints the words "Privacy Policy" as plain text, without a link, on every page, and no privacy URL exists anywhere on the site. There is no data processing agreement, no subprocessor list, no Article 27 EU representative, no named DPO and no data protection contact address. PureCode Software Inc. is a US company with no declared EU presence. The enterprise page claims compliance with SOC 2 and HIPAA, but publishes no report, no certificate and no trust center. The only substantive security material is a June 2025 documentation page describing end-to-end encryption, local processing and the absence of cloud storage.

Who owns the data?

The Terms of Service state that, as between you and PureCode, you own the Generated Code, and PureCode assigns its rights in it to you - subject to any rights other users of the product may hold in the same Generated Code. The same terms warn that outputs can be identical for several users and that, by using the solution, you consent to other users being able to view your Generated Code and the image tiles attached to your generations. PureCode keeps every right in the product itself, and any feedback you send becomes PureCode's property worldwide. The security documentation adds that you retain full ownership of your own code and intellectual property. The Free Plan produces public generations; Premium adds private ones.

Reuse rights

You can reuse the Generated Code freely, including commercially, without asking permission: PureCode assigns its rights in that output to you, with no attribution requirement, the only caveat being that other users may hold rights in identical output. What the provider does with your data is another matter, and the site leaves a contradiction unresolved. Section 4 of the Terms of Service grants PureCode an irrevocable right to use, analyze and process your prompts, queries and any other input content in order to train, enhance and improve its products and services, indefinitely, even after your subscription ends. The security documentation, updated in June 2025, says the opposite about code: nothing is stored or processed remotely, proprietary code does not touch the LLMs and is not used for training, and the marketing pages promise zero data retention and no training on your code. Neither source is presented as overriding the other. You can narrow what is indexed with global instructions and a .purecodeignore file, but no training opt-out mechanism is documented.

Data retention & training

Hosting summary

No hosting country or region is declared anywhere on the site or in the documentation. What PureCode states is a principle rather than a location: code is processed inside the developer's own environment, is never stored or processed remotely, and by default none of your data is sent to the cloud. End-to-end encryption is claimed at rest and in transit, and the vendor says only an encrypted payload ever reaches the model. Enterprise customers choose their own topology - public cloud, VPC, on-premises or fully air-gapped, including a private cloud on AWS or Azure and hybrid setups - so the hosting jurisdiction is effectively decided by the customer rather than disclosed by the vendor. Two technical observations, not vendor claims, are worth noting: purecode.ai resolves to 34.41.6.5, an address in Google LLC's AS396982 in Council Bluffs, United States, and component images are served from an Azure blob. No subprocessor list is published, so the third parties involved in the service cannot be identified.