Qodo

GDPR overview

GDPR implementation is contractual rather than declarative. Qodo publishes a dedicated Data Processing Addendum stating that, with effect from 25 May 2018, it processes personal data in accordance with the GDPR requirements directly applicable to its activities. The DPA incorporates the EU Standard Contractual Clauses of implementing decision 2021/914, Module Two (controller to processor) and Module Three (processor to processor), under Irish law and Irish courts, plus a separate UK GDPR track under Article 46 and the Data Protection Act 2018. Breaches are notified within 72 hours at most, and customers may audit once a year at their own cost with 30 days' notice. The privacy policy, revised on 20 February 2025, sets out access, rectification, erasure, restriction, objection and portability rights, exercised through info@qodo.ai, with separate CCPA commitments not to sell or share personal data. No Article 27 EU representative is named anywhere on the site.

Who owns the data?

Section 4.3 of the Terms of Service leaves every intellectual property right in Customer Data with the customer or its licensors, covering what you provide and what Qodo pulls from your account. Section 4.1 goes further: Qodo relinquishes any right it might hold in the Output the platform generates and assigns it to the customer. Two carve-outs matter. Usage Data and Aggregated Data stay with Qodo, which may publish them anonymized provided no customer is identified, and section 4.6 makes any feedback you send Qodo's property outright. Under the DPA the customer is controller and Qodo processor; the Trust Center states that all customer data is treated as confidential, with restricted and authorized access.

Reuse rights

Because the Output is assigned to the customer, you can reuse, ship and commercialize what Qodo produces without asking anyone's permission. What Qodo does with your code is where the published record contradicts itself, and both sides deserve to be read. The home page promises zero data retention: code is analyzed and discarded, with nothing stored, logged or used to train models. The pricing FAQ answers the training question with a flat no, adding that your code is used only to generate reviews for your team. Section 4.4 of the Terms of Service says something else: the customer grants Qodo and its affiliates a non-exclusive, royalty-free, worldwide license, limited to the duration of the engagement, to use all Customer Data both to deliver the service and to train and improve the platform, the Qodo Models and the services, and to develop new products. Nothing published on the site reconciles the two. Around that core, the Trust Center notes that IDE extensions extract minimal code snippets and send a representation of them to the backend to generate tests and suggestions, and that a zero-retention agreement is in place with OpenAI for paying customers. The privacy policy separately allows personal data to be used for research, technical diagnostics, personalization and analytics in order to train and improve the services. Enterprise customers can sidestep the question altogether with BYOK, using OpenAI, Anthropic, Azure OpenAI or self-hosted models, and with single-tenant, on-premise or air-gapped deployment that keeps code out of shared infrastructure. Everyone else should settle the point in writing.

Data retention & training

Hosting summary

Qodo runs its SaaS on major cloud providers, and Exhibit A of the DPA names each subprocessor with its hosting zone. Google Cloud Platform hosts the service in the United States or the EU, at the customer's election. Amazon Web Services, Inc. and Amazon Web Services EMEA SARL host in the United States, the EU or Australia, again at the customer's election. Two further subprocessors sit in the United States: Slack, used for internal communication that may contain customer data, and Google Workspace for internal mail and collaboration. Exhibit B covers the hosting of customer employee email addresses in the service database, noted as Firebase on GCP. The Trust Center adds that hosting is with a major cloud provider only, inside a private VPC, with disaster recovery on a different cloud region. International transfers are framed by the EU Standard Contractual Clauses and a separate UK track. These regions are contractual options rather than defaults, so location is a decision made at contract time. Enterprise customers can remove the question entirely with single-tenant, private cloud, on-premise or air-gapped deployment inside their own infrastructure.