Codeflash

GDPR overview

The privacy policy, updated on 10 July 2025, lists the GDPR under a heading stating that CodeFlash maintains compliance with industry security standards and regulations, next to SOC 2 Type 2, CCPA alignment and the NIST Cybersecurity Framework. Read closely, the wording is softer than the heading: the item is titled "GDPR Readiness" and says only that privacy practices are designed with GDPR principles in mind. Concrete measures are named, including privacy by design, data minimization and mechanisms for exercising rights, and the policy enumerates access, rectification, erasure, portability, objection and opt-out, answered within 30 days at privacy@codeflash.ai. Transfers from the EEA, the United Kingdom, Asia and Switzerland rely on standard contractual clauses or another valid mechanism. What is missing is just as concrete: no DPA published or offered, no Article 27 EU representative, no named DPO, no Do Not Track support, minimum age 16.

Who owns the data?

The terms of service (23 July 2025) draw a clean line: the customer owns and retains all right, title and interest in the Customer Data, and Outputs, the agent's code suggestions, are explicitly part of it. CodeFlash keeps the intellectual property in the Product itself. Internally, and without disclosing it, the vendor may use and modify Customer Data and Usage Data to operate the Product and to generate Aggregated De-Identified Data, which it can then exploit freely for improvement, testing, operation, promotion and marketing. Feedback is licensed perpetually and royalty-free. Some features pass Customer Data to third-party generative AI providers, which you must not feed personal data. Paid privacy mode adds a no-training pledge.

Reuse rights

Because Outputs belong to the customer, the optimized code can be merged, shipped and sold as part of your own software without asking CodeFlash for anything. The licence to the Product itself is far narrower: non-exclusive, limited, personal, non-sublicensable, non-transferable and for internal use only. Reverse engineering, derivative works of the Product, resale, rental or transfer, use for a third party's benefit and building a competing product are all prohibited. Outputs carry no warranty at all: they are supplied as is, neither promised non-infringing nor necessarily protectable, and the AI clause requires you to verify them before relying on them. Customer Data and Outputs may be deleted after 90 days, irreversibly once an account has been unpaid for 90 days or more. CodeFlash may also cite your name and logo as a commercial reference unless you say otherwise. (terms of service, 23 July 2025)

Data retention & training

Hosting summary

The backend runs on Microsoft Azure, presented as Microsoft's enterprise-grade security and compliance framework, and Codeflash states that no sensitive data is persisted there. No Azure region is ever named, which leaves the exact hosting country unconfirmed; the privacy policy says only that the company is US-based, that US law governs, and that information may be transferred, processed and stored in the United States and other jurisdictions. In cloud mode with privacy mode on, the Codeflash client scans and runs your code inside your own environment and sends the backend only the snippet to optimize and its context. LLM work goes through Azure OpenAI Service and Anthropic Claude under zero data retention agreements, Auth0 handles authentication for app.codeflash.ai, Stripe processes payments under PCI-DSS with no card data stored, and the optional Staging-Review feature holds optimization information for 30 days. The terms add that the Products are installed in the customer environment, which CodeFlash does not host. On-premises puts every Codeflash service inside your infrastructure or VPC, with LLM calls pointed at your own endpoints and no telemetry sent back. SOC 2 Type II is audited annually, report under NDA.