Qoder

GDPR overview

Qoder's site contains no mention of the GDPR at all. The privacy policy, effective 12 May 2026, carries addenda for the United States, Singapore, Australia and the Philippines, but none for the EU or the EEA. No Article 27 EU representative is designated, no data processing agreement is published or offered, and no subprocessor list exists. The framework claimed is Singapore's Personal Data Protection Act 2012 (SG PDPA), a distinct regime that should not be read as a GDPR equivalent. A Data Protection Officer is reachable at intldpo@qoder.com, and section 5 lists access, deletion, portability, rectification, objection and complaint rights, but qualifies them by where the user resides. Cross-border transfers to servers in the United States, Singapore and Japan rely on unnamed legally valid transfer mechanisms. The terms are governed by Singapore law, with SIAC arbitration.

Who owns the data?

Under clause 5 of the terms, effective 29 April 2026, you keep every right in your Inputs and Qoder assigns you whatever rights it may hold in the Outputs. In return you grant Qoder and its affiliates a worldwide, royalty-free license over your User Content to operate and improve the service and develop new products, including for internal purposes and for other customers. Usage Data, meaning technical logs and usage insights but not User Content, is owned outright by Qoder and disclosed to third parties only in aggregated or de-identified form. The service and its intellectual property remain Qoder's. No confidentiality duty covers User Content unless separately agreed, and Qoder advises against submitting personal or sensitive data.

Reuse rights

Outputs are yours to use, publish or sell without asking Qoder for permission: clause 5.1 assigns you the rights in them, subject only to the license you grant back. On the publisher's side, the privacy policy effective 12 May 2026 maps each purpose to a retention period. Account management, payment, service delivery, debugging, support, legal compliance and fraud prevention run for the life of the account; research and service improvement use de-identified User Content only. You can disable the "Share & Improve" setting at any time to stop future improvement use, though data already processed may remain, and Teams or Enterprise administrators can set that toggle for the whole organization. Data is shared with your organization on team plans, with service providers (cloud infrastructure, language models, codebase storage, web search), with integrated third parties, within the group of companies, in a corporate transaction and on lawful request; Qwen by Alibaba and Kimi by MoonShoot are named as model providers. Audio is processed algorithmically to execute the instruction only, with no voiceprint and no transfer to third parties. With bring-your-own-key, sending content to your chosen provider is your own act, governed by that provider's policy. The US addendum states there is no sale and no sharing for targeted advertising, and that Do Not Track signals are not honored.

Data retention & training

Hosting summary

Qoder states that it processes and stores the information it collects on secure servers located in the United States, Singapore and Japan. No European hosting region is offered anywhere. International transfers outside the user's country of residence are possible; the policy invokes appropriate safeguards and legally valid transfer mechanisms without naming any of them. The Singapore addendum commits to transferring data out of Singapore in line with the Personal Data Protection Act 2012 and to a standard of protection at least comparable to it, while the Philippines addendum states that data on Philippine data subjects is stored in Singapore. The terms add that User Content may be transferred, stored and processed in any other location where the publisher, its affiliates or its service providers operate facilities. On security, the policy claims encryption in transit and at rest, an information security program built on a standard framework, anti-malware protection, vulnerability management, access management and resilience measures, but no certification such as SOC 2 or ISO 27001 is claimed. One technical observation made during collection, not advertised by the site: the domain resolves to an anycast node on AS45102, Alibaba (US) Technology Co., Ltd.