MMAKER / Privacy policy
Privacy policy
Effective 2 November 2026
1. Controller and scope
Codepolder, Reprevi, Westhavenkade 71P, 3131AH Vlaardingen, Netherlands is responsible for account, licensing, billing and security data. Contact gdpr@codcl.com. For personal data in business-customer media, we act on that customer’s documented processing instructions; request processing terms before using the service for a workflow requiring a processor agreement.
2. Media is temporary
Local media is processed on your device. In Web, uploaded inputs, intermediate files and exports exist only in RAM-backed processing storage, not a durable media volume. Cleanup runs every minute and removes session objects no later than one hour after session creation; a container restart also loses the session. We do not back up, train models on, sell or build a media library from your media. A selected third-party import host or optional AI provider may process the requests you direct to it under its own terms.
3. Information and legal bases
We retain email, password hashes, locale, account identifiers, acceptance timestamps, subscriptions, payment references, encrypted activation keys, keyed device identifiers and licence events to perform the contract (Article 6(1)(b)). Essential security logs and abuse controls use legitimate interests (Article 6(1)(f)), balanced against your rights. Statutory accounting records rely on legal obligation (Article 6(1)(c)). Optional processing requiring consent is disabled unless separately enabled with valid consent. Card details are handled by the payment provider, not stored by us.
4. Retention and recipients
Account data lasts while the account is active and is removed after a validated deletion request unless necessary for an unresolved claim or legal duty. Security access logs rotate within 14 days; reset tokens expire after one hour and verification tokens after 24 hours. Financial records are retained for the statutory Dutch period, generally seven years where applicable. Hosting infrastructure, contracted email delivery and payment providers receive only data needed for their tasks. A configured Together.AI request contains the selected description prompt; do not put sensitive data in it.
5. Transfers and safeguards
The primary server is in the EU. Any provider processing outside the EEA must have an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses, and necessary supplementary measures. Ask gdpr@codcl.com for current provider and transfer information. We use TLS, hashed passwords, restricted internal services, encrypted secrets and signed device authorization. No method of security can promise zero risk.
6. Your choices and rights
You may request access, correction, deletion, restriction, portability and objection as applicable, and withdraw optional consent without affecting earlier lawful processing. Export account data from the account portal or contact gdpr@codcl.com. We respond within one month, subject to lawful extensions and proportionate identity verification. You may complain to the Dutch Autoriteit Persoonsgegevens or your local EU supervisory authority. We do not make solely automated decisions producing legal or similarly significant effects.