Privacy Policy

Repodin is the working name of a service in research and development. The planned company Repodin Oy has not yet been registered and the paid consumer service has not opened. The registered company's legal name, business ID and address will be added before production and payment use opens. For privacy matters, contact privacy@repodin.com. In education use cases, the institution will typically act as the controller for student data and Repodin as the processor. In that case, the institution is responsible for its own student-facing privacy information and legal basis.

We process the following categories of data: - account and profile data such as name, email address, role and account settings - consent and audit data such as granted consents, timestamps, IP address and browser/device environment data - usage and log data such as sign-ins, security logs and service events - analysis data such as GitHub repositories, AI analysis results, reports and feedback - optional user-provided data such as LinkedIn and CV data - landing-page analytics data such as hashed identifiers, page paths, referrers and UTM parameters

We process personal data to provide the service, manage user accounts, generate analyses, maintain security, provide customer support and comply with legal obligations. The legal basis and whether data is required depend on the purpose: - contract, when we deliver the service you requested - consent, when we process optional data or non-essential analytics - our legitimate interest in maintaining a secure and functional service when preventing misuse, investigating faults or handling support; we balance that interest against the user's rights - legal obligation, when we must retain or disclose data under applicable law

We use essential identifiers for sign-in, session handling and storing consent choices. We also use first-party analytics only when the user has granted analytics consent. Landing-page analytics is handled through our own endpoints. We do not currently use Google Analytics, Meta Pixel or similar third-party marketing trackers on our public pages.

We use the following service providers. Depending on the processing, a provider may act as our processor or as an independent controller. When a provider processes data on our behalf, the processing is governed in accordance with GDPR Article 28. For transfers outside the EU/EEA, we use an applicable transfer mechanism such as the European Commission's Standard Contractual Clauses and assess necessary supplementary safeguards. Infrastructure: - Supabase (Supabase Inc., US) — database, authentication and file storage; data stored in EU (Frankfurt) - Vercel (Vercel Inc., US) — web application hosting; EU region (Frankfurt); SCCs - Railway (Railway Corp., US) — background workers and queue processing; EU region; SCCs Communication: - Resend (Resend Inc., US) — transactional email; SCCs Payments: - Stripe (Stripe, Inc., US) — payment processing and subscriptions; SCCs Authentication and data source: - GitHub / Microsoft (GitHub Inc., US) — OAuth and repository API; SCCs via Microsoft DPA AI analysis (data sent only when you trigger an analysis; not used for model training): - Anthropic (US) — Claude models; SCCs - OpenAI (US) — GPT models; SCCs - Google (US) — Gemini models; SCCs - Mistral AI (Mistral AI SAS, EU/France) — Mistral models; EU company, no transfer Optional features: - ProxyCurl (Nubela Pte. Ltd., Singapore) — LinkedIn profile enrichment with explicit consent; SCCs An up-to-date provider list and information about, or a copy of, the applicable transfer safeguards can be requested from privacy@repodin.com.

Retention depends on the data category and the product or subscription tier disclosed to the user. Basic account data is retained while the account is active; analyses, source material and inactive accounts are deleted when the disclosed product period expires. Security, consent and billing records are retained only as long as needed for abuse investigations, proof of consent, accounting or legal claims. Backup data is removed through normal rotation. Users can request a data export or account deletion. Some data may need to be retained longer for security, accounting or legal claims handling.

You have the right to access your data, request rectification, object to processing in certain situations, restrict processing, request erasure and, where applicable, receive your data in a portable format. You may withdraw consent at any time without affecting the lawfulness of earlier processing. You can manage consent choices in the service privacy settings. Data subject requests can be sent to privacy@repodin.com. We aim to respond without undue delay and within the time limits required by GDPR. You may also lodge a complaint with a supervisory authority: Office of the Data Protection Ombudsman (Finland) — tietosuoja@om.fi | tietosuoja.fi

We update this notice when the service, data flows or legal requirements change. Material changes will be communicated in the service or by another appropriate means before they take effect.

We use artificial intelligence to analyze code and generate skills reports when you request an analysis in the service. AI outputs are informational — they are not legal, financial or career advice. In developer and portfolio use, we do not make solely automated decisions with legal or similarly significant effects (for example, automated hiring decisions). Employers may use public portfolio links at their own discretion. We do not currently use user code, personal data or analysis results to train Repodin's or external providers' general models. If this changes, we will update this notice and establish an applicable legal basis before processing starts. When data comes from GitHub, LinkedIn or another source selected by the user, we identify the source and categories here and in the relevant feature. Failure to provide required account or service data may prevent account creation or the requested analysis; optional data affects only the optional feature. More information: https://www.repodin.com/legal/eu-ai-act