Privacy policy

Who we are

CodeWerf is a service by Spakero B.V. ('we', 'us'). For privacy questions and personal data requests, email us at [email protected].

What we collect, why, and legal basis

Intake answers, the AI conversation, and uploaded files/images — to understand your project and generate a project brief (legal basis: performance of a contract or steps prior to entering into one, GDPR Art. 6(1)(b)).

Email address — to send verification codes, deliver your brief, and contact you (legal basis: performance of a contract, GDPR Art. 6(1)(b)).

IP address (via Cloudflare Turnstile) — to protect the site and AI service from abuse (legal basis: legitimate interest, GDPR Art. 6(1)(f)).

Usage statistics (Google Analytics) — only if you consent (legal basis: consent, GDPR Art. 6(1)(a)).

Providing your data for the intake is voluntary, but necessary if you wish to receive a generated project brief.

Who we share data with (and who we don't)

We never sell your data and never share it with advertisers or data brokers. We do work with a small number of providers who process data on our behalf, solely to deliver the service you asked for: Anthropic (Claude API) — processes your intake answers, the AI conversation, and uploaded files/images to generate your project brief. Resend — sends emails on our behalf, including verification codes and brief links to you, and internal notifications to our team that include your project brief and conversation history. Cloudflare (Turnstile) — checks that you're human; processes your IP address and browser characteristics while doing so. Google (only with your consent for actual analytics) — see 'Cookies and analytics' below for exactly what this means. Google Cloud Platform — hosts our application and database, within the EU (Netherlands). These providers may only use your data to help us deliver the service, never for their own purposes.

International transfers

Some of the providers we work with (such as Anthropic and Google) are based in the United States. Where data is transferred outside the EU, we ensure the legally required safeguards are in place.

Retention and deletion

We keep your data no longer than necessary for the purpose it was collected for. You can request deletion of your data at any time by emailing [email protected] — we'll act on your request within 30 days.

Your rights

You have the right to access, correction, erasure, restriction of processing, objection to processing, and data portability. Where processing is based on your consent (such as analytics), you can withdraw that consent at any time, without affecting the lawfulness of processing before the withdrawal. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Cookies and analytics

We use functional cookies (to manage your intake session and verification). If Google Analytics is enabled, Google always receives a minimal, anonymous technical signal on page visits — without cookies and not traceable back to you, required for the tool to function. Only once you explicitly consent via the cookie settings do we collect actual usage statistics (such as which pages you visit and which steps you complete in the intake) — strictly for internal use, never for advertising. You can change your choice at any time via the cookie settings.

Changes

This privacy policy may be updated from time to time. The date at the top of this page shows when it was last changed.