Privacy policy

This explains what personal data Code Mentor collects, why, who processes it, and what rights you have. We keep it short and specific.

Who is responsible

The data controller is Made by Pless, CVR 36740965, Lindevænget 6, 7100 Vejle, Denmark. Contact: contact@madebypless.dk.

What we collect

  • Account: your email address and a password. Passwords are handled by our authentication provider and stored only as a hash; we never see them.
  • Your reviews: the code you submit, the language, level and focus you choose, the generated review and score, the model used, and the time.
  • Billing: a Stripe customer ID, subscription ID, plan and subscription status. Your card details go directly to Stripe; we never receive or store them.
  • Teams: if you are a Team plan owner, the email addresses of the teammates you add. If you are added to a team, the owner can see that your email holds a seat. Owners cannot see your reviews.
  • Usage counts: how many reviews you ran in each month, used to apply the free-plan limit.
  • Technical data: IP address and request logs that our hosting provider processes to run and secure the service.

Please don't submit secrets, credentials, or other people's personal data in your code.

Why we use it, and the legal basis

  • To create your account, produce reviews, keep your history and provide your plan: performing our contract with you (GDPR Art. 6(1)(b)).
  • To keep the service secure and prevent abuse, including the monthly free-review limit: our legitimate interest (Art. 6(1)(f)).
  • To keep accounting records of payments: a legal obligation under Danish bookkeeping rules (Art. 6(1)(c)).

We don't sell personal data, and we don't use advertising or analytics trackers.

Who processes your data

  • Supabase: database and authentication. Our project is hosted in the EU (Frankfurt, Germany).
  • Suble (Stacket Group ApS, Denmark): hosting and delivery of the website, on servers in Denmark.
  • OpenRouter and OpenAI (both in the US): your submitted code is sent through OpenRouter to an OpenAI model to produce the review. Our OpenRouter account has prompt logging and use for training turned off. OpenAI doesn't use API data for training and may keep it for up to 30 days to monitor for abuse. We don't train models ourselves.
  • Stripe: payments, invoices and VAT calculation.

OpenRouter, OpenAI and Stripe may process data in the US. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the EU Standard Contractual Clauses.

How long we keep it

  • Account, reviews and usage counts: until you delete them. You can delete all your reviews, or your whole account, yourself on the Account page. Deleting your account also cancels any subscription and removes your team seats. Our database keeps no backups, so deleted data is gone straight away.
  • Payment and invoice records: 5 years after the end of the financial year, as Danish bookkeeping law requires.
  • Server logs: kept by our hosting provider for a short period.

Cookies

We use only strictly necessary cookies that keep you signed in. We don't use advertising, tracking or analytics cookies, so no cookie banner is needed.

Your rights

On the Account page you can download a copy of your data and delete your reviews or your whole account yourself. For anything else, such as correction, restriction or objection, write to us at the address above and we will respond within one month. You can also complain to the Danish Data Protection Agency, Datatilsynet.

Children

Code Mentor is not directed at children.

Changes

If we change this policy in a meaningful way, we will update the date below and, where appropriate, tell you by email. See also our terms of service.

Last updated: 30 October 2026