Privacy Policy

Heksis, MB ("we", "us", or "our") operates Kodan ("the Service"). We are committed to protecting your personal data and respecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable EU member state law.

This Privacy Policy explains what data we collect, why we collect it, how we use it, and what rights you have. Please read it carefully.

Data Controller: Heksis, MB

Registered address: V. Nagevičiaus g. 3, LT-08237 Vilnius

Contact: support@kodan.dev

We collect the following categories of personal data:

2.1 Account & Identity Information

• Full name
• Email address
• Profile picture, when provided
• Authentication and session identifiers

Clerk manages authentication. If you choose password-based authentication, your password is handled by Clerk; Kodan does not receive your Google password.

Google Sign-In

When you choose Sign in with Google, Google shares your name, email address, and profile picture with Clerk for your Kodan account. We use your email and authentication identifiers to create or identify your account and sign you in. Your name and profile picture identify you to teammates in your workspace. Clerk stores this account information, and Kodan retrieves account and workspace identity information to provide the Service.

Google Sign-In does not by itself grant Kodan access to Gmail messages, Google Drive files, or Google Calendar events. Optional service connections require separate authorization, as described in Section 2.4. The purpose of Google sign-in account information is authentication and workspace identity. See Sections 5 and 7 for sharing and retention, and Section 8 for revocation and deletion requests.

2.2 Usage & Analytics Data

• Features used and actions taken within the Service
• Session duration and frequency of use
• Error logs and performance diagnostics
• Device type, browser, and operating system
• IP address

2.3 Cookies & Tracking Technologies

We use cookies and similar technologies for authentication, session management, and analytics. You can manage cookie preferences through your browser settings.

2.4 Third-Party Integration Data

Kodan allows you to connect third-party services such as GitHub, Gmail, Slack, Discord, and Jira. These integrations connect directly or through our integration provider, Composio, which provides a catalogue of supported services. When you authorise a connection, we access data from that service solely at your direction and to deliver the functionality you have requested. We do not access any third-party service unless you explicitly connect it. Services available through Composio depend on its catalogue; Composio's own sub-processors are listed at https://trust.composio.dev

• Integration connection data (tokens, credentials, configuration) is retained for as long as the connection remains active.
• Removing a connection disables its use in Kodan and triggers the cleanup supported by that integration. Content already incorporated into tasks, conversations, or review artefacts may remain with the project.
• Project deletion removes project-scoped records, vectors, active stored objects, and registered managed sandboxes, and requests deletion of project credentials. It does not delete your source repository, resources shared outside the project, or files and agent history on your own devices. Providers may retain recoverable copies under their own retention policies.

2.5 Waitlist & Marketing Information

When you request access on our public website, we collect your email address, the time and source of the request, and your separate newsletter choice. We use the email to respond to your access request. We send product news only when you affirmatively select the newsletter option. Submitting the form again with the same email updates that newsletter choice. You may also withdraw permission or exercise your data rights by contacting support@kodan.dev.

Under the GDPR, we rely on the following lawful bases:

• Performance of a contract (Article 6(1)(b)): to provide and manage your account
• Legitimate interests (Article 6(1)(f)): to improve, secure, and monitor the Service
• Consent (Article 6(1)(a)): for non-essential cookies and certain tracking, where required
• Consent (Article 6(1)(a)): for optional product-news emails selected on the waitlist form
• Performance of a contract / Consent: for each integration, on the basis of your explicit authorization
• Legal obligation (Article 6(1)(c)): where required by law (e.g. tax and accounting records)

We use your personal data to:

• Create and manage your Kodan account
• Provide, operate, and improve Kodan
• Power the third-party integrations you have authorized
• Monitor usage patterns and diagnose technical issues
• Communicate with you about your account, updates, and support requests
• Respond to public access requests and, when separately selected, send product news
• Comply with our legal obligations

We do not sell your personal data. We share data only with third-party service providers ("data processors") that help us operate the Service. All such providers are bound by Data Processing Agreements (DPAs) and are permitted to process your data solely on our behalf and in accordance with our instructions.

Our current sub-processors:

• OpenAI: Processes user-submitted content and queries through its LLM and embedding APIs, which may include personal data entered by users.
• Anthropic: Processes user-submitted content through its Claude LLM APIs to power code generation, analysis, and conversational features.
• Google: Processes user-submitted content through its Gemini LLM and embedding APIs, and stores data as part of its cloud storage infrastructure.
• Microsoft Azure: Provides Azure OpenAI models that power our code-generation agents, and Azure Key Vault for secure secrets management.
• Perplexity: Processes search and research queries, which may include content you submit, to return up-to-date information within the Service.
• Clerk: Provides authentication and user identity management, processing account data such as your name, email address, profile picture, and authentication/session identifiers.
• Composio: Brokers the third-party integrations you connect (see Section 2.4), processing OAuth tokens, credentials, and connection configuration on your behalf. Composio maintains its own sub-processor list at https://trust.composio.dev
• MongoDB: MongoDB Atlas is our primary application database, storing account, project, and Service data, which may include personal data.
• Qdrant: Stores vector embeddings derived from your content to power search and retrieval features.
• Digital Ocean: Provides cloud infrastructure on which we store and process application data, which may include personal data.
• Daytona: Provides managed agent sandboxes that process source code, task context, execution output, and credentials supplied for an authorized run.
• Vercel: Hosts our web application and processes request data, including IP addresses and usage metadata, as part of its hosting infrastructure.
• GitHub: Stores source code repositories, which may incidentally contain personal data, and powers source-control integrations you authorize.
• Recall.ai: Operates meeting bots that join calls on our behalf, capturing audio, video, and transcriptions which may contain personal data of meeting participants.
• PostHog: Provides product analytics, processing usage events, device information, and IP addresses to help us understand and improve the Service.
• Sentry: Provides error monitoring and performance diagnostics, processing technical data and error reports that may incidentally contain personal data.
• Pydantic Logfire: Provides application observability and request tracing, processing diagnostic data that may incidentally contain personal data.

We may add or change sub-processors from time to time. We will notify you of material changes to this list.

We may also disclose personal data where required by applicable law, court order, or regulatory authority, or where necessary to protect the rights, safety, or property of Heksis, MB, its users, or the public.

Heksis, MB is established in the EU. Where any service provider processes personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place — such as the European Commission's Standard Contractual Clauses (SCCs) or an adequacy decision.

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by law:

• Account information, including Google sign-in name, email address, and profile picture held by Clerk, is retained while your account is active. Contact us to close your account and request deletion of personal data held by Kodan and its identity provider. Account closure and Google access revocation do not automatically erase workspace content shared with other members.
• Project content, including tasks, conversations, summaries, generated artefacts, and review evidence, is retained to provide the project history until it is deleted.
• Removing a connection and deleting a project have the boundaries described in Section 2.4. Recoverable provider copies, backups, security logs, and records subject to legal obligations may outlast deletion from active storage.
• Usage and diagnostics data is retained for diagnostics and security according to the configured hosting and monitoring services. Contact us for details about retained personal data or to request erasure.
• Records required for accounting, tax, or other legal obligations are retained for the applicable statutory period.
• Waitlist access requests are retained while we evaluate or respond to the request, and removed when no longer needed or when you exercise an applicable erasure right.
• Newsletter permission is retained until you withdraw it by resubmitting the form without newsletter permission or contacting support@kodan.dev.

As a data subject, you have the following rights:

• Right of access: to obtain a copy of the personal data we hold about you
• Right to rectification: to correct inaccurate or incomplete data
• Right to erasure: to request deletion of your data, subject to legal retention obligations
• Right to restriction of processing: to restrict how we process your data in certain circumstances
• Right to data portability: to receive your data in a structured, commonly used, machine-readable format
• Right to object: to object to processing based on legitimate interests
• Rights related to automated decision-making: we do not make solely automated decisions with significant legal or similarly significant effects on you

You can revoke Google Sign-In access from the connections to third-party apps and services in your Google Account at https://myaccount.google.com/connections Revoking access stops future Google authorization; it does not delete an existing Kodan account or data already collected. To request deletion of your Kodan account and associated Google sign-in data, contact us at support@kodan.dev from your account email. We may need to verify your identity. Tell us if you also want project or workspace data deleted; shared workspace data and legally required records are considered separately.

To exercise any of these rights, please contact us at support@kodan.dev. We will respond within 30 days as required by the GDPR.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or disclosure. These include:

• HTTPS for the public Service
• Clerk-managed authentication and authenticated access to workspace data
• Project and organisation access checks in application APIs

Storage, backup, and recovery protections also depend on our infrastructure providers. No method of transmission or storage is completely secure.

The Service is not directed at children under the age of 16 (or such lower age as permitted by the applicable EU member state). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at support@kodan.dev and we will take prompt steps to delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or via a prominent notice within the Service prior to the change taking effect. The "Last updated" date at the top of this document reflects the most recent revision.

Your continued use of the Service after the effective date of any update constitutes your acknowledgement of the revised policy.

For any questions or concerns about this Privacy Policy or our data practices, please reach out:

Heksis, MB

Email: support@kodan.dev

Registered address: V. Nagevičiaus g. 3, LT-08237 Vilnius

You also have the right to lodge a complaint with your national data protection supervisory authority. As a company established in Lithuania, the relevant authority is:

State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija)

Website: https://vdai.lrv.lt

Email: ada@ada.lt