Privacy policy

Who runs the Portal

The Codento Portal is run by Codento Oy ("Codento"), Urho Kekkosen katu 2 C, 00100 Helsinki, Finland. Organizations use it to brief, plan and deliver software Projects with Codento Engine.

Codento is the controller of your account data. For the Project content your Organization adds, Codento is the processor and acts on your Organization's instructions.

What we process

Account data: your name, email address, WorkOS user id, and your Organization memberships and roles. We receive it from WorkOS when you sign in.

Sign in with Google: Google tells WorkOS your name, email address and profile picture. We ask Google for basic sign-in information only (openid, email and profile) and never read your Google mail, files or contacts.

Project content: briefs, documents, repositories, Tickets and comments that members of your Organization add or that Engine produces for your Projects.

Technical data: cookies needed for sign-in and for your display preferences and recently visited Projects, and server logs with your IP address, browser, the page requested and the time, plus your user id or email on some events.

Why we process it

To sign you in, show you your Organization and Projects, run the work you ask Engine to do, and keep the Portal secure. We do not sell personal data and we do not use it for advertising.

Our legal basis

Account data: our legitimate interest in giving you access to the Portal your Organization contracted for, or the contract with you where you are a direct customer. Security logs: our legitimate interest in keeping the Portal secure. Project content: your Organization's instructions to us as its processor.

Who else handles it

WorkOS, Inc. handles authentication and Organization membership. Google handles sign in with Google, and Google Cloud hosts the Portal and its data. Anthropic and OpenAI, and Google Cloud (Vertex AI), process the Project content Engine works on. If you connect a Git host such as GitHub, GitLab, Bitbucket or Gitea, it receives and holds your repository content. Each acts on our behalf or at your direction to provide the service.

AI processing

To do the work you ask for, Engine sends relevant Project content to the AI providers above. While a model works on it, the content is readable in the provider's memory; encryption at rest does not apply during that time.

Engine's AI agents assist your team. People in your Organization approve plans and deliveries, and the agents do not make decisions about individuals that have legal or similarly significant effects.

The planning assistant can search the web and fetch public pages. Its search queries can include details from your Project, and they go to the search service and the sites it reads.

Members can connect their own AI tool to a Project. That tool receives the Project content the member lets it read, under that member's sign-in and role, and is not one of the providers named above.

Do not add special-category data (such as health or biometric data) or other information that your agreements forbid sharing with US-based AI providers to Project content.

Transfers outside the EU

WorkOS, Google, Anthropic and OpenAI are US companies and may process data in the United States. Where the law requires it, we rely on the EU-US Data Privacy Framework or standard contractual clauses for those transfers.

Because these providers are subject to US law, authorities in the United States can lawfully order them to produce data in their control, including under the US CLOUD Act (18 U.S.C. § 2713), wherever the data is stored. Regional hosting and contractual safeguards reduce that risk but cannot remove it.

How long we keep it

Account data stays while you belong to an Organization that uses the Portal. Project content stays while its Project exists. Ask us to remove your data and we will, unless the law requires us to keep it.

Your rights

You can ask us for access to your personal data, its correction or erasure, restriction of its processing, a portable copy, or object to its processing. Write to toni.bergholm@codento.com or to the address above.

You can also complain to the Office of the Data Protection Ombudsman (tietosuoja.fi) or the data protection authority of your own country.