Privacy Policy

This Privacy Policy explains how QualiCode (the AI batch coding platform at coding-agent.de) collects and uses personal data when you use the service as a registered user. It is intended for researchers, analysts, and other pipeline users who upload datasets and run classifications through the platform.

1. Who is responsible?

Controller for platform-related personal data (account, billing, support):

Sonja Berger
Zeilhofener Straße 36
84405 Dorfen, Germany
Email: info@sonja-berger.org

Further business details are in our Legal Notice.

Data Protection Officer: We are not required to appoint a Data Protection Officer under Article 37 GDPR. Privacy enquiries can be sent to the contact address above.

Your role when uploading third-party content: If your Excel files or schemes contain personal data about other individuals (for example survey responses or course feedback), you are typically the data controller for that content. QualiCode processes such data on your instructions as a data processor. See our Data Processing Agreement.

2. What data do we process?

Account and authentication (via Clerk):

• Name and email address
• Authentication identifiers and session data
• Profile information you provide through the sign-up flow

Service usage and content you provide:

• Uploaded Excel datasets (titles, descriptions, labels, and any other columns you include)
• Coding schemes (categories, criteria, examples, prompt templates)
• Analysis runs, progress, credit usage, and configuration metadata
• Per-row classification results, confidence scores, reasoning text, and prompts sent to the AI model

Payment data (via Stripe):

• Billing records, transaction identifiers, and purchased credit packages
• We do not store full payment card numbers; Stripe processes card payments

Technical data:

• IP address, browser type, timestamps, and server logs for security and operations
• Cookies and similar technologies required for authentication (see section 9)

3. Why we process data and legal bases (GDPR Art. 6)

• Contract (Art. 6(1)(b)): Providing the platform, running analyses, managing credits, and support
• Legitimate interests (Art. 6(1)(f)): Securing the service, preventing abuse, improving reliability, and keeping minimal operational logs
• Legal obligation (Art. 6(1)(c)): Tax, accounting, and other statutory retention where applicable
• Consent (Art. 6(1)(a)): Only where we explicitly ask for consent (for example optional communications)

You are responsible for ensuring a valid legal basis exists for any personal data you upload about third parties (for example consent, legitimate interest, or research exemption under applicable law).

4. AI processing

QualiCode uses third-party large language models to classify text snippets according to your coding scheme. When you start a run, relevant text fields and scheme instructions are sent to the model provider you select (OpenAI or Mistral). Outputs are stored in your account so you can review and export them.

• AI suggestions may be incorrect; you must review results before relying on them
• We do not use your uploaded content to train our own models
• Sub-processors' use of data is governed by their policies and our agreements with them

5. Where data is stored and processed

The application, database, and uploaded files are hosted on servers operated by Hetzner Online GmbH in Germany / the European Union. Authentication is provided by Clerk and payments by Stripe. AI API calls may be processed in the United States or the EU depending on the model provider you choose.

A current list of sub-processors is published at coding-agent.de/sub-processors.

6. International transfers

Where personal data is transferred to countries outside the European Economic Area (for example to US-based providers), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and supplementary measures where required. You can request more information about transfers relevant to your use of the service by contacting us.

7. Retention

Personal data and content you upload — including datasets, coding schemes, and analysis results — are generally retained for a maximum of three (3) years from your last account activity or from completion of the relevant processing, unless applicable law requires longer storage. You may request deletion at any time by contacting info@sonja-berger.org. Contractual details are in our Terms of Service.

Payment and accounting records may be kept longer where required by law. Backup copies may persist for a limited period before being overwritten in the ordinary course of backup cycles.

8. Security

We implement technical and organizational measures to protect personal data, including access controls, encrypted transport (HTTPS), authenticated access to the dashboard, and restricted server access. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

9. Cookies

We use cookies and similar technologies that are necessary to operate the service, in particular for authentication and session management through Clerk. We do not use advertising cookies on this platform. You can control cookies through your browser settings; disabling essential cookies may prevent you from signing in.

10. Your rights

If you are in the European Economic Area, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase data (subject to legal exceptions)
• Restrict or object to certain processing
• Data portability where applicable
• Withdraw consent where processing is based on consent
• Lodge a complaint with a supervisory authority (in Germany, your local state data protection authority or the Bayerisches Landesamt für Datenschutzaufsicht if you are in Bavaria)

To exercise these rights, email info@sonja-berger.org. We may need to verify your identity before responding.

11. Data breaches

If we become aware of a personal data breach affecting the service, we will take appropriate remedial action and, where required by law, notify supervisory authorities and affected customers without undue delay.

12. Children

The service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us.

13. Changes

We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect material changes. Continued use of the service after changes constitutes acceptance where permitted by law.

14. Contact

Privacy questions: info@sonja-berger.org