Privacy Policy
Last updated: 14 August 2026
This Privacy Policy explains how we handle personal data when you visit codebasehub.pro, create an account on the CodeBaseHub dashboard, buy one of our digital products, subscribe to our newsletter, take our free certification exam, or contact us.
Our mobile applications each have their own privacy notice, which is linked from inside the app and from the relevant app store listing. This document covers our website and dashboard only.
1. Who is responsible for your data
| Controller | Nord Software LLC, trading as CodeBaseHub |
| Established in | Ukraine |
| hi@codebasehub.pro |
We are the data controller for the processing described here. We have not appointed a Data Protection Officer, because we are not required to; privacy requests are handled by us directly at the address above.
If you are in the European Economic Area, the United Kingdom, or Türkiye, this policy is written to meet the transparency requirements of the GDPR (Articles 13 and 14), the UK GDPR, and the Turkish Personal Data Protection Law No. 6698 (KVKK) (Article 10). Where we ask for your explicit consent under KVKK, that consent is always requested in a separate statement and never bundled into this notice.
2. What we collect and why
We only collect what we need for the purpose described. We do not sell personal data, and we do not use it for advertising profiles.
| What we process | Where it comes from | Why | Legal basis |
|---|---|---|---|
| Name, email address, password hash, profile image, chosen language | You, when you register or edit your profile | Creating and running your account, signing you in, sending service emails | Performance of a contract — GDPR Art. 6(1)(b); KVKK Art. 5(2)(c) |
| Google or GitHub account identifier, name, email (if you use social sign-in) | Your identity provider, with your action | Letting you sign in without a password | Performance of a contract — GDPR Art. 6(1)(b); KVKK Art. 5(2)(c) |
| Purchase records: products bought, amount, currency, date, payment provider customer and order identifiers | You and our payment provider | Delivering what you bought, unlocking access, invoicing, tax and accounting records, handling disputes | Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c); KVKK Art. 5(2)(a), (c) and (ç) |
| Exam answers, score, pass or fail result | You, when you take the certification exam | Grading the exam and issuing your certificate | Performance of a contract — Art. 6(1)(b); KVKK Art. 5(2)(c) |
| Certificate records: your name, credential title, score, issue date, credential ID | Generated when you pass | Issuing the credential and letting third parties verify it (see section 4) | Performance of a contract — Art. 6(1)(b); KVKK Art. 5(2)(c) |
| Email address, and language | You, when you subscribe to the newsletter or unlock gated blog content | Sending you the newsletter and the content you asked for | Consent — Art. 6(1)(a); KVKK explicit consent |
| Name, email, message, and any app name passed in the link | You, when you use the contact form | Answering your enquiry and keeping a record of it | Legitimate interests — Art. 6(1)(f) (responding to people who contact us); KVKK Art. 5(2)(f) |
| Prompts and project details you type into the free CLAUDE.md generator | You | Generating the file you requested | Performance of a contract — Art. 6(1)(b); KVKK Art. 5(2)(c) |
| IP address, browser and device type, operating system, referring page, pages viewed, clicks and other interaction events, and session recordings with form inputs masked | Automatically, in your browser | Understanding how the site is used so we can improve it | Consent — Art. 6(1)(a) and Art. 5(3) ePrivacy Directive; KVKK explicit consent |
| Server logs, error reports, rate-limit counters and security events | Automatically | Keeping the service available, preventing abuse, fraud and attacks | Legitimate interests — Art. 6(1)(f) (security and integrity of our service); KVKK Art. 5(2)(f) |
Providing your name and email is necessary to create an account; without it we cannot provide the dashboard, the exam, or a certificate. Everything else is optional.
3. Cookies and analytics
Analytics and any other non-essential technology are switched off until you accept them in our cookie banner. If you reject, or simply ignore the banner, no analytics scripts are loaded.
| Cookie or storage | Purpose | Category | Lifetime |
|---|---|---|---|
consent | Remembers your cookie choice | Strictly necessary | 6 months |
NEXT_LOCALE | Remembers your language | Strictly necessary | 1 year |
| Session cookies set on sign-in | Keeps you logged in and protects against request forgery | Strictly necessary | Session, or until sign-out |
ph_* (PostHog) | Product analytics and session replay, with all form inputs masked | Analytics — consent required | Up to 12 months |
datafast_visitor_id (DataFast) | Website analytics and attributing a purchase to the channel it came from | Analytics — consent required | Up to 12 months |
| Local storage entry for a dismissed banner | Stops a promotional banner reappearing | Strictly necessary | Until you clear your browser storage |
You can change or withdraw your choice at any time using the Cookie settings link in the site footer. Withdrawing is exactly as easy as giving consent, and it takes effect immediately for future page views.
4. Certificates are publicly verifiable
Our certification is free, and the point of a credential is that other people can check it. If you pass the exam and we issue a certificate, then anyone who has your credential ID or verification link can see your name, the credential title, your score, and the issue date on our public verification page.
That page is not indexed by search engines, and the credential ID cannot be guessed from your name. If you would rather not have a verifiable credential, ask us to delete it and we will revoke it; after that, the verification page will report it as not found.
5. Who else processes your data
We use a small number of service providers. They act on our instructions under a data processing agreement, and they may not use your data for their own purposes.
| Provider | What they do | Where they process data |
|---|---|---|
| Creem | Payment processing and checkout. Creem may act as merchant of record, in which case it is also the seller on your card statement and handles payment data as its own controller under its own privacy policy. | European Union |
| Plunk | Transactional and newsletter email delivery, and our contact list | European Union |
| PostHog | Product analytics and session replay, loaded only after you consent | European Union (EU-hosted instance) |
| DataFast | Website analytics and purchase attribution, loaded only after you consent | Outside the EEA |
| Cloud hosting, database, storage and content delivery providers | Running and serving the website and dashboard, storing uploaded profile images, keeping backups | European Union and United States |
| AI model providers | Generating output for the CLAUDE.md generator and other AI-assisted features, based on the text you submit | United States and other third countries |
We never receive your full card number. Card details are entered on the payment provider's own checkout and handled by them.
We may also disclose personal data where the law requires it — for example to comply with a court order or a lawful request from an authority — or where it is necessary to establish, exercise or defend legal claims.
A current list of our processors, and the country each one processes in, is available from hi@codebasehub.pro on request.
6. International transfers
We are established in Ukraine, and some of our providers are outside the EEA and outside Türkiye. That means your data may be processed in a country whose data protection law differs from your own.
- For visitors in the EEA and the UK: where a transfer needs a safeguard under Chapter V of the GDPR, we rely on the European Commission's Standard Contractual Clauses, or on an adequacy decision where one covers the destination. You can request a copy of the relevant clauses from hi@codebasehub.pro.
- For visitors in Türkiye: transfers abroad are made on the basis of your explicit consent or, where one is in place, a standard contract approved by the Personal Data Protection Board under the amended Article 9 of Law No. 6698, or another safeguard permitted by that article.
7. How long we keep it
| Data | Retention |
|---|---|
| Account data | Until you delete your account, then removed from live systems within 30 days and from backups within 90 days |
| Purchase and invoice records | Up to 10 years, because tax and accounting law requires it — this is kept even if you delete your account |
| Certificates | For as long as the credential should stay verifiable, unless you ask us to revoke and delete it |
| Exam attempts and answers | 24 months |
| Newsletter subscription | Until you unsubscribe. We then keep a minimal suppression record so we do not email you again |
| Contact form messages | 24 months after the conversation ends |
| CLAUDE.md generator input | Not stored by us after your file is generated. Our AI provider may retain it briefly for abuse monitoring under its own policy |
| Analytics events | Up to 14 months |
| Session recordings | Up to 1 month |
| Server and security logs | Up to 12 months |
8. Automated decisions
Your exam is graded automatically: we compare your answers to the correct ones and issue a certificate if you reach the pass mark of 70%. There is no profiling and no human review by default, and the only consequence is whether a certificate is issued. You can retake the exam whenever you like, and if you think a result is wrong, write to us and a person will look at it.
We do not make any other automated decisions that have legal effects for you.
9. Your rights
Wherever you are, you can email hi@codebasehub.pro and ask us to:
- confirm whether we process your data, and give you a copy of it;
- correct data that is wrong or incomplete;
- delete your data;
- restrict or stop a particular use;
- object to processing we base on our legitimate interests;
- send your data to you or another provider in a portable format;
- withdraw a consent you gave us, such as for analytics or the newsletter. Withdrawing does not affect processing that already happened.
We answer within 30 days. We may ask you to confirm your identity first, so that we do not disclose someone else's data.
If you are in the EEA or the UK, you also have the right to lodge a complaint with your national supervisory authority. If you are in Türkiye, Article 11 of Law No. 6698 additionally gives you the right to learn whether your data has been processed, to request notification of corrections or deletions to third parties who received your data, to object to results produced solely by automated systems, and to claim compensation for damage caused by unlawful processing. Please apply to us first, in line with the Communiqué on Application Procedures; if you are not satisfied, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
10. Security
We use TLS for all traffic, store passwords only as salted hashes, restrict administrative access to authorised personnel, mask form inputs in session recordings, and keep encrypted backups. No system can be guaranteed secure, so please use a strong, unique password and tell us immediately at hi@codebasehub.pro if you think your account has been accessed by someone else.
11. Children
Our service is not intended for children. You must be at least 16 years old to create an account or take the exam. If we learn that we hold data about a child under 16, we delete it. Parents and guardians can contact us at hi@codebasehub.pro.
12. Changes to this policy
If we change how we handle personal data, we will update this page and the date at the top. Where a change materially affects you, we will tell you by email or by a notice in the product before it takes effect.
13. Contact
Questions, requests, or complaints: hi@codebasehub.pro. We read every message and reply.