1. Who is responsible for your data

Grexus (grexus.dev) is operated by Deep IT Consulting, a company established in France — see the legal notice for its registration details. For the data described below, Deep IT Consulting is the data controller.

Write to privacy@grexus.dev about anything on this page.

2. If you're here about an app built on Grexus

Grexus is a tool people use to build their own applications. If you signed in to one of those applications, or received an email from one, then the person or company that operates that application is the controller of your data — not Grexus. They decided what to collect and why. Grexus only stores and processes it on their instructions, as their processor.

So a request for a copy of your data, or for it to be deleted, has to go to them. If you write to us instead we will pass it on to them so their clock starts, and tell you we have done so — but we will not act on your data ourselves, because it is not ours to act on.

3. What we hold about you, and why

If you have a Grexus account, we process:

Your account — email address, display name and the identifier from the sign-in provider. To give you an account and let you sign in. Basis: our contract with you.
What you build — your ideas, briefs, features, specifications, plans and anything you upload. To provide the service. Basis: our contract with you.
How the builds ran — run history, timings and the operational trace of what happened. To run, debug and secure the service. Basis: our legitimate interest in operating it, balanced by keeping the trace only as long as it can still explain a failure.
Billing — your subscription, what you consumed, and the invoices. Basis: our contract with you, and our legal obligation to keep accounting records.
The audit trail — who did what on the platform and when. Basis: our legal obligation to be able to demonstrate what we did, and our legitimate interest in security.
Product analytics — first-party counts of which steps people reach. No third-party tracker. One random identifier is held in your browser for the length of the visit so the steps of a single visit can be counted together; it is erased when you close the tab, is never joined to your account, and never leaves us. With the first step we note where the visit came from: the name of the website that linked here (never the page on it), and the campaign label on a link we published ourselves. Basis: our legitimate interest in improving the product.
Google Analytics — only if you allow it. Which pages people visit and how far they get, from a first visit to building a first feature, counted across visits with a cookie from Google. Pages are reported without any project or account identifier, and we never send Google your name, email or account. Basis: your consent, which you can withdraw at any time (§7).

If you used the site without an account, we keep what you typed for two hours and then delete it, along with everything created from it.

4. How long we keep it

Most of it, for as long as you have an account: delete your account and it goes. The exceptions are the ones the law sets — invoices and accounting records for ten years (French commercial and tax law), and the audit trail for six years. Operational traces are shorter: run details ninety days, performance data thirty days.

5. Who else touches it

We use a small number of companies to run the service. The full, current list — what each one does, where it is, and the safeguard covering any transfer outside the EU — is in your account under Settings → Privacy, generated from the platform itself rather than written by hand.

The platform and the applications it builds run in the European Union (Belgium). Two things are processed in the United States: account sign-in, by Google Cloud Identity Platform, and — where you use our AI credits rather than your own key — the coding model. Both are covered by the EU-US Data Privacy Framework and by EU standard contractual clauses. If you allow Google Analytics, Google (Google Ireland Ltd, with processing by Google LLC in the United States under the same framework) receives the visit data in §3.

We do not sell your data, and we do not use it to train models.

6. Your rights

A copy of your data. Settings → Privacy → “Download a copy”. It is machine-readable, so it also covers your right to portability.
Correction. Change your name under Settings → Account. Your email address is the one you sign in with, so it is your sign-in provider's to change — change it there and it updates here the next time you sign in.
Deletion. Settings → Privacy → “Delete your account”. It takes effect after thirty days and you can cancel until then. Your invoices and the audit trail stay, for the reasons in §4, with your name taken out of the latter.
Objection and restriction. Write to privacy@grexus.dev. The only thing we do on a legitimate-interests basis is run and secure the service, so in practice the remedy is closing the account — we would rather say that than imply otherwise.
Complaint. To the CNIL — 3 place de Fontenoy, 75007 Paris, www.cnil.fr — or to the authority where you live.

7. Cookies and tracking

What we keep on your device is either needed to run the service you asked for — the session that keeps you signed in, the security token that protects the sign-in itself, the signed link that lets you open a preview, your own interface preferences, and the answer you gave to the question below — or it is audience measurement.

Our own audience measurement is a random identifier held only until you close the tab, used only to count how far a visit gets, never joined to your account, never shared, and never used to follow you to another site. It falls under the consent exemption for first-party audience measurement, so we run it without asking.

Google Analytics runs only if you say yes. Until you do, its script is not loaded and nothing of Google’s is set. If you allow it, Google sets the cookies _ga and _ga_… for up to 13 months, so a later visit is recognised as the same browser. Google signals and advertising features are switched off, and your answer is asked again after six months. Refusing is as easy as accepting, and changes nothing else about Grexus.

There is no advertising and no session recording.

8. Automated decisions

We do not make decisions about you by automated means that have legal or similarly significant effects. AI writes specifications and code from your instructions; a human — you — decides every outcome that matters, and nothing you build is ever marked done without your verdict.

9. Changes

We will tell you when this notice changes, and your account records which version you were shown and when.

Privacy notice