Privacy policy

This policy explains what Caudex Studio collects when you use it, why, which services handle it for us, and how to have it deleted. Caudex Studio, based in Bangladesh, is responsible for your data here (“we” or “us”).

What we collect

• Your sign-in. When you sign in with Google or GitHub, Google Firebase gives us an account ID and your email address. We never see your Google or GitHub password.
• Your Kaggle connection. Your Kaggle username and API key. The key is encrypted (AES-256-GCM) before it is stored, so a copy of the database alone holds no usable key.
• Your work. Your projects: their names, code and notebook files, settings and attached datasets, and a record of each run, such as when it started, its hardware, its status and the Kaggle notebook version it made. Run logs and output files stay on Kaggle and are read from there when you open them. Dataset files you upload pass through our server on their way to your Kaggle account and are not kept here.
• Billing. When your trial ends, what you have paid for and until when, the status of a card subscription, and the payment notices Paddle and SSLCommerz send us, with the amount, currency, status and their reference numbers. These can include the payment method and the last few digits of a card. We never receive your full card number, the card’s security code, or your mobile wallet number or PIN: those stay with Paddle and SSLCommerz.
• Activity and security. When you were last active, and a record of any action an administrator takes on your account. Our hosting provider keeps short-lived logs of requests, such as the IP address, the time and the page asked for, and we use IP addresses briefly to slow down repeated sign-in attempts.
• What you send us. If you write to us, your message and your email address.

We don’t use advertising or analytics tools, and we take nothing else from your Google or GitHub account.

Why we use it

We use what we collect only:

• to sign you in and keep you signed in;
• to run your code on Kaggle for you and show you its log and outputs;
• to keep your projects and run history;
• to know whether your trial or plan is active, and to record payments;
• to keep the service secure and stop abuse;
• to answer you when you ask for help;
• to keep the records that tax and accounting law require.

We don’t sell your data, share it for advertising, or use your code for anything but running it for you.

Services that handle it

These companies handle data for us, each under its own privacy policy:

• Google Firebase signs you in, with Google or GitHub, whichever you choose.
• Kaggle, part of Google, runs your code and holds the notebooks, datasets and outputs in your own Kaggle account.
• Vercel hosts the website and the app; every request passes through its servers.
• Neon hosts the database that stores accounts, projects, files, run records and billing records.
• Paddle takes card payments as the Merchant of Record; what you enter at its checkout is covered by Paddle’s privacy policy.
• SSLCommerz takes payments in taka, by bKash, Nagad, Rocket or card.

These services may store and process data outside your country, including in the United States.

Administrators of Caudex Studio can see account details and open an account’s projects. They do so only to help when you ask, to look into abuse, or to meet a legal duty. We share data with anyone else only when the law requires it.

Cookies and browser storage

We set one cookie, cx_session, which keeps you signed in. It holds your account ID, email address and Kaggle username, encrypted so that only our server can read it; scripts on the page can’t read it at all. It expires after 30 days, or when you sign out. There are no advertising or analytics cookies.

Your browser also keeps two things in its own storage: Firebase’s sign-in record, and whether you chose the light or dark theme. When you pay, Paddle’s checkout and SSLCommerz’s payment page may set their own cookies, under their own policies.

How long we keep it

• Your account, projects, files and run records: for as long as the account exists. Nothing is deleted when a trial or plan runs out.
• Your Kaggle key: until you connect a different one, or your data is deleted.
• Payment records: for as long as tax and accounting law require, even after the rest of an account’s data is deleted.
• Records of administrator actions: kept after an account’s data is deleted, as a history of what was done.
• Request logs: a short time, as our hosting provider keeps them.

Deleting your data

Ask us from the email address you sign in with (see Contact below). An administrator then deletes your projects, with their files and run records, and your stored Kaggle key. The account itself, meaning its ID, email address and plan dates, is kept unless you ask for it to be removed too, and payment records are kept as described above.

Your notebooks, datasets and outputs on Kaggle are in your Kaggle account, not ours: delete them on kaggle.com. Revoking your API key there stops it working here straight away.

Your rights

Wherever you live, you can ask us to:

• tell you what data we hold about you, and give you a copy;
• correct anything that is wrong;
• delete it, as described above;
• stop using it for a purpose you object to.

We reply within 30 days. If you think we have mishandled your data, you can also complain to the data protection authority where you live.

Security

Connections use HTTPS, your Kaggle key is encrypted before it is stored, and the sign-in cookie is encrypted too. No system is perfectly secure; if a breach affects your data, we will tell you.

Children

Caudex Studio is not meant for children under 13, and we don’t knowingly collect their data. If you think a child has signed up, contact us and we will delete the account’s data.

Changes to this policy

When what we collect or who handles it changes, we update this page and the date at the top. If a change matters to you, we will tell you before it applies.