Privacy Policy

Last updated: October 19, 2026 · Effective: October 19, 2026

Code Crafted Nexus LLC ("Company," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, process, disclose, and safeguard personal information through BoardSmyth AI and our website at boardsmythai.com.

1. Data Controller

Code Crafted Nexus LLC, a Kentucky limited liability company, is the data controller for personal data processed through BoardSmyth AI. Contact: support@boardsmythai.com.

2. Information We Collect

• Account & Authentication Information: Your email address, encrypted authentication tokens, and user ID handled via our authentication provider (Supabase).
• Billing & Subscription Information: Subscription status, billing tier, renewal dates, and transaction identifiers. All payment card details and billing addresses are collected and processed directly by our merchant of record, Paddle. We do not collect or store full credit card numbers.
• Prompts & Project Inputs: On the AI-Included Plan, text prompts, code context, and target board selections are transmitted through our backend infrastructure to our AI model provider (Anthropic) to generate requested code.
• Usage Information: Monthly generation counts, used to enforce subscription tiers.
• Local Application Data: On the Bring-Your-Own-Key (BYOK) Plan, your Anthropic API key is stored locally on your device in your operating system's secure keychain/credential storage. Prompts and code originate directly from your desktop client to Anthropic's API endpoints and do not pass through or remain on our application servers. Your project sketches, board toolchains, serial monitor streams, and local source files remain entirely on your local machine.

3. Legal Bases for Processing (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom (UK), we process your personal data under the following legal bases:

• Performance of a Contract (Art. 6(1)(b) GDPR): To provide access to BoardSmyth AI, manage subscriptions, process AI code requests, and furnish customer support.
• Legitimate Interests (Art. 6(1)(f) GDPR): To prevent fraudulent usage, secure our API endpoints, enforce tier limits, and improve service stability.
• Legal Compliance (Art. 6(1)(c) GDPR): To maintain necessary tax, accounting, and compliance records alongside our merchant of record.

4. Third-Party Service Providers (Sub-Processors)

We do not sell, rent, or trade personal data. We disclose information strictly to service providers who assist in operating the Service:

• Paddle: Merchant of Record, payment processing, sales tax, VAT, and invoice compliance (UK/US).
• Supabase: Cloud database hosting, user account authentication, and session handling (US/EU).
• Anthropic, PBC: Large language model provider powering code generation on the AI-Included plan (US).
• Transactional Email Provider: Delivery of password resets, system alerts, and support communications.

International transfers from the EEA/UK to the United States are governed by Standard Contractual Clauses (SCCs) or adequacy decisions where applicable.

5. Data Retention

We retain account data for as long as your account remains active. Generation count metrics are retained for the duration of the monthly billing cycle and historical billing validation. You may request account deletion at any time by emailing support@boardsmythai.com.

6. Your Rights (GDPR, UK, and California / US States)

Depending on your location, you have statutory rights regarding your personal data:

• Right to Access & Portability: Request a copy of the personal data we maintain about you.
• Right to Rectification: Correct inaccurate or incomplete records.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal account data.
• Right to Restrict or Object: Object to or restrict certain processing activities.
• Non-Discrimination: We will never discriminate against you for exercising your privacy rights.
• Right to Lodge a Complaint: EEA/UK residents have the right to lodge a complaint with their local Data Protection Authority.

To exercise any right, contact support@boardsmythai.com. We respond to verified requests within statutory timeframes (30 days).