Privacy Policy

1. Preamble

With this Privacy Policy, we inform you about the types of personal data (hereinafter also referred to as “data”) we process, the purposes for which we process it, and the extent of such processing. This Privacy Policy applies to processing carried out in connection with dev-doc.io, including our website, account area, and AI-powered documentation service (collectively, the “Online Offering”).

The terms used are intended to be gender-neutral. This notice is designed primarily for users in Germany and the European Economic Area (EEA). Where applicable, national data protection rules, including German law, also apply.

2. Data Controller

Innovirtual Software GmbH
Kommerner Str. 141, 53879 Euskirchen, Germany
E-mail: info@dev-doc.io

Commercial Register: District Court (Amtsgericht) Bonn, HRB 29879
Represented by: Bernd Homberg & Dominik Schmitt

The controller is the legal entity that determines the purposes and means of processing personal data in connection with dev-doc.io.

Data Protection Officer

Bernd Homberg
E-mail: privacy@dev-doc.io

3. Overview of Processing Activities

Depending on how you use dev-doc.io, we may process the following categories of data:

• Account and master data, such as email address, user ID, account status, and authentication-related information.
• Contact and communication data, such as messages sent to our support address and the contents and dates of support communications.
• Contract and transaction data, such as purchased credit packages, transaction references, credit balance, purchase history, refunds, and billing records.
• Content data, such as prompts, instructions, source code, technical specifications, files, and other content submitted for documentation generation, as well as the generated documentation.
• Usage and technical data, such as feature use, timestamps, browser and device information, IP address, error reports, and security logs.
• Analytics data, subject to the analytics configuration and your consent where required.

The data subjects may include website visitors, registered users, customers, prospective customers, and people whose personal data a user includes in content submitted to the service. Users should not submit personal data or confidential material unless they are authorised to do so and the submission is necessary for the requested service.

We process data to provide and administer the service, create and maintain user accounts, authenticate users, generate documentation, administer credits and payments, communicate with users, provide support, secure and troubleshoot the service, meet legal obligations, and measure website usage where permitted.

4. Legal Bases

We process personal data only where a legal basis applies. Depending on the specific processing operation, the legal basis may be:

• Consent (Art. 6(1)(a) GDPR), for example for optional analytics cookies or similar technologies where consent is required.
• Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), for account registration, providing the documentation service, processing purchases, administering credits, and responding to service requests.
• Compliance with a legal obligation (Art. 6(1)(c) GDPR), for example statutory accounting, tax, and record-keeping duties.
• Legitimate interests (Art. 6(1)(f) GDPR), where applicable, such as protecting the service against fraud and abuse, maintaining IT security, troubleshooting, enforcing or defending legal claims, and administering our business, provided those interests are not overridden by your rights and freedoms.

Where we rely on legitimate interests, the relevant interest is described in the applicable section of this Privacy Policy. If we request consent, you may withdraw it at any time with effect for the future. Withdrawal does not affect processing carried out lawfully before withdrawal.

5. Security Measures

We implement technical and organisational measures intended to provide a level of security appropriate to the risk, taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the likelihood and severity of risks to individuals. Measures may include access controls, restricted administrative access, secure development and operation practices, backup and recovery procedures, and measures to protect the confidentiality, integrity, and availability of data.

Connections to dev-doc.io are protected using HTTPS/TLS where configured. No method of transmission or storage can be guaranteed to be completely secure. We review and improve our measures as appropriate.

6. Recipients and Disclosure of Personal Data

We disclose personal data only where necessary for the purposes described in this notice, where a legal obligation requires disclosure, or where another lawful basis permits it. Recipients may include:

• our hosting and infrastructure provider(s) for the European virtual server on which we operate the website and application;
• third-party AI service providers whose models are used to generate documentation;
• Paddle and relevant payment, transaction, fraud-prevention, and billing service providers;
• Google, in connection with Google sign-in and Google Analytics, as described below;
• GitHub, in connection with GitHub sign-in, as described below;
• professional advisers, auditors, and public authorities where necessary or legally required.

We operate the website and application ourselves on a virtual server hosted in Europe.

7. International Data Transfers

Our application is hosted on a virtual server in Europe. However, some third-party services used for AI processing, authentication, analytics, or payment processing may involve processing or access from countries outside the EEA. The location of our own server does not by itself mean that all processing takes place in the EEA.

Where personal data is transferred to a third country, we will rely on a valid transfer mechanism where required, such as an applicable European Commission adequacy decision or appropriate safeguards under Articles 46 et seq. GDPR, including the European Commission’s Standard Contractual Clauses where applicable. Additional measures may be required depending on the circumstances.

8. General Data Storage and Deletion

We retain personal data only for as long as necessary for the purposes for which it is processed, unless longer retention is required or permitted by law. The retention period depends on the type of data, the purpose of processing, contractual requirements, statutory retention duties, and the need to establish or defend legal claims.

When the purpose no longer applies and no legal basis for further storage remains, we delete or anonymise the data. Data retained because of a statutory obligation or legal claim is restricted to the purpose that justifies its retention.

When a user closes their account, we intend to delete the account’s stored customer content, including generated documents, from our active systems. Purchase, invoice, and tax records may need to be retained after account closure for statutory periods. Data held by third-party AI, authentication, analytics, or payment providers may be subject to their own retention periods and deletion procedures.

9. Rights of Data Subjects

Subject to the conditions and exceptions under the GDPR, you may have the right to request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, and data portability. You may also object, on grounds relating to your particular situation, to processing based on Art. 6(1)(e) or (f) GDPR. You have an unconditional right to object to processing for direct marketing, including related profiling.

Where processing is based on consent, you may withdraw consent at any time with effect for the future. You also have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement.

To exercise your rights, contact privacy@dev-doc.io. We may need to verify your identity before responding.

10. Business Services, Accounts, Credits, and Contract Administration

We process the personal data of customers and prospective customers to establish, perform, and administer the contractual relationship for dev-doc.io. This includes account administration, provision of AI documentation features, management of purchased credits, customer support, handling service issues, processing refunds or disputes, and communicating about the service.

Depending on the transaction and information supplied, we may process an email address, user ID, company name or billing details if provided, account and contract information, purchased credit packages, transaction references, credit usage, payment status, and relevant support correspondence.

The legal basis is generally Art. 6(1)(b) GDPR for performing the contract and taking steps at the user’s request before entering into a contract. Where applicable, Art. 6(1)(c) GDPR applies to legal and accounting obligations, and Art. 6(1)(f) GDPR may apply to fraud prevention, IT security, and the protection or enforcement of legal claims.

11. Website Hosting, Application Operation, and Server Logs

We operate the dev-doc.io website and application ourselves on a virtual server hosted in Europe. When the website or application is accessed, the server and related systems may process technical information necessary to deliver the requested pages and maintain secure and reliable operation. This may include IP address, date and time of access, requested URL or resource, referrer, browser and operating system information, response status, transferred data volume, and error or security events.

We use this information to deliver the online service, diagnose technical problems, prevent misuse, investigate security incidents, and maintain the availability and integrity of the application. Where processing is necessary to provide the requested service, the legal basis may be Art. 6(1)(b) GDPR; for security and troubleshooting, it may be Art. 6(1)(f) GDPR.

12. Cookies and Similar Technologies

Our website may use cookies or similar technologies. Some are technically necessary to provide functions you have expressly requested, such as maintaining a login session or remembering a consent choice. Other technologies, including analytics technologies, may require your consent.

Under § 25 TDDDG, storing information on or accessing information from a user’s terminal equipment generally requires consent unless a statutory exception applies, including where the operation is strictly necessary to provide a digital service expressly requested by the user. Any associated processing of personal data must also have a legal basis under the GDPR.

You can manage optional cookies in our cookie settings. You should be able to refuse optional analytics as easily as you can accept it and change your choice later.

13. Registration, Login, and User Account

Users may register and sign in using email/password authentication, Google sign-in, or GitHub sign-in. For account creation and management, we process the data necessary to establish and secure the account, which may include an email address, internal user identifier, authentication status, and account-related timestamps.

Passwords, where used, are stored using an appropriate password-hashing mechanism rather than as readable plain text.

We process account data to create and maintain accounts, authenticate users, provide access to purchased credits and documentation features, protect accounts from unauthorised access, and respond to account-related requests. The legal basis is generally Art. 6(1)(b) GDPR and, for proportionate security measures, Art. 6(1)(f) GDPR.

14. Google Sign-In

If you choose to sign in using Google, authentication is provided through Google’s sign-in service. Google may transmit information needed to authenticate you and connect the sign-in to your dev-doc.io account, such as your email address, name, profile identifier, and authentication result, depending on the permissions and configuration.

We use this information to authenticate you and administer your account. Google may process personal data under its own terms and privacy notice.

15. GitHub Sign-In

If you choose to sign in using GitHub, authentication is provided through GitHub’s OAuth sign-in service. GitHub may transmit information needed to authenticate you and connect the sign-in to your dev-doc.io account, such as your email address, name, username, profile identifier, profile picture, and authentication result, depending on the permissions and configuration.

We use this information to authenticate you and administer your account. GitHub may process personal data under its own terms andprivacy statement.

16. AI-Powered Documentation Generation

dev-doc.io enables users to generate technical documentation with the assistance of artificial intelligence. To provide this feature, we process the prompts, instructions, source code, technical specifications, text, files, and other material that users choose to submit, together with the generated documentation and technical information needed to process requests, administer usage, and troubleshoot errors.

We use multiple AI models and may select or change the model used for a particular task. For security and operational reasons, we do not identify individual model names or model versions in this public notice. This does not mean that relevant information about the legal entities receiving personal data, categories of recipients, processing purposes, processing locations, or international transfer safeguards will be withheld where disclosure is required by law.

We do not use customer prompts, uploaded content, or generated documentation to train general-purpose AI models. This does not by itself mean that AI providers never retain inputs or outputs for operational, abuse-monitoring, security, or other purposes.

The legal basis for processing content submitted to generate documentation is generally Art. 6(1)(b) GDPR, where processing is necessary to provide the service requested by the user. Processing of technical logs for security and troubleshooting may be based on Art. 6(1)(f) GDPR. If a user includes personal data relating to other people in a prompt or file, the user must have a lawful basis and appropriate authority to provide that data.

Please do not submit passwords, API keys, access tokens, private keys, or other secrets.Do not submit personal or confidential information unless you are authorised to do so and it is necessary for the requested output. AI-generated content may be inaccurate or incomplete and should be reviewed before use.

17. Payments, Purchases, and Paddle

We use Paddle in connection with checkout and payment-related services for purchases of credits or other paid features. In connection with a transaction, Paddle may process information such as contact details, billing information, country, transaction and order identifiers, purchase amount, payment status, refunds, disputes, and information required for fraud prevention and compliance.

We process the transaction information needed to associate a purchase with the relevant account, allocate credits, provide the service, handle support requests, and maintain business records. The legal basis is generally Art. 6(1)(b) GDPR for the purchase and Art. 6(1)(c) GDPR for applicable legal and accounting obligations. Art. 6(1)(f) GDPR may apply to fraud prevention and the protection of legal claims.

Paddle may act in its own capacity for certain processing and in another role for other processing, depending on the applicable agreement and service. See thePaddle Privacy Notice.

We do not intentionally store full payment-card details on our own systems where these are collected directly by Paddle. Statutory commercial and tax retention periods may require us to retain transaction or invoice records after an account is closed.

18. Contact and Support Requests

If you contact us by email or through a contact form, we process the information you provide, such as your email address, name if supplied, the content of your message, attachments, and the date of communication. We use this information to respond to your request and manage follow-up.

The legal basis is Art. 6(1)(b) GDPR where the request concerns a contract or pre-contractual measures, and Art. 6(1)(f) GDPR for other enquiries and efficient support. We retain correspondence for as long as necessary to handle the request and, where appropriate, to document the handling of disputes or legal claims.

19. Google Analytics

We use Google Analytics to measure and analyse the use of dev-doc.io and understand aggregate usage patterns so that we can improve the website and service. Depending on the configuration, analytics data may include page views, interactions, timestamps, browser and device information, referrer information, online identifiers or cookie identifiers, and approximate location derived from technical information.

Where consent is required, analytics technologies are activated only after the user has given consent. The legal basis for optional analytics processing is Art. 6(1)(a) GDPR, and § 25 TDDDG applies to storing information on or accessing information from terminal equipment unless an exception applies. Consent can be changed or withdrawn in our cookie settings.

Further information is available in Google’s current privacy documentation:business.safety.google/privacy.

20. Other Embedded Content and Third-Party Services

If dev-doc.io embeds third-party content or uses additional external services, those providers may receive technical data such as the user’s IP address and browser information when the relevant content is loaded. This section applies only to services actually integrated into the website or application. In particular, Google Fonts are used by our websites.

21. Automated Decision-Making

We use AI to generate documentation in response to user requests. The generated content is an output of the requested service.

22. Amendments and Updates

We update this Privacy Policy when changes to our processing activities, services, providers, or applicable law make this necessary. The current version will be made available on dev-doc.io with its effective date. Where the law requires specific notice or renewed consent, we will take the appropriate steps.

23. Definitions

Personal data

Personal data means any information relating to an identified or identifiable natural person, as defined in Art. 4(1) GDPR.

Processing

Processing means any operation performed on personal data, whether or not by automated means, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, restriction, erasure, or destruction.

Controller

The controller is the natural or legal person, public authority, agency, or other body that determines the purposes and means of processing personal data.

Processor

A processor is a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.

Usage and log data

Usage data concerns how users interact with a website or service. Log data records events or activities in a system and may include timestamps, IP addresses, actions, error messages, and technical information used for security, troubleshooting, and performance monitoring.