Privacy Notice

iScholarX LLC, a New Jersey limited liability company with its place of business at Robbinsville, New Jersey 08691, United States, operates ScodyX and is the controller (and, under United States privacy laws, the business) responsible for the personal data described here. Privacy requests and notices go to legal@scodyx.com; product and account questions go to support@scodyx.com.

• Account data — name, email address and login credentials, to create and secure your account (performance of our contract).
• Workspace and team data — workspace names, member roles and invite email addresses, to operate shared workspaces (contract).
• Project content — your prompts, generated files and chat history, to provide the Service and let you resume work (contract).
• Usage and credit records — build runs, engine used and credits spent, for billing accuracy and abuse prevention (contract and legitimate interests).
• Technical data — IP address, device and browser identifiers, and error logs, for security, fraud prevention and reliability (legitimate interests).
• Support messages — what you send us, to answer you (contract and legitimate interests).
• Marketing — where you opt in, to send product updates (consent, withdrawable at any time).

• Merchant of Record — Paddle, for the sale of our plans, subscription management, payments, tax compliance and invoicing.
• Infrastructure and AI providers — hosting and database providers, and the AI model providers that process your prompts to generate code.
• Professional advisers — legal and accounting, where necessary.
• Authorities — where required by law.

We do not sell personal data.

We keep account, workspace and project data for as long as your account is active. After closure we delete or anonymise it within 90 days, except records we must retain for legal, tax or accounting purposes. Credit and billing records are kept for the period required by applicable law.

Operational backups are taken daily and retained for 7 days, so a copy of your data may persist in a backup for up to 7 days after deletion. Because backups are daily, a restore-from-backup can lose up to 24 hours of the most recent data; the backup and recovery terms are set out in section 8 of the Terms & Conditions.

We operate from the United States and our hosting, database and AI model providers process data in the United States and, depending on the provider, in the European Union and United Kingdom. Where personal data of a UK or EEA resident is transferred to us or to a provider outside those regions, the transfer relies on appropriate safeguards — UK/EU Standard Contractual Clauses with the UK addendum, or an adequacy decision. The current provider list is on our subprocessors page.

Subject to applicable law you may request access to your data, correction, erasure, restriction of processing, portability, or object to processing based on legitimate interests, and you may withdraw consent where we rely on it. Signed-in members can download a copy of their workspace data and raise an export, correction, restriction or deletion request from the data controls page inside the workspace, and track the status of each request there. You can also email legal@scodyx.com. We respond within one month (45 days for United States requests) and will tell you if a complex case needs longer; we do not charge for a request and we will not treat you differently for making one.

If you are in the UK or EEA you may also complain to your supervisory authority. If you are a resident of California, Colorado, Connecticut, Virginia, Texas or another United States state with a comprehensive privacy law, you have the rights to know, access, correct, delete, obtain a portable copy, and to opt out of targeted advertising, sale, and profiling with legal effects. We do not sell personal data, do not share it for cross-context behavioural advertising, and do not use it for that kind of profiling, so there is nothing to opt out of; you may still submit a request to confirm this. An authorised agent may act for you where the law allows, and we may ask you to verify the request.

Prompts and project files you submit are sent to the AI model provider you select so it can generate code, and to our fallback provider when the selected engine is unavailable. We do not use your prompts or generated code to train our own models, and we contract with those providers on terms that do not permit training on your content. We make no automated decision that produces a legal or similarly significant effect on you.

ScodyX is not directed at children. We do not knowingly collect personal data from anyone under 16, and accounts require you to be of legal age in your jurisdiction. If you believe a child has given us data, email legal@scodyx.com and we will delete it.

Strictly necessary cookies and local browser storage keep you signed in and remember workspace and theme preferences; these are always on because the product cannot work without them. Analytics and marketing cookies are off until you allow them, and you can change your choice at any time on the cookie settings page, which lists each category and its purpose. We do not use advertising cookies and do not sell personal data. Clearing cookies and storage in your browser also clears the choice recorded on that device, and signing in again will be required.

We apply appropriate technical and organisational measures, including encryption in transit, row-level access controls on stored data, and least-privilege access for staff and services. Generated apps run in an isolated sandbox with no access to your account data. The authentication, isolation, encryption and incident-response practices we operate are described on our security page. No service can promise absolute security, so that page describes practice rather than a guarantee.

When we change this notice we update the date at the top of this page, and for material changes we notify account holders by email or in the product before the change takes effect.