Privacy Policy

EnderDevelopment Privacy Policy

Last updated: October 31, 2026

This Privacy Policy describes how YecoAI, operating under the EnderDevelopment brand ("we", "us", or "our"), collects, uses, stores, and protects your personal data in compliance with the General Data Protection Regulation (GDPR - EU 2016/679), the UK GDPR, the California Consumer Privacy Act (CCPA), the Brazilian Lei Geral de Proteção de Dados (LGPD), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable privacy laws worldwide.

1. Data Controller

The Data Controller for all EnderDevelopment services is:

YecoAI is the sole Data Controller for all personal data processed through EnderDevelopment services. EnderDevelopment is a brand/project of YecoAI and does not constitute a separate legal entity.

2. Data We Collect

We collect data to provide, improve, and secure our development services:

• Account Information: Name, email address, profile data, and authentication credentials provided through our account system.
• Usage Data: Input history, generated code configurations, feature usage patterns, and technical logs (IP address, browser type, device information, operating system).
• Payment Data: Transaction details processed via Stripe or PayPal. We do not store full credit card numbers on our servers — these are handled entirely by our payment processors.
• Communication Data: Support tickets, chat logs, email correspondence, and feedback submitted to us.
• Behavioral Data: Click patterns, navigation paths, and interaction data collected through analytics tools (only with your consent).

3. Purposes of Processing

We process your personal data for the following purposes:

• Service Delivery: To provide, maintain, and improve our AI-powered development tools and services.
• Account Management: To create and manage your account, authenticate your identity, and provide customer support.
• Payment Processing: To process transactions, send invoices, and manage billing.
• Security: To detect, prevent, and address fraud, abuse, security issues, and technical problems.
• Analytics: To analyze usage patterns and improve our services (only with your consent where required).
• Marketing: To send internal promotional communications, product updates, and announcements (with your consent where required, and with the ability to opt-out).
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

4. Marketing & Promotional Consent

5. Legal Basis for Processing

Our processing is based on the following legal bases under GDPR Art. 6:

• Contractual Necessity (Art. 6(1)(b)): To provide the services you requested and fulfill our contractual obligations.
• Legitimate Interest (Art. 6(1)(f)): For platform security, fraud prevention, and service operation.
• Legal Obligation (Art. 6(1)(c)): For tax, accounting, and regulatory compliance as required by Italian and EU law.
• Consent (Art. 6(1)(a)): For marketing activities, analytics tracking, and optional data processing.

6. Data Retention & Security

We implement industry-standard security measures, including AES-256 encryption, HTTPS/TLS protocols, and regular security audits. Data is retained only for as long as necessary to fulfill the purposes outlined or as required by legal retention periods:

• Account Data: Retained for the duration of your account plus 12 months after deletion, or as required by law.
• Payment Records: Retained for 10 years as required by Italian tax law (D.P.R. 600/1973).
• Security Logs: Retained for up to 24 months for security and fraud prevention purposes.
• Marketing Data: Retained until you withdraw consent or request deletion.
• Analytics Data: Retained for up to 14 months (Google Analytics) from collection, only if you accept analytics cookies.

7. Third-Party Data Processors

We utilize trusted third-party services to operate our platform. All processors are bound by data processing agreements compliant with GDPR Art. 28:

• AI model providers: Process the prompts you submit to generate code. Check each provider's data-use settings for training. (OpenAI, Anthropic)
• PayPal: Payment processing for purchases. (PayPal Privacy)
• Google Analytics (GA4): Anonymous traffic analysis — only activated with your explicit consent. Data may be processed in the United States under Standard Contractual Clauses. (Privacy Policy)
• Cloudflare Insights: Website performance and security measurement. Cloudflare may process IP addresses and technical data. (Cloudflare Privacy Policy)

8. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States. Where such transfers occur, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs): We use EU-approved Standard Contractual Clauses with processors outside the EEA.
• Adequacy Decisions: Where the European Commission has recognized a country as providing adequate data protection.
• EU-US Data Privacy Framework: Where applicable, we rely on the EU-US Data Privacy Framework for transfers to certified US organizations.

9. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify:

• The relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Art. 33.
• You directly without undue delay, where the breach is likely to result in a high risk to your rights and freedoms, as required by GDPR Art. 34.

10. Children's Privacy

Our services are not directed to children under the age of 14. We do not knowingly collect personal data from children under 14. If we become aware that we have collected personal data from a child under 14 without verification of parental consent, we will take steps to delete such information. If you believe we have collected data from a child under 14, please contact us at [email protected].

11. Your Rights

11.1 GDPR Rights (EU/EEA/UK Users)

Under the GDPR and UK GDPR, you have the following rights:

• Right of Access (Art. 15): Obtain confirmation of whether your data is processed and a copy of such data.
• Right to Rectification (Art. 16): Request correction of inaccurate personal data.
• Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
• Right to Restriction (Art. 18): Request restriction of processing in certain circumstances.
• Right to Data Portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interest or for direct marketing purposes.
• Right to Withdraw Consent (Art. 7): Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
• Right to Lodge a Complaint: Lodge a complaint with a supervisory authority. The Italian supervisory authority is the Garante per la protezione dei dati personali (www.garanteprivacy.it).

11.2 CCPA Rights (California Residents)

Under the California Consumer Privacy Act, you have the right to:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect, the purposes for which we use it, and the categories of third parties with whom we share it.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell personal information. You have the right to opt-out of any future sale of personal information.
• Right to Non-Discrimination: You will not be discriminated against for exercising your CCPA rights.

To exercise your CCPA rights, contact us at [email protected]. We will respond to verified requests within 45 days.

11.3 LGPD Rights (Brazilian Users)

Under the Brazilian General Data Protection Law, you have the right to:

• Confirm the existence of processing and access your data.
• Correct incomplete, inaccurate, or outdated data.
• Anonymize, block, or delete unnecessary or excessive data.
• Request data portability.
• Delete personal data processed with your consent.
• Obtain information about sharing your data with public entities.
• Revoke consent at any time.

11.4 PIPEDA Rights (Canadian Users)

Under PIPEDA, you have the right to:

• Access your personal information held by us.
• Request correction of inaccurate information.
• Withdraw consent for data processing, subject to legal and contractual restrictions.
• Challenge our compliance with PIPEDA.

11.5 Exercising Your Rights

To exercise any of these rights, please contact us at [email protected] or [email protected]. We will respond to your request within 30 days (or as required by applicable law). We may request verification of your identity before processing your request.

12. Automated Decision-Making & Profiling

We do not use automated decision-making that produces legal effects or similarly significant effects concerning you. We may use automated profiling for security purposes (e.g., fraud detection, abuse prevention) and service improvement, but such profiling does not produce legal effects. You have the right to object to such profiling under GDPR Art. 22.

13. Cookies & Tracking Technologies

For detailed information about our use of cookies and tracking technologies, please refer to our Cookie Policy.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a prominent notice on our website or sending an email to the address associated with your account. Your continued use of our services after such changes constitutes acceptance of the updated Privacy Policy.

15. Contact & Supervisory Authority

For any privacy-related inquiries, to exercise your rights, or to file a complaint:

• Data Controller: YecoAI di Marco Nasi — Ditta Individuale
• Email: [email protected]
• PEC: [email protected]
• EnderDevelopment Support: [email protected]
• Legal Notice: Legal Notice / Imprint

You have the right to lodge a complaint with the Italian supervisory authority: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it.