Privacy Policy (Datenschutzerklärung)
This English version and the German version say the same thing. Should they ever differ, the German version prevails — we are a German controller under a German supervisory authority, and a translation should not be able to change what we owe you.
1. Privacy at a Glance
Protecting your personal data is our top priority. Below, we inform you about what data we collect, process, and store during your visit and use of our platform (Free Community Edition).
Controller: Felix Frenzel, Hellerstraße 9, 96047 Bamberg, Germany, E-Mail: info@clean-core.io.
Data protection officer: none has been appointed. Clean-Core.io is run by one person; the thresholds of Art. 37 GDPR and § 38 BDSG are not met — we do not employ twenty or more people on data processing, our core activity is not regular systematic monitoring, and we process no special categories of data. Write to the address above for any data-protection question; it reaches the controller directly.
2. Data Collection & Processing Purposes
We process personal data of our users only as far as necessary to provide a functional platform as well as our contents and services.
- Google Authentication (Firebase Auth): To sign in, we use Google Sign-In. This securely reads your name, email address, and profile picture from your Google account to authenticate your user session and establish access privileges. Legal basis: Art. 6(1)(b) GDPR.
- Email and password (Firebase Auth): You can also register with an email address and a password instead of using Google. In that case we process the email address and the first and last name you enter. The password itself is handled by Firebase Authentication and is never visible to us. Legal basis: Art. 6(1)(b) GDPR.
- Your motivation (optional): the free-text note you may add when registering. It is voluntary, it has no effect on whether you get access, and one line to info@clean-core.io is enough to have it deleted — we do not ask why. Legal basis: Art. 6(1)(a) GDPR — your consent, which you may withdraw at any time with effect for the future.
- Transactional email (Resend): we send you the mails the service itself requires — confirming an address, an invitation you asked us to send, a notice about your account. Beyond these there is no newsletter and no advertising mail; the only other mail is the community mail described next, and only if you switch it on. Your address is passed to our mail provider for delivery and for nothing else. Legal basis: Art. 6(1)(b) GDPR for the mails that are part of the service, and Art. 6(1)(f) GDPR for those that keep it secure.
- Community mail (optional): surveys about what we should build next and occasional community updates. You receive them only if you switch on "Community mail" in your account settings; it is off until you do. We store the setting on your profile with the time you last switched it on and the time you last switched it off, so that we can show whose consent a mail rested on. You can withdraw at any time, with effect for the future — with the same switch, or with the unsubscribe link in every such mail, which also switches the setting off. Your address then goes on an unsubscribe list so that it is not mailed again; switching the setting back on removes it. Legal basis: Art. 6(1)(a) GDPR — your consent, which you may withdraw at any time with effect for the future.
- Firestore User Profiles: We store metadata about your platform usage (e.g., number of performed code transformations, system limits, as well as your first and last name) in our secure database. Legal basis: Art. 6(1)(b) GDPR for the counters that make the free quota work, and Art. 6(1)(f) GDPR for operating and securing the platform.
- Bring Your Own Key (BYOK): Providing your own key is optional; without it, transformations use a shared community key within your free quota. If you configure your own Google Gemini API key in the settings, this key is encrypted and stored in our secure Firestore instance. It is used exclusively to forward your transformation requests directly via a secure backend proxy to the Gemini API, never exposing your key to the browser. Legal basis: Art. 6(1)(b) GDPR — you supply the key so that we can perform the service with it.
- Security audit records: administrative actions on an account — approval, revocation of access, deletion — are recorded with the acting administrator, the affected account and the time, so that privileged actions remain accountable. Legal basis: Art. 6(1)(f) GDPR. Retention: see section 6.
- Invitations you send: if you invite someone to read a project, we store the email address you entered in order to send the link and to check it when that person signs in. Legal basis: Art. 6(1)(f) GDPR — operating the sharing feature a user asked for. The invited person is informed about this in the invitation email itself (Art. 14 GDPR); section 8 describes the whole mechanism.
Do you have to provide this data? There is no legal obligation to give us anything, and no contractual duty to register at all. Our public pages, the documentation and the offline verifier work without an account. But signing in is technically required to use the platform itself: without an email address and a name we cannot create an account, keep your projects apart from other people's, or enforce the free quota — so if you do not provide them, the platform cannot be used. Everything marked optional above (your motivation, community mail, your own API key) can be left out with no consequence other than the loss of that particular feature.
Minimum age: Clean-Core.io is a tool for professional software work and is not directed at children or young people. You must be at least 18 years old to create an account; the Terms of Service say the same. We do not verify age — asking for proof would mean collecting more personal data than the service needs, not less — but we will delete an account on notice that it belongs to someone younger.
Please do not upload personal data. ABAP often carries it without anyone meaning to: a developer's user id, a name in a comment, a real customer number, a test record from production. Strip those before you upload. We do not offer a data processing agreement under Art. 28 GDPR, and the platform is not meant for processing personal data — the Terms of Service put this as an obligation, and section 3 explains what happens to what you do upload. This is a rule we ask you to keep; the platform does not detect or block it.
3. Processing of Source Code & Project Assets
The ABAP source files you upload and the generated modernization artifacts (such as solution designs, TypeScript code, and test cases) are stored in our secure Google Firebase cloud environment in Europe.
Who can read your project: the account that created it, and anyone that account invites to read it — no one else, and since 16 September 2026 not our administrator either. There is one exception, an emergency, and it is described in Section 8, which also sets out the whole picture and names the rules you can read for yourself.
Important Security Notice: We do not sell, rent, or use your uploaded source code for commercial purposes. For AI-driven modernization, source code is transmitted via secure, authenticated channels to the Google Gemini API using stateless API requests. Which of Google's data-use terms apply depends on the key that makes the request. The shared community key is a paid Gemini API key, so the paid Gemini API terms govern every request made with it: Google does not use your code to train its models. When you use your own key (BYOK), the terms of your own Google account apply — a key on Google's free tier is governed by Google's free-tier data-use terms, which differ. Which terms apply therefore depends on the key you use, and you can see in the settings which one is in use.
4. Hosting & Subprocessors
To provide this service, we rely on the following subprocessors:
- Google Cloud Platform & Firebase: hosting of the application (Cloud Run) and the database (Firestore) on European servers in the Belgium (europe-west1) region — data residency in the EU, operated in line with GDPR requirements.
- Firebase Authentication (Google Identity Platform): the sign-in — your email address, your name, the password handled by Firebase, and with Google Sign-In your Google profile. Unlike hosting and database, this Google service is not tied to a region, so your sign-in data may be processed outside the EU; the international transfers paragraph below covers it.
- Google Gemini API: Generative AI models for the model-written parts of the service — the analysis narrative, business names and sentences for the process reconstructed from the code, the solution design, the code proposal, the documentation and the test suite — via secure stateless proxy layers. The findings, the route and the Clean Core Score are computed without a model.
- Resend: Transactional email delivery (e.g. access-approval and status notifications) and, only if you switched it on, community mail. Your email address is processed to send these messages.
International transfers: Google and Resend are US-based providers, and this covers every Google service named above — including Firebase Authentication, which is not tied to an EU region. Both are certified under the EU-U.S. Data Privacy Framework, so a transfer to them rests on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). Where a transfer is not covered by that certification, it is safeguarded by the EU Standard Contractual Clauses (Art. 46 GDPR) together with the providers' data-processing terms. You may request a copy of these safeguards from us at any time (Art. 13(1)(f) GDPR) — write to info@clean-core.io. Hosting (Cloud Run) and the database with your profile and your projects (Firestore) remain in the EU (europe-west1).
5. Your Rights Under GDPR (including Art. 17 Deletion)
Since our platform is hosted in compliance with EU regulations, you have all rights under the General Data Protection Regulation (GDPR):
- Right of Access (Art. 15 GDPR)
- Right to Rectification (Art. 16 GDPR)
- Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR)
- Right to Restriction of Processing (Art. 18 GDPR)
- Right to Data Portability (Art. 20 GDPR)
- Right to Object (Art. 21 GDPR) — see the box below
- Right to Withdraw Consent (Art. 7(3) GDPR)
- Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)
Your right to object (Art. 21 GDPR)
Where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR — operating and securing the platform, the security audit record, and the invitations you send), you have the right to object at any time, on grounds relating to your particular situation. Send the objection to info@clean-core.io; a sentence naming the processing you object to is enough. We will then stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. Community mail (section 2) goes out only with your consent, and you can stop it at any time and without giving reasons — withdraw the consent or object under Art. 21(2) GDPR, with the switch in your settings, the unsubscribe link in the mail, or a line to us, and it stops. Beyond that we do not use your data for direct marketing.
To exercise these rights, particularly to erase your data, you can trigger account deletion directly in your Profile Settings under the Danger Zone, which immediately deletes your live database and authentication entries, including every project and the source code in it. A single project can be deleted on its own at any time from your dashboard. Residual copies in encrypted backups age out within 30 days (see section 6). Alternatively, contact us at info@clean-core.io.
What deletion does not reach: three things outlive it, and saying so is more useful than a clean sentence. The security audit record keeps the administrative actions taken on an account — approval, revocation, deletion — with the affected account, for 24 months from the action; without it, a privileged action could not be traced to anyone, and we may keep it under Art. 17(3)(e) and Art. 6(1)(f) GDPR. And "immediately" means the live database and the sign-in: copies inside encrypted backups age out on their own schedule, within 30 days, and are not restored selectively. And the weekly reports to the operator sent until 30 September 2026 named new accounts with name and address; those mails sit in the operator's mailbox and with the mail provider, and a deletion does not reach them. Since 30 September 2026 the report carries figures only. Everything else goes at once.
Supervisory authority: you can complain to any supervisory authority, in particular in the EU member state of your residence, place of work or the place of the alleged infringement. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.
6. Legal Basis & Data Retention
Legal basis (Art. 6 GDPR): the basis is stated with each purpose in section 2, because one blanket sentence would not tell you which rule covers which processing. In short: performing the service you request (Art. 6(1)(b)), operating and securing the platform under our legitimate interest (Art. 6(1)(f)), and your consent where something is optional (Art. 6(1)(a)), which you may withdraw at any time with effect for the future. The emergency access described in section 8 rests on Art. 6(1)(f) — keeping the platform and its users safe from malicious content.
Retention: Personal data is retained for the life of your account and removed on account erasure (Art. 17); residual copies in encrypted backups age out within 30 days. The periods that are not simply "as long as the account exists":
- Server and access logs: 30 days (see section 9).
- Encrypted backups: a daily copy for 7 days and a weekly copy for 28 days, so nothing survives beyond 30.
- Security audit record: 24 months from the recorded action, then deleted. The period covers two annual reviews, which is what makes a privileged action traceable long enough to be accountable without keeping administrator identities indefinitely.
- Community mail: the setting and the times of your latest opt-in and withdrawal for as long as the account exists; the entry on the unsubscribe list until you switch community mail back on or the account is erased.
- Rate-limit counters: they expire with their own window, minutes to hours. The key is a salted hash, so no address is stored in readable form.
- Your own Gemini key and your Google profile picture: for as long as you keep them — the key until you delete it in the settings or your account goes, the picture reference until your account goes.
Retention per collection is documented in docs/DATA-RETENTION.md in our public source repository — as additional transparency, not as the place you have to look.
No automated decision-making (Art. 22 GDPR): we use AI models to analyse and transform the code you upload. They produce text, diagrams and code — they make no decision about you. There is no automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you. Whether an account is approved, restricted or deleted is decided by a person.
8. Who Can Open Your Projects
Only the account that created a project can open it, including the ABAP source code in it — and anyone that account has invited to read it. No account you have not invited has standing access, and our administrator account does not either: the security rules that govern every read from the browser — published as firestore.rules in our public source repository, where you can read them yourself — grant the owner and the accounts the owner invited, and no one else.
An invitation is reading only, and you can take it back. You invite someone by entering their email address, and we send a link to that address. The link opens only for a signed-in account whose own, confirmed email address is the one you invited, so a forwarded link opens nothing for anybody else. What it grants is reading — the whole project, including the ABAP source code you uploaded — and nothing beyond that: analysing, confirming, signing and exporting stay with you. The invitation link expires by itself if nobody accepts it — after fourteen days unless you choose otherwise, and after ninety at the latest. Once accepted, reading continues until you withdraw it. A project can have at most three invitations waiting at once, and you can see at any time who has access and withdraw it. A withdrawal takes effect in the security rules themselves, immediately, and not only in what the screen shows. What the other person has already read or downloaded is with them, as it would be with any document you hand to someone.
We store the address you entered together with the invitation, because the link has to be checked against it and because you have to be able to see whom you invited. No browser can read it, not even yours — your overview of who has access is answered by our server, and it names only the people who actually accepted. The invitation is deleted with the project, and it is deleted when the person it names erases their Clean-Core.io account. Because we did not get that address from the person it belongs to, the invitation email itself tells them what we hold, why, on what basis and for how long (Art. 14 GDPR), and names the rights in section 5 — including the right to object under Art. 21. We process the address on our legitimate interest in running the sharing feature a user asked for (Art. 6(1)(f) GDPR).
The one exception is an emergency, such as a credible report that an upload contains malicious code. Reaching a project then is a deliberate act by the operator on the server, not a permission that stands open, and it leaves a record. Administrative actions on an account — approval, revocation of access, and deletion — are likewise recorded in an audit log together with the acting administrator, the affected account and the time. Apart from the people you invite yourself, we do not pass project content to anyone other than the subprocessors named in section 4.
9. Server Logs
Everything above is about people with an account. This section is about everybody, because a web server cannot answer a request without seeing where to answer to.
When you open a page or our server calls a model on your behalf, our hosting records the request: your IP address, the date and time, the path requested, the response status, the amount of data sent, the referring page and your browser's user-agent string. These logs exist to keep the service running and safe — to find an error you ran into, to see that a route is failing, and to recognise abuse. We do not use them to build a profile, and they are not combined with your account to analyse your behaviour. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating and securing the platform.
They are kept for 30 days and then deleted automatically by Google Cloud Logging. The same applies to the error reports our application writes when something goes wrong.
One related record: to stop a single caller from exhausting the free quota or the mail route, we count requests per caller in a short sliding window. The counter's identifier is a salted hash of the account and the IP address, never the address itself, and the record expires with its own window — minutes to hours. You can object to the processing in this section at any time under Art. 21 GDPR; see section 5.