Privacy Policy

1. Who we are

CodeWall Ltd is the data controller for the personal data described in this policy.

• Company: CodeWall Ltd, registered in England and Wales, company number 17124935.
• Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ.
• ICO registration reference: C1959199.
• Contact: legal@codewall.ai

2. Controller and processor roles

This policy covers personal data for which CodeWall is the controller — for example, data about website visitors, account users and business contacts.

When you use the Platform to test your own systems, CodeWall acts as a processor of any personal data within your environment or test data. You remain the controller of that data, and our handling of it is governed by the data processing terms in your customer agreement (Design Partner Agreement or equivalent), not by this policy.

The Platform is intended for business users aged 18 or over. We do not knowingly collect personal data from children.

3. Personal data we collect

• Account and contact data: name, work email, job title, organisation and login credentials.
• Usage and technical data: IP address, device and browser information, and activity logs from your use of the website and Platform.
• Communications: messages, support requests and feedback you send us.
• Billing data: where applicable, billing contact and transaction details (card payments are handled by our payment provider).

We collect this directly from you and automatically through your use of our website and Platform.

4. Why we use it, and our lawful bases

• To provide, secure and support the Platform and your account — performance of a contract.
• To operate, protect and improve our website and services and prevent misuse — legitimate interests.
• To analyse anonymised and aggregated usage data to improve the Platform — legitimate interests.
• To send service messages, and marketing where you have opted in — legitimate interests (service) / consent (marketing).
• To meet legal, tax and regulatory obligations — legal obligation.

5. Who we share it with

We share personal data only with:

• Sub-processors that host and support the Platform (including our cloud hosting providers), under written contracts.
• AI model providers (including OpenAI, Anthropic and Google) used to deliver Platform features. Personal data is sanitised and anonymised before it is transmitted to any AI provider, so individuals are not identifiable, and we do not use customer data to train AI models.
• Professional advisers, auditors and authorities, where required by law or to protect our legal rights.

We do not sell personal data.

6. International transfers

Some providers process data outside the UK. Where they do, we rely on appropriate safeguards — UK adequacy regulations or the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses).

7. How long we keep it

We keep personal data only as long as necessary for the purposes above. On termination of a customer relationship, customer data is deleted or returned within 30 days, subject to any legal retention requirement. Account and business records are kept for the duration of the relationship and a reasonable period afterwards to meet our legal obligations.

8. How we protect it

We maintain an Information & Cyber Security Policy aligned to ISO/IEC 27001, SOC 2 and the NIST Cybersecurity Framework, including encryption of data in transit and at rest, access on a need-to-know basis, and a documented incident-response process. If you become aware of a security issue, contact security@codewall.ai.

9. Automated processing

The Platform uses AI agents to test systems and generate security findings about your infrastructure. This does not involve automated decisions that produce legal or similarly significant effects concerning individuals.

10. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict or object to our use of your personal data, to data portability, and to withdraw consent at any time. To exercise these rights, contact legal@codewall.ai.

You also have the right to complain to the Information Commissioner's Office (ICO) — ico.org.uk, or 0303 123 1113.

11. Cookies

Our website uses essential cookies to function, and analytics cookies to understand usage. You can control non-essential cookies through your browser or our cookie banner.

12. Changes to this policy

We may update this policy from time to time. The “last updated” date shows the current version, and we will notify material changes through the Platform or by email.

13. Contact

Questions about this policy or your personal data: legal@codewall.ai — CodeWall Ltd, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ.