Privacy Policy
Smartdoxx BV · Last updated: 12 June 2026 · Version 1.0
1. Who we are
This Privacy Policy explains how Smartdoxx BV (“we”, “us”, “our”), provider of the Smartdoxx SaaS platform that automatically generates documentation from source code (the “Service”), processes personal data.
Our details:
- Smartdoxx BV (besloten vennootschap), incorporated in Belgium
- Registered office: Zwijnaardsesteenweg 653, 9000 Gent, Belgium
- Enterprise (KBO/BCE) number: 1033830156 · VAT: BE1033830156
- Data protection contact: info@smartdoxx.com
- Data Protection Officer: We have assessed that we are not required to appoint a DPO under Article 37 GDPR. Data protection matters can be addressed to our contact above.
Controller and processor. Our role depends on the data. We are a controller for personal data about our website visitors, prospects, the people who register and administer accounts, and our own marketing. This Policy covers that processing. When our business customers use the Service, we act as a processor for the personal data processed on their behalf (account users, SmartViewer end-users, notification recipients, and any personal data incidentally present in their source code). That processing is governed by our Data Processing Agreement (Annex B of the Customer Agreement), not by this Policy. Section 9 below summarises it for transparency.
2. Personal data we collect as controller
| Category | Examples | Source |
|---|---|---|
| Account & identity data | Name, business email, account ID, job title, company; hashed passwords | You, at registration |
| Billing data | Billing contact, address, VAT number, invoices and payment history | You / your account billing details |
| Usage & log data | Features used, actions, timestamps, browser/device, IP address, access and audit logs | Automatically |
| Support data | Messages, tickets and attachments sent to info@smartdoxx.com | You |
| Prospect / lead data | Business contact details of potential customers (name, role, company, business email/phone) | You / public sources / lead-generation tools |
| Marketing data | Preferences, email engagement, event sign-ups; customer name & logo as a reference | You / interactions |
| Cookie & analytics data | Identifiers and analytics from our website | Your device, see §8 |
We design the Service to process source code, not personal data, and we do not intend to process special categories of personal data (Article 9 GDPR). Please don’t send us such data through support channels unless necessary.
3. Why we process it and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and manage your account; provide the Service | Performance of a contract (6(1)(b)) |
| Invoicing and payment | Contract / legal obligation (6(1)(b),(c)) |
| Customer support | Contract / legitimate interests (6(1)(b),(f)) |
| Secure, monitor and improve the Service; prevent abuse | Legitimate interests (6(1)(f)) |
| Service / transactional communications | Contract / legitimate interests (6(1)(b),(f)) |
| Prospecting and marketing to business contacts | Legitimate interests, or consent where required (6(1)(f)/(a)) |
| Using your name and logo as a customer reference | Legitimate interests (6(1)(f)), you may object at any time |
| Comply with legal, tax and accounting obligations | Legal obligation (6(1)(c)) |
| Establish, exercise or defend legal claims | Legitimate interests (6(1)(f)) |
Where we rely on legitimate interests, we have weighed them against your rights and you can object at any time (§7). Where we rely on consent (e.g. some marketing, non-essential cookies), you can withdraw it at any time.
4. Who we share data with
We do not sell personal data. We share it with the service providers (processors) that help us run the Service, and with professional advisers, authorities where legally required, and successors in a merger or acquisition. Our current sub-processors are:
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting, infrastructure, backups/object storage | Germany (EEA) |
| Supabase, Inc. | Database & backend, hosting of Generated Documentation in SmartViewer, account data | Frankfurt, Germany (EEA); US parent |
| OpenRouter, Inc. | AI gateway routing requests to the underlying model providers | United States |
| Microsoft Ireland Operations Ltd. | Email/business communication (Exchange Online), document storage (OneDrive), business records | European Union |
| Anthropic / OpenAI / Google / AWS (via OpenRouter) | Large language models for documentation generation, using EU-hosted endpoints where available | EU regions where available |
| Google Ireland Ltd. (Google Analytics) | Website analytics and audience measurement | European Union; US parent |
The authoritative, up-to-date sub-processor list is Annex D of the Customer Agreement, which we maintain and update. All underlying AI models are configured to operate under zero-data-retention terms and to exclude input data from training.
5. International data transfers
Hosting of the Service is on infrastructure in the European Union (Germany), with no transfer of hosted personal data outside the EEA for hosting. For AI processing we route via OpenRouter (US) to EU-hosted model endpoints where technically available, so that AI inference occurs within the EEA where possible.
Where a transfer outside the EEA does occur (e.g. transit through the OpenRouter gateway, or a US-based provider entity), we rely on an appropriate Chapter V GDPR mechanism: an adequacy decision, certification under the EU–US Data Privacy Framework where applicable, and/or the Standard Contractual Clauses (Decision (EU) 2021/914), supplemented by additional safeguards following a transfer impact assessment. The mechanism per sub-processor is identified in Annex D. You can request a copy via info@smartdoxx.com.
6. How long we keep data
| Data | Retention |
|---|---|
| Customer source code | Processed in transit only, in Germany; deleted immediately after each generation. Not retained in persistent storage. |
| Generated Documentation & account data | For the term of the agreement; deleted after the 30-day post-termination grace period |
| Backups | Deleted in the ordinary backup rotation, in any event within 90 days of the original processing |
| Accounting / invoicing records | 7 years (Belgian tax law) |
| Usage & log data | 18 months |
| Support records | 24 months after the ticket is closed |
| Marketing / prospect data | Until you unsubscribe or object, plus a short buffer |
After the periods above we delete or anonymise the data. Our internal data-retention schedule sets out the operational detail.
7. Your rights
Subject to the conditions in the GDPR, you can: access your data; have it corrected; have it erased; restrict or object to processing; receive it in a portable format; and withdraw consent where processing is based on it. We do not carry out solely automated decision-making with legal or similarly significant effects.
To exercise these rights, contact info@smartdoxx.com. We respond within one month. If you are an end-user of a customer’s account (e.g. a SmartViewer reader or notification recipient), please direct your request to that customer, who is the controller; we will assist them as processor and will forward any request we receive.
Complaints. You can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be.
8. Cookies and tracking
Our website uses strictly necessary cookies to function and, with your consent, analytics and preference cookies. We use Google Analytics (provided by Google Ireland Ltd.) to understand how visitors use our website and to improve it; Google Analytics sets cookies and processes identifiers and usage data such as pages viewed, approximate location, and device and browser information. These analytics cookies are only set after you give consent through our cookie banner.
You can manage or withdraw your consent for non-essential cookies at any time via our cookie banner or your browser settings. You can also opt out of Google Analytics using Google’s browser add-on. Where Google Analytics involves a transfer of data outside the EEA, this is covered by the transfer mechanisms described in Section 5.
9. When we act as processor (Customer Data)
When customers use the Service, we process personal data on their behalf and on their instructions, as set out in our DPA. In summary:
- Data subjects: account users/administrators, SmartViewer end-users, notification recipients, and any individuals incidentally present in source code.
- Data categories: identification/contact data, authentication data (hashed/encrypted), technical and log data, notification email addresses, and incidental data in code/comments/commit metadata.
- Source code: processed in transit only, in Germany, kept logically separated, deleted immediately after generation, never used to train AI.
- Breach notice: we notify the controller without undue delay and within 48 hours of becoming aware.
- Deletion: on termination, data is deleted after a 30-day export grace period, subject to backup rotation and legal retention.
The full terms, including sub-processor change notifications and audit rights, are in Annex B (DPA) of the Customer Agreement.
10. How we protect your data
We maintain commercially reasonable technical and organisational measures, including: encryption of data in transit; logical separation of each customer’s data; access controls on a need-to-know basis; secure storage of credentials and access tokens; processing of source code in transit only with immediate deletion after generation; and hosting within the EU (Germany). We review these measures periodically and may pursue certifications such as ISO 27001 or SOC 2 in future.
11. Children
The Service is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16.
12. Changes to this Policy
We may update this Policy from time to time. We will post the new version with an updated date and, for material changes, notify you by email or in-app notice.
13. Contact us
- Smartdoxx BV
- Zwijnaardsesteenweg 653, 9000 Gent, Belgium
- Email: info@smartdoxx.com