Privacy Notice

iScholarX LLC, operator of ScodyX, is the data controller for the personal data described here. For any privacy question or request, contact support@ischolarx.com.

• Account data — name, email address and login credentials, to create and secure your account (performance of our contract).
• Workspace and team data — workspace names, member roles and invite email addresses, to operate shared workspaces (contract).
• Project content — your prompts, generated files and chat history, to provide the Service and let you resume work (contract).
• Usage and credit records — build runs, engine used and credits spent, for billing accuracy and abuse prevention (contract and legitimate interests).
• Technical data — IP address, device and browser identifiers, and error logs, for security, fraud prevention and reliability (legitimate interests).
• Support messages — what you send us, to answer you (contract and legitimate interests).
• Marketing — where you opt in, to send product updates (consent, withdrawable at any time).

• Merchant of Record — Paddle, for the sale of our plans, subscription management, payments, tax compliance and invoicing.
• Infrastructure and AI providers — hosting and database providers, and the AI model providers that process your prompts to generate code.
• Professional advisers — legal and accounting, where necessary.
• Authorities — where required by law.

We do not sell personal data.

We keep account, workspace and project data for as long as your account is active. After closure we delete or anonymise it within 90 days, except records we must retain for legal, tax or accounting purposes. Credit and billing records are kept for the period required by applicable law.

Our providers may process data outside your country, including outside the UK and EEA. Where that happens we rely on appropriate safeguards such as UK/EU Standard Contractual Clauses or an adequacy decision.

Subject to applicable law you may request access to your data, correction, erasure, restriction of processing, portability, or object to processing based on legitimate interests, and you may withdraw consent where we rely on it. Email support@ischolarx.com and we will respond within one month. If you are in the UK or EEA you can also complain to your supervisory authority.

We apply appropriate technical and organisational measures, including encryption in transit, row-level access controls on stored data, and least-privilege access for staff and services. Generated apps run in an isolated browser sandbox with no access to your account data.

Strictly necessary cookies and local browser storage keep you signed in and remember workspace and theme preferences; these are always on because the product cannot work without them. Analytics and marketing cookies are off until you allow them, and you can change your choice at any time on the cookie settings page, which lists each category and its purpose. We do not use advertising cookies and do not sell personal data. Clearing cookies and storage in your browser also clears the choice recorded on that device, and signing in again will be required.

Signed-in members can download a copy of their workspace data and raise an export, correction, restriction or deletion request from the data controls page inside the workspace, and track the status of each request there. We aim to respond within one month of receiving a request and will tell you if a complex case needs longer. You can also email support@ischolarx.com, or complain to your local supervisory authority.

We describe the authentication, isolation, encryption and incident-response practices we operate on our security page. No service can promise absolute security, so that page describes practice rather than a guarantee.