Privacy Policy

VULK is a product operated by Code Ahead Lda. We provide an AI-powered platform that helps users build full-stack applications from natural language. We are committed to protecting your privacy and handling your information transparently.

This Privacy Policy describes how your personal information is collected, used, and shared when you visit, subscribe, register, or make a purchase from https://vulk.dev (the "Site").

Personal information we collect

When you visit the Site, we automatically collect certain information about your device, including information about your web browser, IP address, time zone, and cookies installed on your device. Additionally, as you browse the Site, we collect information about the individual pages you view, what websites or search terms referred you to the Site, and how you interact with the Site. We call this automatically collected information Device Information.

• Cookies — data files placed on your device, often including an anonymous unique identifier. (Learn more about cookies and how to disable them: allaboutcookies.org.)
• Log Files — track actions on the Site and collect IP address, browser type, ISP, referring/exit pages, and timestamps.
• Web Beacons, Tags, and Pixels — electronic files to monitor site usage and interaction.
• Plausible Analytics (privacy-first, no cookies) — page views and high-level traffic metrics. Microsoft Clarity and Google Analytics 4 are loaded only after consent where required.

Order information

When you subscribe or make a purchase through the Site, we collect information such as your name, email address, billing address, payment details (processed securely via Stripe), and any other relevant data necessary to manage your subscription and account.

Project information

When you generate, edit, or deploy a project through VULK, we store the prompts you submit, the generated source files, deployment metadata, and billing usage. Code is owned by you (see Terms § 3) — you may export and delete it at any time. Prompts may be used in aggregate, fully de-identified form for service improvement; opt-out is available on Max and Business plans.

How we use your personal information

We use the collected Order Information to:

• Process your orders, payments, and generate invoices
• Communicate with you about your account, plan changes, and billing
• Screen for potential fraud or risks
• Provide you with information or promotions related to our services, when aligned with your preferences

We use the collected Device Information to:

• Improve and optimize the Site experience
• Analyze customer interactions for performance tracking
• Screen for potential risk and fraud (rate-limit abuse, brute-force attempts)

Sharing your personal information

We share your Personal Information with trusted third-party service providers who help us operate effectively:

• Stripe — secure subscription billing and 3DS card authentication. (Stripe Privacy Policy.)
• OpenRouter / Vertex / OpenAI / Anthropic / xAI — AI model inference. Prompts are sent for the duration of generation only; providers commit not to train on user content (per their respective terms). On the iOS app, an explicit consent dialog is shown before the first generation as required by App Store Review Guideline 5.1.2(i).
• Cloudflare — CDN, DDoS protection, edge compute.
• AWS RDS (Frankfurt) — primary database, EU-hosted.
• Resend — transactional email delivery.
• Sentry — error tracking. PII is scrubbed before submission via beforeSend hooks.
• Google Analytics & Meta Pixel / CAPI — only after consent. (Google Privacy Policy.)

We do not sell or rent your personal information. We disclose your information only when required by law or to protect our rights.

AI generation and third-party model providers

VULK is an AI app builder. To turn your prompts into working code, we forward the prompt and any attached images, files, or context you choose to share to a third-party large language model. We never sell prompts and we never use them to train our own models.

The providers we route to are:

• OpenRouter — orchestration layer that routes the prompt to the underlying model we picked for that task.
• Anthropic (Claude) — used for planning and complex reasoning steps.
• Google (Gemini, via Vertex AI) — used for fast file generation and the genome pipeline.
• OpenAI (GPT) — used for some specialized tasks where it consistently outperforms the other providers.
• xAI (Grok) and DeepSeek — used as fallbacks and for users who explicitly select them via Bring Your Own Model.

Each provider receives only the data it needs for the current generation, processes it under their own privacy policy, and returns the result. No persistent third-party identifier of you is shared, and prompts are not retained server-side beyond what is required to deliver the response and recover from transient errors.

On the VULK iOS app, in compliance with App Store Review Guideline 5.1.2(i) (effective 13 November 2025), we show an explicit consent dialog before the very first generation. The dialog names every provider above. If you decline, no prompt is sent. You can reset the consent at any time from Settings → Reset AI consent.

If you bring your own model (BYOM) — by adding your own OpenAI, Anthropic, Google, Groq, Mistral, Together, Fireworks, or OpenAI-compatible endpoint key — VULK forwards your prompt directly to that provider, with the same disclosure requirements documented in your account's API Keys settings page.

Your rights

If you are a resident of the European Economic Area (EEA), UK, or Switzerland, you have:

• Right of access — request a copy of the data we hold about you
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten") — request deletion
• Right to restrict processing — limit how we use your data
• Right to data portability — export your data in a machine-readable format
• Right to object — opt out of marketing or profiling
• Right to lodge a complaint — with your national data-protection authority (in Portugal: CNPD)

To exercise these rights, use the contact form selecting the "Privacy / DPO" topic. We respond within 30 days.

Do not track

Please note, we do not alter our Site's data collection practices when we detect a "Do Not Track" signal from your browser. EU consumers receive a consent banner that respects ePrivacy regardless.

Data retention

We retain your Order Information and project data for as long as your account is active. After account deletion, billing records are kept for 7 years to comply with Portuguese tax law; everything else is purged within 30 days.

International transfers

Primary infrastructure is EU-hosted (AWS Frankfurt). Some sub-processors operate outside the EU. Where transfers occur, they are protected by Standard Contractual Clauses (SCCs) approved by the European Commission.

Minors

Our Site is not intended for individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a minor has provided us with information, contact us and we will delete it.

Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect changes to our practices or for other operational, legal, or regulatory reasons. Material changes are announced by email at least 14 days before they take effect.

Contact

Privacy questions? Use the contact form with topic "Privacy / DPO". Mail: Code Ahead Lda, Vila do Conde, Portugal.

Last reviewed: April 30, 2026