Privacy Policy

Last updated: July 7, 2026

This policy describes how Platfory handles your information. It is a plain-language draft pending final review by a qualified attorney.

1. Who we are

Platfory ("we", "us") operates platfory.ai and the Platfory editor extension, a marketplace that shows a single sponsored line in the wait-state of AI coding tools and shares ad revenue with developers. Platfory is operated by Oleksii Yakubenko, an individual entrepreneur (empresário em nome individual) registered in Portugal (NIF 320760839, business address R. Saraiva de Carvalho 1C, 1250-240 Lisboa, Portugal), who is the data controller and the party you contract with. Contact us at privacy@platfory.ai.

2. What we collect

Account data. When you sign in with GitHub or Google, we receive a numeric user ID, your username or verified email, and nothing else from the provider. We never receive your password.
Ad interaction data. Impression and click events: which sponsored line was shown, which tool, timing, and validation signals used to prevent fraud.
Earnings and payout data. Your balance, ledger entries, and, if you connect payouts, a Stripe connected-account identifier. We never see or store your bank details; Stripe does.
Advertiser data. If you run campaigns: your creative text, destination URL, budgets, bids, and campaign performance.
Referral data. Your referral code and the referrals attributed to it.
Technical data. IP address and standard server logs, used for security, rate-limiting, and our admin audit log.
Cookies. See section 6.

3. What we do NOT collect

The extension never reads or transmits your source code, your prompts to the AI, the AI's responses, your keystrokes, your file names, or your file contents. It collects impression and click events only. This is a core design commitment, enforced in the software.

4. How we use your data

To provide the service, calculate your earnings, and serve relevant sponsored lines.
To validate impressions and clicks and prevent fraud (server-side, never self-reported).
To process payouts through Stripe and referral bonuses.
To keep you signed in, secure the platform, and maintain an audit trail of administrative actions.

5. Purposes and legal bases (GDPR)

We process each category on a specific basis:

Contract (Art. 6(1)(b)) - to run your account, serve the sponsored line, and calculate and pay your earnings.
Legal obligation (Art. 6(1)(c)) - for tax, accounting, invoicing, and anti-money-laundering records tied to payments and payouts.
Legitimate interests (Art. 6(1)(f)) - to prevent ad fraud and keep the platform secure. We have balanced these interests against your rights; you may request our assessment.
Consent (Art. 6(1)(a)) - for the per-tool integration that modifies your editor configuration, which you can withdraw at any time by uninstalling or running Platfory: Restore.

6. Cookies

We use a single essential first-party cookie (platfory_session) to keep you signed in, plus short-lived cookies during sign-in (OAuth state) and for referral attribution. We do not use tracking, analytics, or advertising cookies, and we do not fingerprint you.

7. Sub-processors and sharing

We do not sell your personal data. We use the following sub-processors strictly to run Platfory:

GitHub and Google - authentication (OAuth). US.
Stripe - payments, payouts, and identity/KYC verification. US / EU.
Neon (database), Upstash (cache), and Vercel (hosting) - infrastructure. US / EU / global edge.

Advertisers receive aggregate campaign metrics (impressions, clicks, spend) only, never your identity. We keep this list current and will notify you of material changes.

8. Data retention

We keep account and event data while your account is active. Financial and invoicing records are kept for the period required by Portuguese tax and accounting law (generally up to 10 years). Fraud and security logs are kept for up to 24 months. When you delete your account, we remove or anonymise data we are not legally required to retain, typically within 30-90 days.

9. Your rights

Under the GDPR (and, where applicable, laws such as the CCPA/CPRA), you may access, correct, delete, port, restrict, or object to the processing of your personal data, and withdraw consent. To exercise any right, email privacy@platfory.ai; we respond within one month. We will not discriminate against you for exercising these rights. If you are unhappy, you have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or your local EU data-protection authority.

10. International transfers

Some providers process data outside the EEA, including in the United States. For each such transfer we rely on an appropriate safeguard under GDPR Chapter V: the EU-US Data Privacy Framework where the provider is certified, and otherwise the European Commission's Standard Contractual Clauses with supplementary technical and organisational measures. You may request details at privacy@platfory.ai.

11. Security

Sessions are cryptographically signed, updates to the extension are signature-verified, ad events are validated server-side, and administrative actions are rate-limited and audited. No system is perfectly secure, but security is central to how Platfory is built.

12. Age

Platfory is not directed to anyone under 18, and we do not knowingly collect their data.

13. Changes

We may update this policy; we will change the date above and, for material changes, notify you.

14. Contact

privacy@platfory.ai