Privacy policy

1. Controller and contact

Service provider

CRYPTO MONEY INVEST d.o.o.

Registered address

Kumodraška 170, Beograd (Voždovac), Serbia

Company registration number / MB

21366153

Tax identification number / PIB

110590827

Support & privacy

support@weeyuga.com

Business support phone

+381652446218

CRYPTO MONEY INVEST d.o.o. is responsible for the account and service processing described here. Email support@weeyuga.com for privacy matters; this is our privacy contact, not a claim of a formally appointed data protection officer. For repository personal data we process on your instructions, you remain responsible for your authority and instructions. Paddle handles payment data under its Privacy policy.

2. Information and its sources

You provide your name, email, password, accepted policy version, support messages and feedback screenshots. We store a salted password hash, verification status and timestamps, trial start/expiry and reminder-delivery status. Authentication records include hashed session, email-link and agent-key tokens, expiry, key names, permissions, last use and revocation. Browser requests provide IP addresses, request paths, user-agent and security/error information; temporary abuse counters use hashed identifiers.

From authorized GitHub/GitLab access we obtain account/repository identifiers, repository names and paths, selected branches and commits, source files and metadata, connection tokens and webhook secrets, provider-side hook references, scan jobs, errors and graph/context results. Source can contain personal data you include. Credentials are encrypted at rest. We store query counts for plan allowances; returned context is visible to you and agents you authorize.

Paddle sends customer, subscription, product/price and transaction identifiers, status, period dates and relevant webhook references. We do not receive full card numbers or card security codes. Feedback includes your account identity, role, sanitized page URL/title, comment, category and selected images, plus delivery receipts.

3. Purposes and legal bases

We process account, indexing, retrieval, billing status and requested support information to perform our agreement and deliver features you request. Legitimate interests support service security, misuse prevention, diagnosing faults and responding to product feedback; we consider the effect on your rights and minimize access and retention. Legal obligations can require specific financial or dispute records. Where consent is required for an optional activity, we obtain it and you may withdraw it. We currently use no optional analytics or advertising tracking on this site.

4. Recipients and international processing

Authorized company personnel can access information when necessary for support, security or operation. Our hosting provider is Contabo: we operate the VPS and databases ourselves. The current app is hosted on the cicd instance. The owner confirmed that Contabo reports the region as EU for every instance, including central logging hosts; no finer country or city is available. Our operator is in Serbia, and EU hosting does not mean all recipient processing or access is exclusively within the EU. We create application backups ourselves; complete off-host recovery coverage is still being verified. We do not use Contabo-managed backups. The owner confirms Contabo DPAs have been completed for its instances; the agreements and authenticated downloads are private.

GitHub and GitLab receive provider API requests, tokens needed for authentication and configured hook information. Paddle receives checkout/payment and billing information and provides payment-related support. Our self-operated mail service sends verification, recovery, trial-expiry service reminders and support emails. IntegraBoard receives submitted feedback and screenshots into our private TruthGraph support project. Service providers and recipient infrastructure may process information outside Serbia, including in the EEA or other countries under their applicable arrangements. Where transfer safeguards are required, we use applicable contractual safeguards or another permitted mechanism; contact us for information about the relevant arrangement.

The hosted customer index does not send repository source to an external AI provider. If you give context to an AI agent or local-model runner, its downstream use depends on the model/provider you choose. On-premises customers control their own hosting and connected agents.

5. Cookies and payment scripts

An essential, HTTP-only session cookie keeps you signed in for up to seven days. It uses Secure on HTTPS and SameSite=Lax. The Cookie policy explains its environment-specific name and browser controls. Paddle.js is loaded on checkout when you choose to proceed with payment; Paddle controls its payment and fraud-prevention technology. We do not embed advertising scripts or visitor analytics. Clipboard images are read by the feedback form when you paste or choose them.

6. Security

We use HTTPS, hashed authentication secrets, encrypted provider credentials, isolated customer graph databases, bounded uploads, session/origin checks and revocable agent access. Feedback images are available through authenticated routes. Access is limited by role and operational need. No security measure is absolute; avoid including secrets or unnecessary personal data in code or screenshots. These measures are not a claim of independent certification.

7. Retention and verified closure

Active account and workspace information is kept while needed to provide your service. Temporary reset links expire after 30 minutes, verification links after 24 hours and sessions after seven days; expired token records are removed during authentication maintenance. Temporary rate-limit counters expire after their configured short windows. Local delivered feedback image bytes expire after seven days; dead-letter images expire after 30 days. Feedback copied to IntegraBoard remains available for support until the associated account is erased or a separate erasure request is fulfilled.

After verified account closure, access and saved provider credentials are disabled immediately. Active account, repository, index, usage and identifiable feedback records are erased within 30 days. Our retention commitment for TruthGraph application backup copies is a further 30 days. App-specific backup cleanup runs automatically; expiry of the new infrastructure and off-host recovery copies is still being verified. These are our chosen retention commitments. A separate ledger retains only opaque account identifiers, environment and erasure timestamps to prevent old backups from restoring access or erased content.

We do not retain an entire workspace merely because a transaction existed. Any legally required exception must identify the specific record, purpose, legal reason and review/expiry date, with access restricted separately. Paddle retains its own transaction records as an independent merchant of record. Your source-provider repositories, independently downloaded exports and records held by your chosen AI provider are outside our deletion process. Our operational and security log policy permits only the latest 30 days. Cleanup has been verified for the scoped TruthGraph server logs and local Mac copies. Automated expiry runs hourly on the server and hourly while the Mac is awake. This verification does not establish enforcement for every infrastructure or recipient log store. Logs can contain identifiers; contact us for an account-specific erasure review. This log limit is separate from workspace, backup and specific financial-record retention.

8. Your rights and requests

Subject to applicable law, you may ask for access, correction, an available export or portability copy, erasure, restriction, or object to processing based on legitimate interests. You may withdraw consent where we rely on it. Contact support@weeyuga.com; we verify identity and authority without asking for a full password or card details. We respond within the period applicable to your request and explain any lawful exception. You may complain to the competent data-protection authority, including the Serbian Commissioner for Information of Public Importance and Personal Data Protection or your local authority where applicable. We do not use this service to make automated decisions with legal or similarly significant effects about you.

9. Updates

We update this notice when processing changes and communicate material changes where required. The effective date identifies the current version. Ask us if a purpose, recipient, transfer or retention period needs clarification before you connect sensitive material.