Privacy Policy.

This policy explains what information code900 collects when you visit code900.com or talk to our project-intake assistant, how we use it, and the choices you have. We keep it short and plain: we collect what we need to respond to you and run the site, and we don't sell your information.

Who we are

code900 is a custom software studio based in Miami, Florida. In this policy, "code900," "we," and "us" mean the business that runs www.code900.com. Questions about privacy go to hello@code900.com.

What we collect

Site analytics

We use Umami, a privacy-focused analytics tool that we host ourselves, so the data stays on our own server and isn't shared with an advertising or analytics company. Umami does not use cookies. It records aggregate information such as the pages viewed, the referring site, browser and device type, and approximate country. It doesn't build a profile of you across other websites.

The "online now" indicator on our home page shows only a count of current visitors, derived from these analytics. It never identifies anyone.

Light or dark mode

A small cookie on your device remembers whether you chose light or dark mode. It holds nothing else.

Our project-intake chat assistant

The chat on our site is an automated AI assistant, not a person. When you use it, we collect:

• What you type: your messages and the assistant's replies.
• The details you choose to share: typically your name, email, phone number, company, and a description of your project, budget, or timeline.
• Basic technical information needed to run the chat and protect it from abuse, such as your IP address (used for rate limiting) and the page you started from.

We use this only to answer your questions and to follow up about the project or service you asked about. The chat runs on our own chat service, which stores the conversation on our behalf. When you share your contact details, the chat service passes them to our team by email, with a short summary of what you need, so we can follow up. The full conversation isn't included.

Memory across pages. The chat uses a cookie to remember your conversation while you move between pages of this site, so you don't have to start over. It stops remembering after 30 minutes without activity, or straight away when you choose "End chat". On every page except the home page, a chat button in the corner opens the same conversation. Your browser also keeps a small note for this tab of whether the chat was open, so it can reopen it on the next page. That note holds no messages. On a shared computer, use "End chat" when you're done. The chat doesn't use advertising or tracking cookies, and it doesn't follow you to other websites.

Email

If you email us, we receive your email address and whatever you include in your message.

Client accounts

If you're a client, you sign in to our client portal through our sign-in service, CoreAuth. We keep your email address, your projects and their updates for as long as you're a client, or until you ask us to delete them.

Signing in sets two cookies that keep you signed in securely. They hold no tracking information.

If you give your name when you accept an invite, CoreAuth also links your account to a record in our identity registry, a directory shared by our services, holding that name and your verified email address. We may check that the address can receive mail, without sending you anything.

We keep a security record of account actions, holding no contact details, for up to 7 years.

Account emails (for example, a deletion confirmation) go through our email provider, which keeps a record of the address, subject and delivery status.

Signing out ends your code900.com session. To sign out of every app at once, use “Sign out everywhere” on your CoreAuth account page.

Payments

If you pay for a consulting engagement, checkout is handled by Stripe. Your card details go directly to Stripe; we never see or store your full card number. Stripe's use of your information is covered by Stripe's privacy policy.

How we use it

• To understand your project, reply to you, and follow up about working together.
• To prepare estimates, proposals, and engagements you ask for.
• To keep the site and chat running, secure, and free of spam and abuse.
• To understand, in aggregate, how the site is used so we can improve it.

We don't sell your personal information, we don't share it for advertising, and we don't use it to train AI models.

AI processing

To generate the assistant's replies, the text of your conversation is sent to our AI provider, Anthropic, which processes it to generate the reply. This means your messages leave our own servers for that purpose. Under our provider's commercial API terms, Anthropic does not use it to train its models. If we change AI providers, we will update this page.

Who we share it with

We share information only with service providers that help us run the business, and only as needed for them to do so:

• Hosting: our servers run on Amazon Web Services (AWS).
• AI processing: Anthropic, as described above.
• Email delivery: email we send (for example, a note to our team about your chat, or a confirmation about your account) is delivered through Amazon's email service.
• Payments: Stripe, if you pay through our site.

We may also disclose information if the law requires it, to protect our rights or the safety of others, or as part of a sale or reorganization of the business (in which case this policy would continue to apply).

How long we keep it

Chat conversations and the contact details shared in them are kept for 180 days, then deleted, unless we've started working together, in which case we keep what's needed for that engagement. For safety, our systems keep backups. Data we delete from the live system may remain in those backups, which are kept for a limited time and then deleted. Backups are used only to recover from failures, never to restore data you asked us to delete. Analytics are kept in aggregate.

Your choices and rights

• Access, correction, or deletion: email hello@code900.com and we'll respond within 30 days. We find your chat data using the email address or phone number you gave in the chat. Depending on where you live, you may have additional rights under local law; we'll honor them.
• Deleting a client account: deleting your account removes your portal data and your sign-in. Removing the identity record is a separate request: contact us and we'll handle both. Erased data can remain in database backups for up to 63 days, after which it is deleted. Manual volume snapshots are kept until we delete them by hand. The identity registry's backup copies expire within about 17 weeks.
• Don't want to use the chat? You can always reach us by email instead.

Security

We protect information with encrypted connections (HTTPS), access controls, and by keeping data on systems we operate. No system is perfectly secure, but we take reasonable steps to protect what you share with us.

Children

Our site and services are for businesses and are not directed to children under 13. We don't knowingly collect information from children.

Changes to this policy

If we change this policy, we'll update it here and change the "Last updated" date above. If a change is significant, we'll make that clear on the site.

Contact

code900 · Miami, Florida · hello@code900.com