Privacy Policy

Last updated: 16 October 2026

1. Who we are and what this policy covers

Anastasiia Russkikh, an individual operating from Kazakhstan, operates AI Product Assurance and is responsible for the processing described in this policy. Contact mvp.anastasia@gmail.com for privacy questions or requests.

This policy covers nocodeapp.io, early-access and support correspondence, and the private-beta workspace, which may also display the name AI Product Architecture OS. Public registration and public checkout are not yet open. The information processed depends on the features you use and those enabled for your workspace.

2. Information processed

• Contact and support information: your name, email address, messages and information you choose to send when requesting access or support.
• Account and workspace information: account identifiers, name, email address, authentication information, workspace membership, roles and invitations.
• Project information: product descriptions, architecture decisions, evidence, links and other material submitted by you or authorised collaborators, together with generated analysis and associated project records.
• Billing and usage information: product or plan, transaction and subscription references, payment status, amount and currency, credit grants and usage, and information needed to handle billing or refund requests. Checkout is handled by the payment provider; the application receives transaction and access information.
• Technical information: IP address, request and device/browser information, session information and logs generated in operating and protecting the service.

Information may come directly from you, from authorised collaborators who invite you or add project information, and from authentication or payment providers reporting service or transaction status. Please avoid adding personal information unnecessary for the project. Do not send passwords or complete payment-card details to support.

3. Purposes and legal bases

We use information to respond to access and support requests; create and authenticate accounts; provide workspace collaboration and requested AI analysis; deliver purchased access or documents; administer subscriptions, credits and refunds; and operate and protect the service.

Where EU or UK data-protection law applies, we rely on the following bases as appropriate to the activity:

• Contract or steps you request before entering a contract: providing requested accounts, services, purchases and related support.
• Legitimate interests: responding to business contacts, managing authorised organisational users and invitations, and maintaining a secure, functioning service. These interests are operating the requested service and managing the business relationship.
• Legal obligations: records and disclosures required by applicable law, including applicable accounting obligations.
• Consent: optional launch or marketing updates where you have agreed to receive them. You may withdraw this consent by emailing support. Withdrawal does not affect the lawfulness of processing before withdrawal.

You may choose not to provide optional information. Without the account, project or transaction information needed for a requested feature, we may not be able to provide that feature or resolve your request.

4. Providers and other recipients

The providers involved depend on the service or enabled feature you use:

• Cloudflare supports delivery and security of the public website. Privacy information: https://www.cloudflare.com/privacypolicy/.
• Vercel hosts the application. Privacy information: https://vercel.com/legal/privacy-notice.
• Supabase provides authentication and database services for workspace and related service records. Privacy information: https://supabase.com/privacy.
• Anthropic and OpenAI are integrated providers for AI-assisted analysis. Relevant input and context are sent to the configured provider only when an enabled AI feature is used. Provider information: https://www.anthropic.com/legal/privacy and https://openai.com/policies/privacy-policy/.
• Resend provides transactional email, including authentication or invitation messages when enabled. Privacy information: https://resend.com/legal/privacy-policy.
• Google serves font resources loaded by the public website and provides the Gmail mailbox used for support correspondence. Privacy information: https://policies.google.com/privacy.
• The original payment provider handles the relevant payment, subscription and refund. The application currently includes a lava.top integration. Its privacy policy is at https://lava.top/en/docs/policy. Only for orders actually sold by Paddle, Paddle's privacy notice applies to its processing: https://www.paddle.com/legal/privacy.

A listed integration does not mean that every feature is enabled or that every provider receives every user's information. Sessions, recording, transcription and AI interpretation are not currently available as public product features.

Workspace participants can access content according to the roles and permissions applying to their workspace. Information may also be disclosed where required by applicable law.

5. AI-assisted processing

When you request an enabled AI-assisted action, the relevant project content and context are processed by its configured AI provider to produce the result. AI output supports your work and should be reviewed before it is relied upon. The provider's handling of API data is governed by the applicable service and data-processing terms for that provider account.

6. Retention

We retain account and workspace information to provide the requested service and maintain the project's records. When deciding whether information is still needed, we consider the account and workspace relationship, outstanding support requests, payment disputes, security incidents and applicable legal obligations.

Information collected solely for the original waitlist is retained until launch or a removal request, whichever comes first. You can ask to be removed by emailing mvp.anastasia@gmail.com.

Subscription cancellation is separate from a request to delete personal information. Shared project records, billing records and information required by law may need different handling from a personal account record.

7. International processing

Our primary Supabase database and authentication services are hosted in London, United Kingdom. Other providers used to deliver the website, application, AI analysis, email and payments may process information outside your country. A primary hosting location does not mean that all processing, support access, logs or backups remain in that location.

Provider-specific processing arrangements are described in the applicable service and data-processing agreements and the provider notices linked above. You may contact mvp.anastasia@gmail.com for information about the recipients and arrangements relevant to your use of the service.

8. Cookies and browser storage

The workspace uses cookies and browser storage for functions such as authentication, account sessions and workspace selection. Blocking or clearing them may require you to sign in again or affect those functions.

The public website loads Google Fonts and uses hosting and security services. Requests to those services involve technical information such as your IP address and request metadata. You can manage cookies and stored website data through your browser settings.

9. Your rights and requests

Depending on applicable law, you may have rights to access, correct, delete or receive a portable copy of your personal information, restrict processing, object to processing based on legitimate interests, and withdraw consent where processing relies on it.

Email mvp.anastasia@gmail.com to make a request. Requests are reviewed individually, and we may need information to verify your identity and locate the relevant records. For shared workspaces, we also consider other participants' rights and records we are legally required to retain. We will respond within the period required by applicable law.

You may also complain to your competent data-protection authority. EU/EEA authority details are available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. UK information is available at https://ico.org.uk/make-a-complaint/.

10. Updates and contact

We will update this policy when our processing changes and change the date above. Where required, we will provide notice or obtain consent before the relevant change.

Contact mvp.anastasia@gmail.com about this policy or your personal information.