Privacy Policy

1. Introduction

Welcome to AI-ERD. This Privacy Policy explains how Codelive Inc. ("Company," "we," "us," or "our") collects, uses, discloses, and protects your information when you use our database diagram design tool with optional AI features via MCP integration at ai-erd.com ("Service").

We are committed to protecting your privacy and handling your data transparently. Please read this Privacy Policy carefully to understand our practices regarding your personal data.

Company Information:

• Codelive Inc.
• GL Metro City Hangang, A-dong, Unit 1813, 10 Cheongcho-ro, Deogyang-gu, Goyang-si, Gyeonggi-do 10542, Republic of Korea
• Email: [email protected]
• Phone: +82 070-7954-6531

2. Definitions

3. Scope

3.1 What This Policy Covers

This Privacy Policy applies to:

• Information collected through the AI-ERD website (ai-erd.com)
• Information collected through our Service
• Communications between you and Codelive Inc.

3.2 What This Policy Does Not Cover

This Privacy Policy does not apply to:

• Third-party websites or services linked from our Service
• Information collected by third-party authentication providers on their own services (their independent processing)
• Information you choose to share publicly through the Service's sharing features
• How third-party AI tools process data within their services after you connect via MCP (see Section 14.3)
• Publicly shared content may be accessible to anyone with the link or as configured by you.

4. Data Controller and Processor

4.1 Your Customer Data

For Customer Data (your diagrams, schemas, and files):

• You are the Data Controller – You determine the purposes and means of processing your Customer Data
• Codelive Inc. generally acts as a processor for Customer Data to provide the Service, and as a controller for limited processing required for security, compliance, and Service operations.

4.2 Other Information

For Other Information (account data, usage analytics, etc.):

• Codelive Inc. is the Data Controller – We determine how this information is collected and used

5. Information We Collect

5.1 Customer Data

Customer Data is information you create or upload to the Service:

Important: We do not use Customer Data to train our own AI or machine learning models. If you choose to use AI features via MCP, your diagram data may be processed by third-party AI tools you connect (see Section 14.3).

5.2 Other Information

We collect Other Information in the following ways:

Information You Provide

Information Collected Automatically

Information from Third Parties

6. How We Use Your Information

We may introduce advertising on the free tier; however, we do not use Customer Data (such as your diagrams or schemas) to target or personalize ads.

6.1 Customer Data

We use Customer Data only to:

• Provide and operate the Service
• Store and display your diagrams
• Enable export and sharing features you initiate
• Provide technical support when you request it

We do NOT use Customer Data to:

• Train our own AI or machine learning models
• Sell to third parties
• Use Customer Data to serve targeted or personalized advertisements
• Create user profiles for marketing

6.2 Other Information

We use Other Information to:

7. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), United Kingdom, or other jurisdictions requiring a legal basis for processing, we rely on the following:

You may withdraw consent at any time by contacting us or adjusting your settings.

For analytics cookies and similar technologies, we rely on consent where required by law.

8. Data Sharing and Disclosure

8.1 We Do Not Sell Your Data

We do not sell personal information as that term is defined under applicable law.

8.2 Subprocessors

We use the following service providers to operate our Service:

8.3 Authentication Providers (Third Parties)

You may sign in using Google, GitHub, Microsoft, or email. These authentication providers process certain information (such as your name, email address, and profile information) under their own terms and privacy policies. We receive limited account information from them to authenticate you and operate the Service.

8.4 Other Disclosures

We may disclose your information:

8.5 Advertising

We may introduce advertising on the free tier. If we do, we may use third-party advertising partners to display ads and measure performance. Depending on the configuration, this may involve sharing device and usage information (such as cookie/identifier data where applicable, IP address, and basic log/interaction data) for ad delivery, frequency capping, measurement, and fraud prevention.

We do not use Customer Data (your diagrams, schemas, and files) to serve targeted or personalized advertisements. Where required by law, we will obtain consent for advertising cookies or similar technologies and provide controls to opt out. If we introduce advertising, we will disclose whether ads are personalized and provide required choices/opt-outs (including where advertising cookies are used).

You may also contact us at [email protected] to submit opt-out requests where applicable.

9. International Data Transfers

9.1 Data Location

Your data is primarily stored on servers located in the Republic of Korea.

9.2 Transfers Outside Korea

Some service providers (including Google Analytics and Sentry) may process certain personal information outside the Republic of Korea depending on their global infrastructure.

Where required by applicable law, we use appropriate safeguards and lawful transfer mechanisms for cross-border transfers (which may include Standard Contractual Clauses (SCCs) and/or other recognized mechanisms). Korea is recognized by the European Commission as providing an adequate level of protection for EU/EEA data transfers.

For transfers from the UK, we rely on the UK Addendum to the EU SCCs, the UK IDTA, or another valid transfer mechanism as required by UK law.

International transfers may include usage and device information (e.g., cookie/identifier data where applicable, IP address, user agent, access logs) and error/diagnostic data (e.g., error events, stack traces, performance data) to support analytics, monitoring, and Service reliability. Transfers occur over encrypted networks when you use the Service and when analytics/monitoring events are generated.

You can control non-essential analytics via our cookie consent settings (where available) and may contact us at [email protected] to exercise applicable privacy rights. Retention follows provider settings and our retention policy, and we keep information only as long as necessary unless a longer period is required by law.

Upon request, we will provide available details about the recipient and transfer safeguards.

9.3 Your Rights

If you are in the EEA, UK, or other jurisdictions with data transfer restrictions, you have the right to request information about the safeguards we use for international transfers.

10. Cookies and Tracking Technologies

10.1 Types of Cookies We Use

10.2 Your Cookie Choices

• Essential Cookies: Required for the Service to function; cannot be disabled
• Analytics Cookies: You can opt out through your browser settings or our cookie preferences (when available)

10.3 Do Not Track

We currently do not respond to "Do Not Track" browser signals. However, we honor Global Privacy Control (GPC) signals where required by law and technically feasible.

11. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy.

Exceptions

We may retain data longer if required by law, legal proceedings, or to protect our legal rights.

12. Data Security

We implement appropriate technical and organizational measures to protect your data:

While we strive to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

13. Your Privacy Rights

13.1 General Rights(All Users)

Regardless of your location, you have the right to:

Brazil (LGPD). If you are located in Brazil, you may have rights under Brazil’s LGPD, including confirmation of processing, access, correction, anonymization/deletion, portability, information about shared recipients, and the right to revoke consent. You can exercise these rights by contacting us as described in Section 13.4. We process personal data in Brazil based on the legal bases available under the LGPD (such as consent, contract performance, legal obligation, or legitimate interests, as applicable). You may also lodge a complaint with the Brazilian National Data Protection Authority (ANPD).

13.2 Additional Rights for EEA, UK, and Switzerland Residents

Under GDPR and equivalent laws, you also have the right to:

13.3 Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Categories of Personal Information Collected

Your California Rights

Sale and Sharing Disclosure

• We use analytics only for measurement and service improvement, and we do not enable analytics for cross-context behavioral advertising. Where required, you can opt out via cookie preferences and/or GPC.

You may also submit opt-out requests by email as described in Section 13.4.

If we introduce advertising, certain disclosures or data sharing may be considered a “sale” or “sharing” under applicable law (including CPRA). Where required, we will provide opt-out mechanisms (e.g., cookie preferences, GPC, and/or in-Service controls).

We may also provide an online request form or in-Service controls (when available).

Authorized Agents

You may designate an authorized agent to submit requests on your behalf. We may require verification of the agent's authorization.

13.4 Exercising Your Rights

To exercise any of these rights, please contact us at:

• Email: [email protected]
• Subject Line: Privacy Rights Request

We will respond to your request within the timeframe required by applicable law (generally 30 days for GDPR, 45 days for CCPA).

14. Your Choices

14.1 Account Information

You can update your account information by accessing your account settings or contacting us.

14.2 Email Communications

You can opt out of promotional emails by:

• Clicking the "unsubscribe" link in any promotional email
• Contacting us at [email protected]

Note: You cannot opt out of transactional emails (e.g., security alerts, service announcements).

14.3 AI Features

If you choose to use AI features via MCP, you may connect AI-ERD to third-party AI tools such as Claude Code. In this setup, Claude Code may request and receive your diagram data from AI-ERD through our MCP endpoint (e.g., create/get/list/update diagram tools) in order to generate suggestions or apply updates you request.

Any processing performed by the third-party AI tool (including how it uses the diagram data within that tool) is governed by that provider’s terms and privacy policy. The Company does not control the third-party AI tool’s processing and is not acting as a processor/subprocessor for that third-party AI tool in this user-managed integration.

You can choose not to use MCP-based AI features at any time.

14.4 Cookies

You can manage cookies through:

• Your browser settings
• Our cookie preference center (when available)

Where required by law, we will not set non-essential cookies unless you consent.

14.5 Do Not Track / Global Privacy Control

• DNT: We currently do not respond to Do Not Track signals
• GPC: We honor Global Privacy Control (GPC) signals where required by law and technically feasible

15. Children's Privacy

The Service is not intended for users under 16 years of age. We do not knowingly collect personal information from children under 16. In some jurisdictions, different age thresholds may apply. If we become aware that we have collected personal information from a child under 16, we will take steps to delete such information promptly.

If you believe we have inadvertently collected information from a child under 16, please contact us immediately at [email protected].

16. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party services you access.

17. Supervisory Authority

17.1 EEA and UK Residents

If you are in the EEA or UK and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

17.2 Korea Residents

Korean residents may file complaints with:

• Personal Information Protection Commission (PIPC): https://www.pipc.go.kr
• Korea Internet & Security Agency (KISA): https://www.kisa.or.kr

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated Privacy Policy on our website
• Sending an email to your registered email address
• Displaying a prominent notice within the Service

The "Effective Date" at the top of this Privacy Policy indicates when it was last revised. Your continued use of the Service after changes become effective constitutes acceptance of the revised Privacy Policy.

19. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Codelive Inc.

• Email: [email protected]
• Phone: +82 070-7954-6531
• Address: GL Metro City Hangang A-dong, Unit 1813, 10 Cheongcho-ro, Deogyang-gu, Goyang-si, Gyeonggi-do 10542, Republic of Korea

For privacy-specific inquiries, please use the subject line: "Privacy Inquiry"

Last Updated: December 24, 2025