Privacy at core.blue
Last updated: [date of publication]
1. Who is responsible
Code Intelligence Labs LLC, 3833 Powerline Rd. Suite 201, Fort Lauderdale, FL 33309, USA. Contact: contact@codeclarity.team; for the waiting list and the sandbox: desk@core.blue.
Representative in the EU (Art. 27 GDPR): Andreas Hassmann, Dr.-Otto-Nuschke-Str. 17, 09328 Lunzenau, Germany.
2. What core.blue is
core.blue offers private memories for AI agents ("houses"). core.blue carries a home page
and a manual; mcp.core.blue carries an adviser that agents talk to over the Model Context
Protocol, and a sandbox: a house for three hours. Houses on a machine of their own are not
available yet. There are no accounts, no cookies, no analytics and no advertising.
3. What we record, why, and for how long
3.1 What agents ask the adviser
For each call we record: the time, the name and version the agent's program gives for itself, a running number that ties the calls of one visit together, the question as it was asked, including free text and feedback, and the answer in brief. We do not record IP addresses, headers or the session id.
Purpose: to improve the manual and the offer. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). The entries are evaluated and then deleted, at the latest one month after their day. People read free text; agents are asked to send nothing personal and nothing secret.
3.2 The waiting list
An AI agent can give us the e-mail address of a person it acts for, so that we write to that person once houses can be had. We then have the address not from you but from an agent that says it acts for you (Art. 14 GDPR).
We record: the e-mail address, the size asked for, the language, and the times of request, mail and confirmation. Nothing about the agent that asked. The request's id and link are stored only as an irreversible hash.
| When | What we do | Legal basis | How long |
|---|---|---|---|
| before you confirm | write you exactly one mail asking whether you know about it | legitimate interest in accepting a request in your name only with your confirmation (Art. 6(1)(f)) | without confirmation seven days; then the address is deleted, the rest of the entry 30 days later |
| after you confirm | write to you once when houses can be had | your consent (Art. 6(1)(a)); withdraw it at any time with the second link in our mail or at desk@core.blue | until houses can be had or you withdraw |
| when you decline or withdraw | delete the address and keep an irreversible hash of it, so that no further request makes us write to you | legitimate interest in respecting your wish for good (Art. 6(1)(f)) | for good; on request we delete it too |
3.3 The sandbox
An agent can open a throwaway house for three hours. What it writes there stays on our machine until the lease ends and is then deleted completely; we do not read it, and there is no backup of it. So that only one house is open per source at a time, the caller's IP address is held in memory while the house runs and is written nowhere. Legal basis: legitimate interest (Art. 6(1)(f)) in sharing a free test fairly and limiting abuse.
3.4 Connections
Our server writes no access logs. To protect the machine from too many connections, it counts new connections per IP address; the address is held in memory for up to two minutes and written nowhere (Art. 6(1)(f)).
3.5 When you write to us
Mail to desk@core.blue, and replies to our mails, are forwarded to the mailbox of Code Intelligence Labs. We use them to answer and delete them when the matter is settled (Art. 6(1)(f)).
4. Who else processes the data
| Service | For | Data | Where | Basis |
|---|---|---|---|---|
| Hetzner Online GmbH | the machine (Nuremberg) | everything in 3.1 to 3.4 | Germany | processing on our behalf (Art. 28) |
| Postmark (ActiveCampaign, LLC) | sending our mails | your address, the mail's content | USA | processing on our behalf under Postmark's terms (with standard contractual clauses); EU-US Data Privacy Framework (ActiveCampaign is certified) |
| United Domains AG | domain, DNS, forwarding of desk@core.blue | mails to desk@core.blue | Germany | processing on our behalf |
| Microsoft (Microsoft 365) | the mailbox of Code Intelligence Labs | mails to desk@core.blue and replies | EU/USA | processing on our behalf, EU-US Data Privacy Framework |
| Let's Encrypt | certificates | no personal data | USA | — |
Opens and clicks in our mails are not tracked. We sell no data and pass none on for advertising.
Transfers to the USA: The controller is in the USA. The data lies on the machine in Germany; the operator has access to it. For Postmark and Microsoft the transfer rests on the EU-US Data Privacy Framework (Art. 45 GDPR).
5. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest, and you can withdraw consent at any time without affecting the lawfulness of processing before. Write to desk@core.blue or to the EU representative. You can complain to a data protection supervisory authority, for example the one where you live.
There is no automated decision within the meaning of Art. 22 GDPR. Giving us your address is voluntary; without it we simply cannot write to you.
6. Changes
If we change this statement, the new date stands at the top.