Who is responsible
Berat Doğan Araç, an individual based in Konya, Türkiye, operates Licuse and determines how personal data is used for our website, accounts and services. Contact hello@licuse.com for a privacy question or request. Licuse is not a separate incorporated company.
This notice covers our web account, desktop integration and hosted service processing. It does not replace the independent policies of an AI provider you select, a third-party extension, an external website or Polar acting in its own role.
Local-first does not mean offline-only
Your workspace files, current chat history, notes, indexes, code maps, checkpoints and local BYOK usage are primarily held on your device. The current local store is not mirrored wholesale to the Licuse account database. Local storage is not represented as application-level encrypted; protect your OS account, disk and backups.
When you invoke AI, relevant prompts, selected files or excerpts, conversation context, attachments and tool results can leave your device. In a direct BYOK flow they go to the configured provider. In a hosted flow they pass through the Licuse backend and its model/search providers. A local-first interface is not a promise that AI processes your content only on your computer.
BYOK keys are held in the IDE’s credential storage and used to authenticate requests to the provider you select. The website has no BYOK key collection form. Some account, model-catalog or runtime-configuration requests may still contact Licuse even when a model request uses BYOK.
What we process and why
| Category | Examples | Purpose / basis |
|---|---|---|
| Account and authentication | Email, account ID, display name, optional provider profile/avatar data, sign-in provider, verification, terms acknowledgement and account timestamps; credentials and session/security records handled by Supabase Auth. Connecting the IDE also creates a one-time authorization record containing a code hash, PKCE challenge, account ID and expiry time. It contains no password or access/refresh tokens. The code expires after two minutes and is deleted after successful use; expired records are cleaned up on subsequent connection requests, and account deletion removes associated records. | Create and protect your account, authenticate access and recover passwords. Contract performance and legitimate security interests; legal duties where applicable. |
| Plan and hosted usage | Plan, credit totals and usage; request ID, selected model, input/output/reasoning token counts and timestamps. | Display activity, account for hosted requests, apply service limits and resolve disputes. Contract performance and legitimate operational interests. |
| AI request content | Prompts, chosen or automatically selected relevant context, code, notes, images/attachments, tool outputs and generated responses. | Deliver the feature you invoke. Contract performance; you must have authority to submit third-party data. This is distinct from optional website analytics. |
| Operational and security data | Network IP, user agent and request metadata processed by infrastructure; generation identifiers/status, timings, errors and abuse indicators. Diagnostic messages may include technical paths or error context. | Serve requests, diagnose failures, prevent abuse and preserve service reliability. Legitimate interests and applicable legal duties. |
| Billing records | Polar customer, subscription, transaction and event IDs, status, amount/currency, next billing date and account association, paid-period allowances, credit reservations, usage and refund records. Sandbox and live records are separated. | Manage test billing; later, fulfil paid orders and meet financial/legal obligations. Full card details are entered into Polar’s checkout, not stored by our application. |
| Support and waitlist | Email, selected product interest, signup timestamp, correspondence and files you choose to send. | Respond to requests and send the specific product updates you request. Contract steps/legitimate support interests; permission for optional updates. You may unsubscribe by emailing us. |
| Optional website analytics | Consented public-page views and enabled enhanced events (scroll depth, outbound links, downloads and supported video), plus browser/device information and Google Analytics identifiers. | Understand aggregate website use, only after optional consent. No ad targeting is configured by this integration. |
What this does not mean
Our current application does not maintain a cloud mirror of your local workspace or intentionally store full current chat transcripts as hosted usage records. Request processing, provider retention, diagnostic information, support attachments and any records from older versions are separate. The legacy cloud chat export/import path is retired. This change does not establish that historical server records or backups have been erased.
We do not sell personal data or use this integration for cross-site advertising. We do not send account emails, provider keys, file contents or prompts as Google Analytics events. The analytics integration excludes account, authentication, billing and API pages. Our manually sent page views omit URL query strings and fragments; enabled enhanced events may include outbound or download link URLs. This does not turn Google Analytics identifiers into anonymous data.
Do not submit passwords, API keys or sensitive personal information in AI prompts or support attachments unless necessary, lawful and appropriately protected. AI and support content can contain personal data even if we did not ask for it.
Legal grounds and optional choices
For processing governed by GDPR/UK GDPR, our grounds are performance of a contract or requested pre-contract steps; legal obligations; legitimate interests in security, maintenance and support, subject to your rights; and consent for optional analytics or optional marketing where required. Consent may be withdrawn without affecting prior lawful processing.
For processing governed by Türkiye’s KVKK, the corresponding grounds include establishing or performing a contract, compliance with legal duties, establishment/exercise/protection of rights and legitimate interests that do not override fundamental rights, as applicable under Article 5. Optional analytics requires a separate affirmative choice. This notice and acceptance of service terms do not constitute blanket consent to all processing or international transfers.
Account fields are needed for an account; declining them can prevent account features. Optional analytics is not required to download the app, sign in or use the workspace. We do not use this website to make solely automated decisions with legal or similarly significant effects about you.
How long data stays
Local content: files, chat/history databases, notes, settings and local BYOK usage remain on your device until you remove them through the relevant app controls or storage. Uninstalling may leave data or OS backups behind. We cannot remotely erase copies on your computer.
Active cloud account: profile, plan and hosted activity records are normally kept while you use the account, until you request deletion or the account is closed. There is no automatic time-based deletion promise for these records in this beta. Data that is no longer needed must not be retained indefinitely merely because no request was made.
Exceptions: records needed for security incidents, legal claims, fraud prevention or statutory accounting may be retained for the relevant justified or legally required period. Infrastructure logs and backups follow the actual provider/product configuration and recovery cycle; account deletion is not a promise of instantaneous removal from every backup. Where an exception applies to a deletion request, we will explain its scope and basis where permitted.
Waitlist and support: retained for the requested updates or to resolve your request, unless you ask us to remove them or a justified legal/support need remains. Analytics: currently configured but subject to your consent. Its cookie lifetime is distinct from report retention. If enabled, Google property retention settings and aggregate reports are explained in our Cookie policy; provider-held data is governed by the provider’s applicable settings and obligations.
Access, deletion and other rights
Email hello@licuse.com from your account address to request access, correction, deletion, account closure or an available export. State the request and relevant account reference; do not attach an identity document unless we explain a necessary verification step. Cloud account deletion is currently handled by support, not an instant self-service button.
Where applicable, you may also request restriction, portability, information about recipients or transfers, object to legitimate-interest processing, withdraw consent and complain to your competent supervisory authority. KVKK rights under Article 11 include learning whether data is processed, requesting information/correction/deletion under the relevant conditions, information on transfers, notification of recipients and challenging adverse automated analysis. We will respond within the applicable legal period, with explanations of any lawful extension or refusal.
Use Cookie settings on the Cookie policy page to withdraw optional analytics consent. Requests to remove local files must be completed on your device; requests relating to your independent BYOK account should also be directed to that provider. An account deletion request does not itself cancel a separate provider subscription.
Protection, children and changes
Controls in the current application include verified sessions, HTTPS on deployed services, HttpOnly website authentication cookies, access restrictions and account-scoped database queries. No system is perfectly secure, and we do not claim every local database is encrypted or every third party offers zero retention.
Our accounts and AI services are intended for adults aged 18 or over. If you believe a child has supplied data to us, contact us so we can investigate and take appropriate action. We will update this notice when our processing materially changes and obtain new consent when required. The date above identifies this version.
A person you can reach.
Licuse is operated by Berat Doğan Araç, an individual based in Konya, Türkiye. Licuse is a brand, not a separate incorporated company.
hello@licuse.com ↗