Privacy Policy
Last updated: 17 August 2026
This Privacy Policy describes how DecompilerAI Akin Yilmaz (“we”, “our”, “us”) collects, uses and protects your personal data when you use DecompilerAI at decompiler.ai.
1) Controller Information
- Controller: DecompilerAI Akin Yilmaz
- Address: Industriestraße 59, 50389 Wesseling, Germany
- E-mail: support@decompiler.ai (also for data protection requests)
- Legal notice: Impressum. No data protection officer is required.
2) Data We Collect
| Data Category | Examples | Purpose | Legal Basis (GDPR) |
|---|---|---|---|
| Account Information | E-mail, username, salted scrypt password hash, confirmation status, last login. With Google Sign-In: your Google account ID, name, e-mail address and profile picture URL (we never receive your Google password) | Account creation, login, profile management | Art. 6(1)(b) - Contract performance |
| Uploaded Content | ELF binaries you upload, file name, size, SHA-256 hash, upload IP address, decompilation results, annotations (renames, comments), whole-program results, Ghidra projects and analysis caches | Providing and operating the decompiler service for your requests | Art. 6(1)(b) - Contract performance |
| Metadata of Uploaded Files | Architecture, file size, file format and other technical characteristics that do not describe program behaviour | Service operation, capacity planning, improving performance and reliability | Art. 6(1)(f) - Legitimate interest |
| Chat and Interaction Data | Messages you send in the chat, the function context sent with them, engine and mode choices | Providing the Service, showing history per binary, support and troubleshooting, preventing abuse | Art. 6(1)(b), Art. 6(1)(f) |
| Usage Ledger | Which action, when, engine, credits charged or refunded | Charging credits, showing your usage, billing evidence | Art. 6(1)(b), Art. 6(1)(c) |
| Security Data | Device fingerprint (see section 3), IP address, server access logs, login events | Fraud and abuse prevention, service integrity | Art. 6(1)(f) - Legitimate interest |
| Payment Data | PayPal subscription and payer identifiers, payment status and amounts, the notifications PayPal sends us; billing name and address you enter when requesting an invoice. We do not receive card or bank details | Billing, subscription management, refunds, fraud prevention, tax compliance | Art. 6(1)(b), Art. 6(1)(c), Art. 6(1)(f) |
| Contact Form and Cancellation Form | E-mail address, subject, message, IP address and browser identifier | Answering your request, confirming cancellations, preventing abuse | Art. 6(1)(b), Art. 6(1)(f) |
| Cookies & Browser Storage | See section 10 | Login session, anti-bot check, UI preferences | Art. 6(1)(b), Art. 6(1)(f); § 25(2) TDDDG |
3) Anti-bot Fingerprint
To detect automated abuse and fraud we compute a technical fingerprint of your browser (browser and hardware characteristics such as screen, GPU, fonts, audio and canvas rendering, time zone, and interaction patterns such as mouse movement) and store it with your IP address for a maximum of 30 days. When you log in, the fingerprint is linked to your account for the purpose of abuse and fraud prevention. Fingerprints are not used for automated blocking or banning; they support manual review only. The related cookie is session-scoped (deleted when you close the browser). Legal basis: Art. 6(1)(f) GDPR (protection of the Service against bots and account abuse). You may object to this processing on grounds relating to your particular situation (section 9).
4) What Leaves the EU: Which Engine Sends What Where
Ghidra analysis runs on our own servers at Hetzner Online GmbH (data centres in Germany/Finland). The other engines and features use processors as follows. Only the code being analysed and your chat messages are transmitted; never your account credentials.
| Feature | What is sent | Where it is processed | Leaves the EU? |
|---|---|---|---|
| Analysis (disassembly, CFG, xrefs, strings, hex) and Ghidra pseudo-C | nothing leaves our servers | Hetzner Online GmbH, Germany/Finland (EU) | No |
| DecompilerAI model (decai), per function | disassembly of the selected function and its call context | RunPod Inc. (USA), GPU servers restricted to EU data centres; RunPod stores nothing after the request | Data stays in EU data centres; the processor is a US company (Standard Contractual Clauses) |
| GPT engine, per function | disassembly, Ghidra pseudo-C and prior decompiled C of the function | OpenAI, L.L.C. (USA) | Yes |
| Whole-program Fast mode | disassembly of all functions (decai step) and the resulting C code (readability step) | decai step: RunPod, EU data centres; readability step (L4): OpenAI, USA | Yes (readability step) |
| Whole-program Deep mode (L1-L4) | disassembly of all functions and the resulting C code (syntax, compile, verification and readability steps) | decai step: RunPod, EU data centres; L1-L4 steps: OpenAI, USA | Yes |
| Chat | your message, the disassembly and decompiled C of the current function, its callers and the previous chat turns | OpenAI, L.L.C. (USA) | Yes |
Transfer basis for OpenAI: OpenAI's Data Processing Addendum with EU Standard Contractual Clauses (and the EU-US Data Privacy Framework where OpenAI is certified). OpenAI does not use API data for training and deletes it after at most 30 days. Transfer basis for RunPod: data processing agreement with EU Standard Contractual Clauses; inference is restricted to EU data centres and is stateless. If you must not send code outside the EU, use only the analysis features, Ghidra and the decai engine.
5) Data Sources
- Directly from you when you create an account, upload files, use the chat, request an invoice, contact us or cancel a subscription.
- Automatically through your use of the Service (cookies, localStorage, device fingerprint, IP address, logs).
- From third parties: Google (Google Sign-In) and PayPal (payment status notifications).
6) Use of Data
- Provide, operate and maintain the Service, including decompilation, chat and related features.
- Authenticate and secure user accounts and sessions.
- Charge credits, process payments, manage subscriptions, issue invoices and handle refunds and cancellations.
- Prevent abuse, fraud and illegal activities; investigate notices or complaints; enforce our Terms; comply with applicable law.
- Improve the Service using technical metadata and independent benchmarks, without using the behaviour of your uploaded programs or chat messages for training.
We do not use your uploaded files, their behaviour or your chat content to train, fine-tune or evaluate our models beyond the real-time processing required to provide results to you.
Important: If you are bound by strict confidentiality obligations (for example, NDAs, export control rules or internal policies), you must ensure you are permitted to upload the relevant code or data to cloud services and the processors named in section 4 before using the Service.
7) Data Retention
| Data | Retention |
|---|---|
| Account data | Until you delete your account; deletion completes within 30 days. Inactive free accounts are deleted after 24 months of inactivity, following a deletion e-mail. |
| Uploaded binaries, decompilations, annotations, whole-program results, Ghidra projects, analysis caches | Until you delete the file or your account, then removed within 30 days. |
| Metadata of deleted uploads (file name, size, hash, upload IP address) | 90 days after deletion. |
| Chat history | 12 months, or until account deletion. |
| Usage ledger (which action, when, how many credits) | Until account deletion; billing-relevant records 10 years. |
| Invoices, payment records | 10 years (§ 147 AO, § 14b UStG), also after account deletion. |
| Server access logs (IP address, URL, time, browser) | 14 days. |
| Anti-bot fingerprints and bot scores | 30 days. |
| Contact-form and cancellation-form e-mails | 6 months. |
| Backups | Encrypted database backups are kept for 14 days at Hetzner (EU); deleted data may persist in backups for that period. |
8) Recipients and Processors
- Hetzner Online GmbH, Gunzenhausen, Germany: servers, storage and backups (data centres in Germany/Finland, EU).
- RunPod Inc., USA: GPU inference for the DecompilerAI model (decai), restricted to EU data centres (safeguard: data processing agreement with Standard Contractual Clauses).
- OpenAI, L.L.C., USA: GPT engine, Fast mode readability step, Deep mode and chat (safeguard: OpenAI Data Processing Addendum with Standard Contractual Clauses / EU-US Data Privacy Framework).
- PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg: payments and refunds; PayPal is an independent controller (see PayPal's privacy statement).
- Google Ireland Ltd: Google Sign-In (optional) and reCAPTCHA on the login, registration, password, contact and cancellation pages; Google receives your IP address and browser data (see Google's privacy policy). Legal basis Art. 6(1)(f) (bot and fraud prevention).
- Namecheap, Inc., USA (Private Email): sending confirmation, password, invoice, contact and cancellation e-mails (Standard Contractual Clauses).
- Cloudflare, Inc. (cdnjs): delivery of a code-highlighting script on some pages; Google/YouTube: video embed on the start page.
- Authorities and legal recipients where required by law.
We have concluded data processing agreements (Art. 28 GDPR) with the processors listed above.
9) International Transfers
Personal data is transferred to the United States only in the cases marked in sections 4 and 8 (OpenAI; RunPod as a US company operating EU data centres; Namecheap; Cloudflare). The safeguards are the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the recipient is certified, the EU-US Data Privacy Framework (Art. 45 GDPR). You can request a copy of the safeguards at support@decompiler.ai.
10) Cookies & Browser Storage
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| session_token | localStorage | keeps you logged in (JWT) | 30 days |
| username, profile_avatar, ins-* | localStorage | shows your name and picture, remembers inspector layout | until logout |
| acHash | cookie | anti-bot challenge seed | 7 days |
| device_tag | cookie (+ localStorage copy) | anti-bot: recognises the same browser during a visit | session |
| PayPal, Google, YouTube | third-party cookies | only on the checkout, login/registration/contact/cancellation and start pages | see provider |
We do not use analytics, tracking or marketing cookies. If this changes in the future, we will update this Privacy Policy and, where required, ask for your consent before setting any non-essential cookies.
11) Your Rights (GDPR)
As a data subject under the GDPR, you have in particular the following rights:
- Right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).
- Right to object (Art. 21) to processing based on our legitimate interests (for example, the anti-bot fingerprint), on grounds relating to your particular situation.
- Right to withdraw consent (Art. 7(3)) with effect for the future, where processing is based on consent.
- Right to lodge a complaint with a supervisory authority, for example the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf, or any other supervisory authority.
How to exercise them: you can delete your uploads at /upload and your whole account at /profile; for everything else contact support@decompiler.ai.
12) Security
We implement appropriate technical and organisational measures to protect personal data against loss, theft, misuse and unauthorised access, including encryption in transit, salted password hashing, access controls, logging and regular security monitoring. No system is perfectly secure, but we work continuously to keep risk at an appropriate level for a service of this kind.
13) Age Limit
The Service is intended for persons who are at least 18 years old. We do not knowingly collect personal data of younger persons.
14) Changes
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last updated” date.
