your work stays in europe.
What students make on MakeMode — their prompts, their code, their published projects — is processed on European infrastructure, by design. This page explains, in plain language, who is responsible for that data, what data exists, where it goes, and the rights every student keeps.
who's responsible for the data.
Under the GDPR there's a clear split, and it matters for a policy office: the institution is in charge, and MakeMode works on its instruction. We don't decide on our own to do anything with student data.
Your institution (e.g. a university) is the data controller. It decides MakeMode is used in a course or programme, and it is the party legally responsible for the student data described here. Questions about why data is processed in connection with someone's studies sit with the institution.
MakeMode is the data processor. We run the application for the institution and process data only according to the institution's instructions and a Data Processing Agreement (DPA) signed with them. We don't repurpose student work, and we don't sell data — that isn't the model.
In short: the institution is the controller; MakeMode is the processor. The institution's own systems stay the institution's own infrastructure, not our sub-processor — a sovereignty advantage rather than something to paper over.
what data actually exists.
We collect what the tool needs to work, and not more. There's no advertising, no profiling, no resale. The categories are short on purpose.
account & identity
Your name, email or institutional ID, and a sign-in token — from the email magic link, or your institution's single sign-on once that's in place. Enough to know it's you, no more.
your prompts & code
What you type to the assistant, plus the parts of your code and project files sent as context so it can respond — and the output it generates back.
your projects
The source files and assets you create on your device, and — if you choose to publish — the built site that gets a public web address.
Plus operational telemetry — cost, token-usage and CO₂ readings shown in the app. These are designed to be non-personal measurements that don't carry prompt content. We do not ask for, and you should not enter, special-category data (health, religion, ethnicity, and so on): remember that anything typed into a prompt is sent to the AI model to generate a reply.
No cookies, no third-party trackers. This website sets no cookies and runs no analytics or advertising scripts, so there's nothing to consent to. Every asset — fonts, images, styles — is served from our own European infrastructure; nothing loads from a third party outside the EU. The one exception is the optional feedback widget: if you send feedback, your message (and your email, only if you add one for a reply) goes to our EU backend, and we keep a one-way hash of your IP for abuse-prevention only — never the raw address.
how your data flows.
No hidden steps. Here is every point at which data moves — including the one most tools gloss over: the moment your prompt is sent to an AI model to get a reply.
1 · sign in
You sign in with a one-time magic link sent to your email — institutional single sign-on (such as SURFconext) is planned next. That establishes who you are, and nothing more.
2 · make (the model hop)
When you prompt the assistant, your prompt plus the relevant code and context leave your device and are processed by an AI model to generate a response. This is the hop — and it runs on inference hosted in the EU.
3 · preview
Previewing your project runs locally on your machine. Nothing leaves the device at this step.
4 · save
Your project files stay on your device in the desktop app, or on EU object storage (Scaleway, Paris "fr-par") for the web app. Either way, they stay in the EU.
5 · publish
If you choose to share, the built output is stored on EU object storage (Scaleway, Paris "fr-par") and given a public web address. Anything published is public to anyone with the link.
on data location
Inference runs on Scaleway Generative APIs in France (fr-par). The models are open-weight models served on EU soil — nothing crosses to the US. We describe EU residency as our operating commitment, becoming contractual as agreements are signed.
The plain claim we're working toward: identity and code stay on the institution's own systems; inference runs EU-hosted; publishing lands on EU storage; no US vendor touches student data. That's the design and the operating goal — see the honest-status note below for exactly where it is contractual today. More on the models themselves on sovereignty & models.
who else touches the data.
A sub-processor is a service MakeMode relies on to deliver the tool. The list is deliberately short, and each one operates under a data-processing agreement. We keep an up-to-date list and notify the institution of changes per our DPA.
One French EU vendor handles inference (Scaleway Generative APIs), object storage for published projects, and the supporting compute — all in the Paris region. Consolidating on one provider means one GDPR DPA and one clear data path.
The AI models that process your prompts are open-weight models served on Scaleway in France. They run on EU infrastructure; the data path does not leave the EU.
SURF (SURFconext / eduGAIN) is planned for a later phase as the identity provider for institutional single sign-on. Today, signing in is a one-time email magic link — no third-party identity broker in the path.
the rights every student keeps.
Under the GDPR you can ask to access the data held about you, rectify what's wrong, request erasure, restrict or object to processing, and get your data in a portable format. You can also lodge a complaint with a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens.
Because the institution is the controller, you can usually exercise these rights through the institution or through us. If you contact us, we act on the institution's instructions and may pass the request along to them.
you're using an ai system — and it doesn't grade you.
MakeMode includes an AI assistant. When you use it, you're interacting with an automated system, not a human, and the code and text it gives you are AI-generated. AI output can be wrong, incomplete or insecure — always review, test and verify it before relying on it, especially for coursework, where your institution's academic-integrity rules apply.
Under the EU AI Act, MakeMode is a tool for building and prototyping and is treated as a limited-risk system — our obligation is transparency, which is the purpose of this note. MakeMode is not intended for, and must not be used for, student assessment, grading, or other high-risk decisions about people.
an honest note on status.
We won't dress up intent as a settled legal guarantee. Today, EU data residency, no-retention of prompts beyond the request, and no-training on your data are MakeMode's design and operating commitment — and they become contractual as the data-processing agreements are signed (with the institution, with the inference host, and with Scaleway). Where a term isn't yet sealed in writing, we describe it as a goal, not a fact. This page is updated to state guarantees only once they are contractually in place — so a policy office can rely on what it reads here.
questions from your policy office?
We're glad to walk a data-protection officer or procurement team through any of this — the DPAs, the sub-processor list, the data flow, a DPIA. Read the rest of the trust pages, or just email us.