EU Data Act Information

Effective date: 2026-10-06 · Version: 1.0.2 · Last updated: 2026-10-06

This page is published by Aidealy Ltd., of Hamidron 1, Herzliya 4654110, Israel (company registration number 517367066) ("Aidealy", "we"), under Regulation (EU) 2023/2854 (the "EU Data Act"). It contains the information the EU Data Act requires providers of data processing services to publish and keep up to date: where the infrastructure providing the Service sits and the measures protecting data held in the Union against conflicting foreign-government access (Article 28), the register of the data structures and formats in which your exportable data is available (Article 26(b)), and the fee and exit information for switching (Article 29(4) and (6)).

For customers whose Order Form place of incorporation or billing address is in the EU, the contractual switching and exit terms are in the Aidealy EU Data Act Rider, which applies to them automatically as part of their agreement with Aidealy. This page describes the same process in reader-facing terms; if this page and the Rider differ, the Rider governs. This page is published in English; the English text prevails over any translation.

1. Where the infrastructure providing the Service sits

Aidealy operates the Service in two strictly separated hosting regions. Each customer organisation (tenant) is assigned to exactly one region at onboarding, and its data is stored only in that region.

Three further points, stated for completeness and honesty:

• Aidealy Ltd. itself is an Israeli company and, like any company, can be legally compelled by the authorities with jurisdiction over it, including Israeli authorities; the hosting region controls where data is stored, not the company's own legal exposure.
• Sub-processors. The jurisdictions of the sub-processors we use, per service, are listed on our published Sub-processor List, which identifies each vendor's contracting entity and processing locations.
• AI inference. The zero-cross-region commitment is a storage guarantee. When the AI features run, content is processed transiently by whichever of our two AI model providers performs the step, and both are US recipients: Anthropic, PBC stores API data in the United States and offers no EU option (inference runs on US infrastructure for US-region tenants and may run in any geography for other tenants); OpenAI OpCo, LLC, a United States recipient, processes at its default endpoint (its EU regional option is supported in our software but not switched on). Either provider may perform any AI step, and Aidealy may change the routing at any time, including as a fallback, without adding a sub-processor. Each leg is a transfer to a US recipient covered by the EU Standard Contractual Clauses; both providers are named, with legal entities and processing locations, on our Sub-processor List.

2. Protection of data held in the Union against conflicting foreign-government access

The EU Data Act asks providers to describe, in general terms, the technical, organisational, and contractual measures they maintain to prevent international governmental access to, or transfer of, non-personal data held in the Union where that access or transfer would conflict with Union or Member State law. Aidealy's measures are:

• Technical. Strict region separation (an EU tenant's data is stored only in the EU region); encryption of customer data at rest, with a dedicated encryption key per tenant, and encryption in transit; role-restricted access controls and logged administrative access.
• Organisational. As a matter of practice, Aidealy handles government and law-enforcement demands touching any customer data on the same footing its Data Processing Agreement commits to for the personal data it covers: the affected customer is notified promptly unless the law prohibits it (and as soon as any prohibition lapses), the requesting authority is redirected to the customer first where lawful and available, disclosure is limited to the minimum legally required, and demands we have reasonable grounds to consider unlawful or overbroad are challenged with reasonable efforts.
• Contractual. Our Data Processing Agreement commits us, for the personal data it covers, to notify the affected customer promptly unless the law prohibits it (and as soon as any prohibition lapses), to redirect the requesting authority to the customer first where lawful and available, to disclose only the minimum legally required, and to use reasonable efforts to challenge demands we have reasonable grounds to consider unlawful or overbroad; demands touching any other customer data are handled under the organisational measures above.

To date, Aidealy has received no such demands.

3. Switching and exiting: the process and timelines

An EU customer can exit Aidealy, and take its data, on the following statutory path (the contractual version is the EU Data Act Rider):

1. Notice. You start a switch by giving notice (in writing, under the Rider). The notice period is at most two (2) months. You choose one of three exits - move to another provider, move to your own infrastructure, or have your data erased - in the notice or at any time up to the end of the notice period.
2. Transitional period. After the notice period, a thirty (30) calendar-day transitional period runs, during which the Service stays live and we provide reasonable assistance, maintain business continuity and security, and tell you about known risks to continuity. If completing the switch in 30 days is technically unfeasible, we tell you within fourteen (14) working days of your switching notice, with reasons, and set an alternative period of at most seven (7) months. You can extend the transitional period once.
3. Export. At your request, our support team exports the data you specify and delivers it in CSV (a structured, commonly used, machine-readable format; JSON is available for structures where Aidealy offers it) within ten (10) Business Days of the request (a "Business Day" is a day other than Friday, Saturday, or a public holiday in Israel). You choose the scope: any part of your exportable data, up to all of it; a request that does not narrow the scope covers all of it. The datasets available are listed in the register in Section 5.
4. Retrieval period. Your data remains retrievable for at least thirty (30) calendar days after the transitional period ends. An export requested in time is delivered even if delivery completes after the window closes.
5. Erasure. After the retrieval period (and delivery of any export requested within it), we erase your exportable data and digital assets. Erasure runs through the standard deletion mechanics described in our Data Retention & Deletion Policy (available on request), including time-limited encrypted backups that expire on their own short schedule and the narrow records other laws require us to keep.

When the switch completes: where you move to another provider or to your own infrastructure, the agreement (for the affected subscription) ends on successful completion of the switch - you confirm completion in writing, or completion is deemed confirmed ten (10) working days after every export you requested in time has been delivered and the retrieval period has ended, whichever of confirmation or deemed confirmation is earlier (Rider Section 9.1).

Switching and porting: methods, formats, and known limitations. The switching and porting procedure available for the Service is the notice-and-export path described above: exports are prepared and delivered by Aidealy's support team at your request - there is no self-service bulk-export console - and are delivered to you as per-dataset files in CSV (JSON is available for structures where Aidealy offers it); there is no direct provider-to-provider transfer mechanism. You scope the export at dataset level using the register in Section 5, and a full column-level data dictionary for your own exportable datasets is provided privately on request and during switching. Known restrictions and technical limitations: the Service does not maintain a copy of your repositories - the raw git inputs it ingests originate in, and remain within, your own systems of record, and its at-rest record of code changes is primarily fingerprint-based (hashes and coordinates rather than file contents, with limited per-file diff details held for some ingestion paths) - so an export contains the Service's records and derived metrics, not your source code; and functional equivalence at a destination provider is not provided (see "What the exit does not include" below), and Aidealy does not provide as part of the free exit, rebuilding your setup at a destination provider, developing new technologies, or disclosing Aidealy assets protected by intellectual-property rights or constituting trade secrets; functional equivalence at the destination is an infrastructure-tier (IaaS) duty and does not apply to a SaaS like Aidealy. Help beyond the mandated exit (custom formats, migration engineering, destination rebuild) is available as paid professional services.

Services with complex switching: no Aidealy standard service is offered on the basis that switching is impossible or subject to the Act's special regimes for custom-built or test services; if Aidealy ever offers a bespoke or non-production evaluation deployment relying on those regimes, the affected customers will be informed before contracting.

4. Fees when you switch

• No switching charges. Aidealy charges nothing for the switching process - including the mandated reasonable assistance and the standard export runs. The EU Data Act abolishes switching charges from 12 January 2027; Aidealy applies that position from day one and reserves no interim cost-based charges.

• Standard service fees continue. The subscription remains billable through the notice period, the transitional period, and the retrieval period - the Service is live and usable through them.

• Early termination fee (disclosed before contracting). If you exit a committed term (for example, an annual prepaid subscription) early via switching, an early termination fee equal to the fees for the entire remaining committed term applies, and prepaid fees for the terminated remainder are not refunded. For a prepaid term, the retained prepaid fees for that remainder are credited in full against the early termination fee and will normally fully satisfy it - the fee and the no-refund rule are two expressions of a single amount, never charged cumulatively.

  A monthly, non-committed option is available. Where a committed term is priced lower than the equivalent monthly price, the committed term is the trade for that discount. The EU Data Act expressly leaves early termination penalties outside the abolished switching charges and requires that they be disclosed before contracting - this section is that disclosure.

• Paid professional services remain available for work beyond what the Act mandates (additional custom export work, migration engineering, destination rebuild help), at the rates stated in the applicable Order Form or statement of work.

5. Register of exportable data structures

This is the online register, kept up to date, of the data structures and formats in which your exportable data is available. Every dataset below is available in CSV (structured, commonly used, machine-readable), and JSON is available for structures where Aidealy offers it; no common specification or harmonised standard for this service type has yet been published in the central Union standards repository for the interoperability of data processing services, so exports are provided under Article 30(5) of the Act. The register describes datasets at dataset level. A full column-level data dictionary for your own exportable datasets is provided to you privately on request, and during switching, as part of our switching assistance - it is delivered per customer and not published, because the underlying database structure includes Aidealy intellectual property and trade-secret material the Act does not require to be disclosed.

All datasets are per-tenant: they contain only your organisation's data.

Billing and subscription records are not part of this register: subscription purchases are transacted through our payment provider, Paddle, acting as Merchant of Record - Paddle holds the transaction records for those purchases, and your invoices are delivered to you when they are issued - and Aidealy's own internal billing-evidence records (see the Data Retention & Deletion Policy) are likewise outside it.

5.1 Analytics data lake: raw activity records

5.2 Analytics data lake: daily aggregates

5.3 Analytics data lake: executive summaries

5.4 Graph database collections

Relationship data. The graph database also links the records above (for example, which user authored which commit, or each contributor's share of a pull request, including contribution and effort measures). That relationship data is exported with the datasets it relates to - for example, per-contributor pull-request attribution is delivered as part of the pull-request export - rather than listed as separate datasets.

5.5 What is not in the register (exhaustive exemptions)

The following are not exportable data and are the only categories withheld, because they are Aidealy's own intellectual-property or trade-secret assets (or third parties'), not data you generated or co-generated by using the Service:

1. Aidealy's internal operational, configuration, and pipeline structures (processing state, query governance, system configuration) and Aidealy's own service audit logs.
2. The internal definitions of the graph structure itself (the schema and graph wiring), as distinct from the relationship data described above, which is exported with its datasets.
3. Aidealy's AI prompts, scoring implementation internals, and model configuration. (The scoring rubrics and formula are published on our website and are not a trade secret; what is withheld is the implementation, not the methodology.)

Nothing you provided or generated is excluded. No customer input or output data - including any of your repository content the Service holds at rest - is withheld under these exemptions, and the exemptions do not impede switching.

6. Questions

Questions about this page or an export: legal@aidealy.ai (contract questions) or your account contact (export requests). Security posture: our Security & Trust page. Data protection: our Privacy Policy (the privacy notice for the Service) and Data Processing Agreement.