Codesigner

Terms of use for Codesigner

Version 2026-11. This English text is a translation for information only; the German version is binding.

§ 1 Scope and provider

1. These terms of use govern the use of the web service Codesigner (the "service"). The provider is «TODO: Gottfried Wilhelm Leibniz Universität Hannover», «TODO: postal address» (the "provider"). The service is run by «TODO: institute that runs Codesigner» (the "operator").
2. Terms of the users that deviate from these do not apply.

§ 2 Services

1. Codesigner is a tool for research and teaching that optimizes the hyperparameters of machine learning methods. Users can upload datasets, create experiments, start optimization runs, analyse results and share experiments within their group.
2. Use is free of charge.
3. There is no right to particular results, computing time or features. The provider may change, restrict or extend the features where this is reasonable for users.
4. Optimization runs execute on computers of Gesellschaft für wissenschaftliche Datenverarbeitung mbH Göttingen (GWDG), KISSKI.
5. An AI assistant answers questions about experiments and data. A language model generates its answers; they may be incomplete or wrong. Check them before relying on them.
6. The assistant acts only with your rights. It can open pages and pre-fill forms but never submits anything; the decision stays with you.

§ 3 Access and account

1. Access is given to people a group lead invites, in particular members of the provider and people from cooperation projects. There is no right to be admitted.
2. The account is created when the invited person chooses a password through the link sent to them and agrees to these terms of use. The link is valid for 24 hours.
3. The account is personal and not transferable. Keep your password secret and do not use it for other services. Report suspected misuse to «TODO: contact email for this service» without delay.
4. Users belong to one or more groups. Group leads manage their group's members and can see and manage the group's experiments.

§ 4 Obligations of users

1. Use the service and its computing power only for research and teaching and in accordance with applicable law.
2. In particular, you must not
   • upload unlawful content or infringe the rights of others, in particular copyright, database rights and personality rights;
   • upload malware;
   • circumvent security measures, use other people's accounts or access data not shared with you;
   • impair the service through automated mass requests or excessive load;
   • use computing power for other purposes, such as mining cryptocurrency;
   • pass your sign-in details on to others.
3. Report security vulnerabilities you notice to «TODO: contact email for this service» without exploiting them.

§ 5 Your content

1. Only upload datasets and other content you hold the necessary rights to.
2. Datasets must not contain personal data unless you may lawfully process it for this purpose and have anonymized or pseudonymized it as far as possible. Special categories of personal data (Art. 9 GDPR) must not be uploaded.
3. All rights to your content and results remain with you or other rights holders. You grant the provider the simple, free right to store, process, back up and transfer the content to the computing provider, as far as the service requires.
4. Depending on role and sharing, members of your group see your experiments. The operator sees experiments only as far as needed for support or to fix faults; every such access is logged.
5. The provider may block or remove content that breaches these terms or applicable law.

§ 6 Availability and backups

1. The provider strives for uninterrupted operation. There is no right to constant availability. Maintenance, faults, security measures or changes may interrupt the service, and running optimizations may then be stopped.
2. Backups serve only to restore operation. Codesigner is not an archive: download results you need to keep. Deleted experiments stay 30 days in the bin and can be restored during that time.

§ 7 Liability

1. The provider is liable without limitation for intent and gross negligence and for injury to life, body or health.
2. For slight negligence, the provider is liable only for breach of an essential obligation whose fulfilment makes proper use of the service possible in the first place and on whose observance you may regularly rely. Liability is then limited to the foreseeable damage typical for this kind of service. Otherwise, liability for slight negligence is excluded.
3. For loss of data, the provider is liable within paragraphs 1 and 2 only to the extent the damage would also have occurred with appropriate backups of your own (§ 6(2)).
4. Liability under the Product Liability Act and official liability (§ 839 BGB with Art. 34 GG) remain unaffected.
5. These rules also apply to the personal liability of the provider's employees.

§ 8 Suspension and termination

1. You can delete your account at any time under Settings → Account. Experiments you own then pass to your group's lead.
2. Group leads can remove you from their group. The operator can deactivate accounts whose entitlement has ended.
3. If you breach these terms, the operator may suspend your account and, after a prior warning, delete it. For serious breaches, in particular attacks on the service, immediate suspension without warning is permitted.
4. The provider may discontinue the service with four weeks' notice. You will be given the opportunity to download your data beforehand.

§ 9 Changes to these terms

1. The provider may change these terms for objective reasons, such as a change in the law or in the service.
2. The changed version is shown to you at your next sign-in. You can continue using the service only once you agree to it. If you do not agree, you receive your data on request to «TODO: contact email for this service», or your account is deleted.

§ 10 Data protection

How your personal data is processed is described in the privacy policy. It informs you under Art. 13 and 14 GDPR and is not part of the terms you agree to.

§ 11 Final provisions

1. The law of the Federal Republic of Germany applies.
2. If a provision is invalid, the remaining provisions stay valid.
3. The German version is binding. The English version is for information only.

---

Privacy policy for Codesigner

Version: 2026-11. This English text is a translation for convenience; the German version is binding. Codesigner is a tool for research and teaching that tunes the hyperparameters of machine learning methods. This policy describes the personal data it processes (Art. 13 and 14 GDPR).

1. Controller

«TODO: Gottfried Wilhelm Leibniz Universität Hannover», «TODO: legal form, e.g. Körperschaft des öffentlichen Rechts», «TODO: represented by, e.g. the President»
«TODO: postal address»
Email: «TODO: general contact email»

Codesigner is run by: «TODO: institute that runs Codesigner», «TODO: institute's postal address». For questions about this service and to exercise your rights: «TODO: contact email for this service».

2. Data protection officer

«TODO: name, postal address and email of the data protection officer»

3. Data processed, purposes, legal basis and retention

Unless stated otherwise, the legal basis is Art. 6(1)(e) GDPR in conjunction with § 3 of the Lower Saxony Data Protection Act (NDSG) and the university's tasks in research and teaching under the Lower Saxony Higher Education Act. Data kept for security is also processed to meet Art. 32 GDPR.

Data	Purpose	Kept for
Account: email address, display name, password (as a hash only), groups and roles, dates of registration, last sign-in and acceptance of the terms	Providing the account, collaboration in groups	until the account is deleted
Invitation and password links	Setting up the account and choosing a password	24 hours; an account never used is then deleted
Experiments: settings, uploaded datasets, results, notes, and a history of who changed or started what and when	Running the optimization, traceability within the group	until you or your group delete them; deleted experiments stay 30 days in the bin and then until the operator deletes them for good
Sign-in (session)	Staying signed in	14 days or until you sign out
Failed sign-in attempts: the identifier entered, IP address, browser identifier, time	Protection against password guessing	30 days
Web server logs: IP address, time, address requested, browser identifier, referring page	Operation, security and troubleshooting	«TODO: days Apache keeps its logs on the server (logrotate)» days
Support access: when the operator looks at experiments to help, each request is logged with the person's name, the time and the page	Accountability for support access	12 months
Assistant: your messages, the replies, the experiment's notes and extracts of the dataset (column names, statistics and up to 5 example values per column)	Answering your questions; fixing problems with the assistant	90 days after a conversation was last used, or until you delete it
Backups of all the data above	Recovery from failures	14 days

4. Recipients

• Your group: members see your display name and email address. Group leads see the group's experiments. Experiments you share are seen by the people you share them with.
• Operator: the administrators at «TODO: institute that runs Codesigner» see account data, usage statistics and, when helping, experiments, and to fix problems, conversations with the assistant. Each look at an experiment or conversation is logged with name and time.
• Email: invitations and password links are sent through the mail server of Leibniz Universität IT Services (LUIS).
• Assistant: the data listed above is sent to the language model at chat-ai.cluster.uni-hannover.de, which LUIS runs within the university.
• Compute jobs: for an optimization run, the dataset and settings are transferred to the computing centre of Gesellschaft für wissenschaftliche Datenverarbeitung mbH Göttingen (GWDG), KISSKI, acting as a processor under Art. 28 GDPR. The copies are deleted once the results are retrieved.

No data is transferred to countries outside the European Union. Data is not sold and not used for advertising or analytics. There is no automated decision-making within the meaning of Art. 22 GDPR.

5. Cookies and browser storage

Codesigner only uses cookies and browser storage that are strictly necessary for the service (§ 25(2) no. 2 TDDDG), so no consent is needed. No content is loaded from third parties, and no tracking or analytics tools are used.

• sessionid: your sign-in, 14 days.
• csrftoken: protects forms from misuse by other sites, one year.
• django_language: the language you chose, until you close the browser.
• codesigner-theme: the appearance you chose, one year.
• Browser local storage: page view states, such as open panels; they never leave your browser.

6. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).

• Under Settings → Account you can download all data held about you, change your display name and delete your account. Experiments you own then pass to your group's lead.
• To change your email address, and for anything else, write to «TODO: contact email for this service».

You also have the right to lodge a complaint with a data protection supervisory authority, for example: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover.

7. Obligation to provide data

An account cannot be set up without an email address. Everything else, such as a display name, is optional.

8. Personal data in your datasets

Only upload datasets that contain no personal data, or that you may lawfully process and have anonymized or pseudonymized as far as possible. You are responsible for this content under the terms of use.

9. Where the data comes from

Your email address and group membership were entered by the group lead who invited you (Art. 14 GDPR). All other data comes from you or arises from your use of the service.

10. Security

Codesigner is reachable only encrypted over HTTPS. Passwords are stored only as a hash. After several failed sign-in attempts, signing in is blocked for a while. Administration is reachable only from the institute's network and with a second factor.

11. Changes to this policy

If the service or the law changes, this policy is updated. The version published here applies.