DifVi Privacy Policy
Version 1.1 | Effective November 4, 2026 · Updated November 10, 2026
1. Who we are and what this policy covers
DifVi is operated by MCHO LLC, a Delaware limited liability company operating from Florida, United States (“DifVi,” “we,” “us”). This policy covers difvi.ai, difvi.com, the DifVi desktop application, and related account, billing and support services. It does not cover unrelated MCHO websites or services.
Contact us about privacy, support or deletion at support@difvi.ai. Our business mailing address is MCHO LLC, 3625 New Jerusalem Road, Vernon, FL 32462, United States.
MCHO LLC is responsible as controller for personal information used to administer accounts, billing, support and our own service operations. Where we process personal information contained in an organization’s code or other content solely on its instructions, we act as its processor to the extent applicable law provides. Organizations should contact us to arrange any required data processing agreement before submitting such information.
2. Information we process
Account information: your name, email address, account identifiers, authentication information and preferences needed to provide access.
Billing records: subscription and payment status, plan, invoices, transaction identifiers and related customer information received from Stripe. Payment card details are entered directly into Stripe’s payment interface. We do not receive or store full card numbers or card security codes on DifVi systems. Stripe may retain billing information and make limited transaction or payment-method information available to us.
Requested AI content: when you request a cloud AI feature, the request may include prompts, relevant source-code differences, surrounding code, descriptions of changes or pull requests, and related project context. Requests and responses may contain personal information embedded in that content.
Technical and usage information: IP address, app or browser version, operating system, timestamps, service errors, security events, feature interactions, and AI usage quantities needed for operation, metering, troubleshooting or analytics.
Communications: information you provide when contacting support, submitting feedback or asking us to investigate a problem. Please avoid sending passwords, API keys or unrelated confidential information.
3. Local code and requested AI processing
DifVi reads projects you choose to open locally and helps you visualize and review changes across Git worktrees. Opening a project is not permission for unrestricted uploading of the repository. Cloud AI processing is initiated when you request an AI feature; relevant code and context then leave your device.
Depending on the app version and configuration, an AI request goes directly from your device to OpenRouter, or passes through DifVi’s servers before being routed through OpenRouter to an upstream model provider. Results return through the corresponding route. Request content can include surrounding context beyond the exact text you highlighted.
OpenRouter and the selected model provider process the request to generate the response. For AI requests routed through accounts and infrastructure controlled by DifVi, we will apply available no-training controls and provider-routing restrictions within our control before transmitting customer content. We will not knowingly enable an option permitting those providers to train on your source code, prompts or responses. If we cannot enforce the applicable no-training restriction for a DifVi-managed route, we will not use that route for customer content.
These controls are not a guarantee of a third party’s independent compliance or a promise of zero retention. Providers may retain information for permitted service, security or legal purposes under their applicable terms. OpenRouter’s privacy information is available at https://openrouter.ai/privacy/.
When you independently connect your own provider account, API key, coding agent or external service, you are responsible for reviewing that provider’s training, retention and privacy policies, configuring the settings available to you, and ensuring you have authority to send the content. A provider you select remains our responsibility to the extent it processes data on our behalf; merely choosing a model in DifVi does not transfer our legal obligations to you. Contact support if you need information about a DifVi-managed provider.
We do not use your source code, prompts or responses to train our own AI models. We do not have personnel inspect your private code for routine product improvement. If you ask for assistance requiring code inspection, we will obtain your explicit permission for that inspection. Disclosures compelled by law are addressed below.
Connected coding agents may independently send information to their own providers under your agreements and settings with them. Their traffic is distinct from DifVi’s own AI requests.
Only submit code or other content you are authorized to process through these services, including any required employer or client permission. Do not include secrets or sensitive personal information that the requested feature does not need.
4. Why we use information
We use information to provide accounts and requested features, process subscriptions, meter usage, deliver support and service notices, investigate errors, prevent abuse, maintain security, and meet legal and accounting obligations. We use optional analytics to understand product usage under the notice and choices described below.
Where European or UK data protection law applies, our legal bases are performance of our contract with you for account administration and requested services; legitimate interests in secure, reliable operations and proportionate business administration; legal obligations for required records and disclosures; and consent for optional tracking or other processing where consent is required. For an organization’s users, account administration may rely on legitimate interests rather than a contract with each individual. You may object to processing based on legitimate interests.
We do not use this information to make solely automated decisions producing legal or similarly significant effects about you.
5. Analytics and tracking
On our website (difvi.ai), we use PostHog to count page visits and steps in our forms, such as starting or sending an access request. This works without cookies or similar storage on your device: each page view gets a random identifier that is forgotten when you leave the page. These events do not include your email address, anything you type into a form, or a location derived from your IP address. Access requests and team inquiries you send are stored separately so we can reply to you.
We use PostHog for product analytics, such as feature views, clicks, navigation and error-related events. We provide appropriate notice and obtain consent before optional analytics runs where required.
Our analytics and any session replay exclude source code, prompts, credentials, payment details, and network request and response bodies. We do not send or retain those categories in analytics or session recordings. If session replay is offered, it requires separate notice and an affirmative choice before recording begins. Declining optional recording does not prevent core service use.
Technical records necessary for authentication, security, billing and requested service functions are distinct from optional product analytics. Identifiers in those records may be personal information even when they do not include your name.
We provide controls to change optional tracking choices and update this policy as needed. You can also contact support@difvi.ai for assistance. Browser storage controls can affect essential sign-in functionality.
6. Who receives information
Information is available to authorized personnel and service providers only for relevant purposes. Providers include Stripe for payments, OpenRouter and upstream model providers for requested AI processing, and providers supporting hosting, authentication, databases and transactional email. Hetzner provides website hosting; infrastructure supporting other features may vary as the service develops. PostHog processes the permitted analytics events described in section 5. Contact us for the current provider list relevant to your account.
We may disclose information to comply with a binding legal obligation, protect rights and security, investigate fraud, or establish or defend legal claims. We may also disclose information to professional advisers under appropriate confidentiality duties or in connection with a merger, financing or business transfer, subject to applicable safeguards and notice requirements.
We do not sell personal information or share it for cross-context behavioral advertising. We do not provide customer code to advertisers.
7. International processing
We operate in the United States and Europe and use providers that may process information in other countries. Your data is not guaranteed to stay in your country or in the European Union.
Where applicable law restricts a transfer, we use a lawful mechanism, such as an applicable adequacy decision or standard contractual clauses with additional safeguards where necessary. Contact support@difvi.ai for information about safeguards applicable to your data and how to obtain a copy, subject to protection of confidential information.
8. Retention and deletion
We retain account information while needed to provide your account and address account-related requests. After closure, we delete or de-identify information no longer needed, while retaining records necessary for tax and accounting obligations, fraud prevention, dispute resolution or legal claims.
Support records are retained while needed to resolve the matter and reasonably address related follow-up or disputes. Technical logs and analytics are retained only for their operational, security and measurement purposes. Relevant criteria include the type and sensitivity of data, the purpose of collection, incident-investigation needs, legal retention periods, and whether aggregated information can meet the same purpose.
Requested AI content is processed to deliver the response. Any retained request content, response history or troubleshooting material is subject to the same necessity and purpose limits; this policy is not a promise of zero server logging or immediate deletion from every provider. Provider retention and backup cycles may differ. Contact us for information about the configuration applicable to your use.
Request account closure or deletion at support@difvi.ai. Deletion from active systems may precede expiration from restricted backups. We explain any lawful reason for retaining information. Closing a DifVi account does not delete your local repositories or independently held accounts with Stripe, OpenRouter or your coding-agent providers.
9. Your rights and choices
Depending on applicable law, you may request access, correction, deletion, restriction, portability or information about our processing; object to processing based on legitimate interests or direct marketing; withdraw consent without affecting earlier lawful processing; and appeal a decision on a request where that right applies.
Email support@difvi.ai. We may request proportionate identity verification and will respond within applicable statutory deadlines. Authorized agents may act where permitted, subject to verification of authority. We do not discriminate for exercising protected rights.
You may complain to the data protection authority where you live or work or where an alleged infringement occurred. UK residents may contact the Information Commissioner’s Office. Applicable U.S. state rights depend on the law and whether it applies to our business.
10. Security and age eligibility
We use encrypted connections for communications with our service and limit access according to operational need. No service or transmission method is completely secure. We investigate security incidents and notify affected people and authorities when required by applicable law.
DifVi is not intended for children under 16. Users aged 16 or 17 must have parent or guardian involvement where needed to enter a valid contract or give legally required consent. If you believe a child under 16 has supplied personal information, contact us so we can investigate and take appropriate action.
11. Changes and contact
We update this policy as the service and its data practices change and show the revised effective date. For material changes, we provide additional notice and obtain consent where legally required before undertaking processing requiring that consent.
Privacy questions and requests: support@difvi.ai
MCHO LLC, 3625 New Jerusalem Road, Vernon, FL 32462, United States.