Privacy Notice

This Privacy Notice explains how Karan Rajeshbhai Mungara ("we", "us"), as the data controller for Cofounder OS (the "Service"), collects, uses, shares, and protects your personal data.

1. Data We Collect

• Account data: name, email address, login credentials.
• Profile & content: personas, contexts, tasks, messages, files, and other data you submit to the Service.
• Integration data: tokens and content from third-party services you choose to connect (e.g. Gmail, MCP connectors), processed solely to provide the requested feature.
• Support communications: messages and attachments you send to support.
• Usage & telemetry: pages viewed, features used, error logs, approximate IP address, device and browser type.

Payment data (card details, billing address, tax identifiers) is collected directly by our payment processor Paddle and is not stored by us.

2. How We Use Your Data & Legal Basis

• Provide the Service — perform the contract with you (account creation, persona/agent functionality, integrations).
• Security & fraud prevention — legitimate interest in protecting users and the Service.
• Customer support — perform the contract / legitimate interest.
• Product improvement & analytics — legitimate interest, using minimised data.
• Legal compliance — legal obligation (tax, accounting, lawful requests).
• Marketing — only with your consent; you can withdraw consent at any time.

3. Sharing

We share personal data with:

• Service providers (subprocessors): hosting, database, email, analytics, error monitoring, and AI model providers — bound by contract to use data only to provide their service to us.
• Paddle.com, our Merchant of Record, for sale of the Service, subscription management, payments, tax compliance, and invoicing.
• Professional advisers (legal, accounting).
• Authorities where required by law or to protect rights, safety, or property.

We do not sell your personal data.

4. International Transfers

Your data may be processed outside your country. Where required, we use appropriate safeguards (e.g. Standard Contractual Clauses or adequacy decisions) to protect transfers.

5. Retention

We retain personal data for as long as needed to provide the Service and meet legal obligations. When you delete your account, we delete or anonymise your data within a reasonable period, except where retention is required by law (e.g. tax records).

6. Your Rights

Subject to applicable law, you may have the right to:

• Access your personal data;
• Rectify inaccurate data;
• Erase data ("right to be forgotten");
• Restrict or object to processing;
• Data portability;
• Withdraw consent;
• Lodge a complaint with your local supervisory authority.

To exercise these rights, contact us through the in-app support channel. We aim to respond within 30 days.

7. Security

We use appropriate technical and organisational measures — including encryption in transit, access controls, row-level security on user data, and approval-gated outbound actions — to protect your data. No system is perfectly secure; we cannot guarantee absolute security.

8. Cookies

We use essential cookies and similar technologies to keep you signed in and operate the Service. We do not use advertising cookies. If we add analytics or marketing cookies, we will request consent where required and provide controls to manage your preferences.

9. Children

The Service is not intended for individuals under 16. We do not knowingly collect data from children.

10. Changes

We may update this Notice. Material changes will be notified via the Service or by email. The "Last updated" date above reflects the current version.

11. Contact

Data controller: Karan Rajeshbhai Mungara. Contact us through the in-app support channel for any privacy-related questions or requests.