1. Scope & Legal Frameworks

This policy is designed to align with the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA). Where a specific regional right applies to you, the relevant section below governs. If you do not agree with this policy, please do not use the Service.

2. Information We Collect

• Account information: your name, email address, and the authentication provider you use (Google, Apple, or email/password) via Firebase Authentication.
• Content you provide: pitch deck files, pasted text, links you submit for analysis, deal parameters, coaching-session messages and (optionally) audio you record, and any drafts you save. This content may contain confidential business information.
• Payment information: when you purchase a plan, payment is processed by Stripe. We receive limited billing details and subscription status; we do not collect or store your full card number.
• Team & collaboration data: the names, email addresses, and roles of people you invite to your workspace, and invitation status.
• Usage & device data: log data, IP address, browser/device type, and interactions with the Service, collected to operate, secure, and improve it.
• Communications: messages you send us (e.g., contact or support requests).

3. How We Use Information

• To provide the Service — generate audits, scores, rewrites, coaching, and exports.
• To create and secure your account, and to authenticate you.
• To process payments, manage subscriptions and seats, and prevent fraud.
• To operate, maintain, debug, secure, and improve the Service.
• To communicate with you about your account, purchases, and support requests.
• To comply with legal obligations and enforce our Terms.

4. Legal Bases for Processing (GDPR/UK GDPR)

Where GDPR applies, we process personal data on these bases: performance of a contract (to provide the Service you request); legitimate interests (to secure and improve the Service and prevent abuse); consent (where required, e.g., certain communications or optional features); and legal obligation.

5. Your Content & AI Processing

To generate your results, the content you submit is sent to Google's Gemini API for processing, subject to Google's applicable API terms. In addition:

• We do not sell your content, and we do not use your pitch content to train our own models.
• We access AI processing through Google's commercial API rather than consumer AI products.
• We share your content only with the sub-processors listed in Section 7, strictly to provide the Service.

6. Automated Analysis

The Service uses automated AI to generate scores, critiques, and recommendations. These outputs are informational and preparatory; they are not final decisions that produce legal or similarly significant effects about you. You may contact us with questions about any output.

7. Sub-Processors & Sharing

We do not sell or rent your personal information. We share it only with service providers who process it on our behalf to run the Service:

• Google (Gemini API, Firebase Authentication & Firestore, Google Cloud, optional Workspace export): AI processing, authentication, database, hosting, and user-authorized exports.
• Stripe: payment processing and subscription management.
• Resend / SendGrid: transactional email delivery (e.g., report summaries, team invitations).
• Gamma: optional presentation generation, when you choose to use it.

We may also disclose information if required by law, to protect our rights or users' safety, or in connection with a merger or acquisition (with notice where required).

8. Cookies & Similar Technologies

We use only cookies and similar local storage that are strictly necessary to authenticate you, keep you signed in, and operate core functionality. We do not use them for third-party advertising. If we introduce non-essential cookies in the future, we will update this section and provide a consent mechanism where required.

9. Data Retention

We retain your account and audit data for as long as your account is active and as needed to provide the Service. When you delete an audit or your account, we delete or de-identify the associated personal data within approximately 30 days, except where we must retain limited records to comply with legal, tax, accounting, or security obligations.

10. Security

We use reasonable, industry-standard technical and organizational measures to protect your information, including encryption in transit (TLS) and encryption at rest provided by our cloud infrastructure (Google Cloud / Firebase), access controls, and database security rules. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal data, we will notify you and regulators as required by law.

11. International Data Transfers

The Service and our providers are based in the United States, and your information will be processed there. Where we transfer personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

12. Your Rights

California (CCPA/CPRA): the right to know, access, correct, and delete your personal information; the right to opt out of "sale" or "sharing" (we do not sell or share personal information as defined by the CPRA); and the right not to be discriminated against for exercising these rights. California requests can be sent to ccpa@cogently.app.

EEA/UK (GDPR): the rights of access, rectification, erasure, restriction, data portability, objection, and to withdraw consent, plus the right to lodge a complaint with your supervisory authority.

You can delete audits and your account from your dashboard, or exercise any right by contacting us (Section 14). We will verify your request and respond within the timeframe required by law.

13. Children's Privacy

The Service is intended for business users and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact us and we will delete it.

14. Changes & Contact

We may update this policy from time to time; we will post the updated version here and revise the effective date, and provide additional notice where required. For any privacy question or to exercise your rights, contact us at privacy@cogently.app.