LEGAL
Privacy Policy
Last updated: October 10, 2026 · Applies to every Cobenian product: Steward, Panel, Accounts, Foundry, and the Data APIs, to the Cobenian FREE Build program, and to the Cobblebook survey service.
The short version. We never read the body of your email. We don't sell your data, and we don't share it for anyone's marketing. Your data is isolated to your workspace, connection tokens are encrypted, and you can delete everything at any time.
Cobenian Corporation ("Company," "we," "us"), a Virginia corporation, operates the Cobenian Suite — the Steward and Panel applications, the Cobenian Accounts control plane, and the Foundry and Data API platform services beneath them (together, the "Service"). This Privacy Policy explains how we collect, use, and protect your information across every product in the Suite. Product-specific detail appears in the schedules at the end.
1. Information we collect
Account information
When you create an account we collect your name, email address, and profile image from your Google or Microsoft account through OAuth authentication. We never ask for or store a password.
Email metadata
Where you connect a mailbox, we access email metadata: sender and recipient addresses, subject lines, timestamps, thread identifiers, and attachment presence indicators. We never access, request, or store the body content of your incoming or outgoing email.
Calendar data
Event titles, descriptions, times, locations, and attendee lists from a connected Google or Microsoft calendar.
Financial and time-tracking data
If you connect QuickBooks, we access customer records, invoice data (amounts, dates, statuses), and estimates. If you connect Harvest, we access time entries, projects, and client records. We use this data solely to provide the Service.
Business records you create in the Service
Records you or your team create or that the Service creates on your instruction — cases and their correspondence, questionnaire responses, documents and their status, monitoring signals and alerts, automation decisions and their audit trail.
SMS and voice data
Where your organization provisions a messaging- or voice-enabled number through us: phone numbers in E.164 format, message content (encrypted at rest), delivery metadata, call timestamps and duration, and call transcripts (encrypted at rest). Voice recordings are retained only if your administrator explicitly opts in; otherwise audio is transcribed and discarded immediately. We retain opt-in and opt-out proof records as compliance evidence under the TCPA and U.S. carrier rules (10DLC / A2P).
Chat data
If you connect Slack or Microsoft Teams, we store the conversation threads in which you interact with the Service and pointers to the business records referenced in them.
Usage data
Standard server logs including IP address, browser type, pages visited, and timestamps, for operating and improving the Service.
2. How we use it
Solely to provide and operate the Service:
- Computing what is normal for each of your clients and detecting meaningful changes
- Generating proposals, drafts, alerts, and inferred deadlines for your review
- Sending you transactional notifications through the channels you connected
- Sending outbound communications you authorize the Service to send on your behalf
- Authenticating you and managing your account, seats, and billing
- Diagnosing technical issues and improving the Service
3. AI processing
The Service uses third-party AI providers to classify information, generate summaries and drafts, and power conversational features. The following categories may be transmitted as needed to operate the Service: email subject lines and other metadata fields; calendar event titles; business records you create in the Service; SMS bodies sent to or by the Service; voice audio and transcripts during a live interaction; and chat content from Slack, Teams, and the in-app assistant.
Email body content is never transmitted to any AI provider, because we never collect it. Our AI providers process data under contractual data-protection terms and do not train their public models on it.
4. What we do not do
- We do not read, access, or store email body content
- We do not sell your data
- We do not share your data with third parties for their marketing purposes
- We do not use your business data to train public AI models
5. Sharing
We share personal information only in these limited circumstances:
- Service providers. The vendors listed in our subprocessor list process data on our behalf under contractual obligations to protect it.
- Legal requirements. Where required by applicable law, regulation, legal process, or governmental request.
- Business transfers. In a merger, acquisition, or sale of assets your data may transfer as part of the transaction. We will notify you.
6. Security
- OAuth tokens encrypted at rest with AES-GCM
- SMS bodies, call transcripts, and any retained recordings encrypted at rest
- HTTPS for all data in transit
- Webhook signature verification on inbound and outbound delivery
- Per-workspace data isolation and scoped, least-privilege access
- Sign-in delegated to Google or Microsoft; we never hold your password
7. Your choices and rights
You can disconnect any integration at any time, which stops further collection from that source. You can export or delete your data, and deleting your account deletes the data associated with it. To exercise any right, or to ask what we hold about you, email privacy@cobenian.com.
8. Retention
We retain your data for as long as your account is active and for the period afterwards needed to meet legal, tax, and compliance obligations. Messaging opt-in and opt-out records are retained as carrier-compliance evidence regardless of account status.
9. Changes
We will post any change here and update the date at the top. Material changes will also be notified in-product or by email.
Schedule A — Steward
Steward reads the mailbox, calendar, invoicing, and time-tracking sources you connect in order to propose actions for your approval. Everything in sections 1–3 above applies. Steward is the only product in the Suite that connects to a mailbox, and it reads metadata only.
Steward's messaging disclosures for SMS and voice, including STOP/HELP keywords and message frequency, are published at steward.cobenian.com/sms-terms.
Schedule B — Panel
Panel holds the business records its instruments create: cases and their correspondence, questionnaire responses, monitoring signals and alerts, document status, and the decision log for any automation you enable. Panel reads connected systems (such as QuickBooks, Harvest, Jira, or GitHub) through the same connections you authorize, and does not connect to a mailbox for reading.
Where an instrument collects information from someone outside your organization — a client answering a questionnaire, a person emailing your case queue — you are the controller of that information and we process it on your behalf.
Schedule C — Cobenian Accounts
Accounts is the control plane: identity, organizations, seats, entitlements, usage metering, and billing. It holds no product data. It records the usage totals and spending caps that determine your bill, and the audit trail of administrative actions taken in your organization.
Schedule D — Platform services
Cobenian Foundry and the Cobenian Data APIs are shared infrastructure underneath the products above, not separately sold services. Foundry holds the connections you authorize, the event history the products act on, stored files, and the conversation records described in section 1; the Data APIs hold canonical business records on behalf of the product that wrote them. Everything in sections 1–8 applies to them. You interact with them only through a product you already use, and no data reaches them except by way of one.
Schedule E — Cobenian FREE Build program
The FREE Build program is described in its official rules. This schedule covers the information we collect for it. Sections 4–7 above (what we do not do, sharing, security, and your choices) apply here as well.
What we collect
- Applications: your name, work email and, if you give it, phone number; your company, role, industry and size; and your answers about the problem, what it costs you, what you have tried and your budget.
- Nominations: the nominator’s name and email, and the nominated business’s name and contact’s name and email.
- Next-round sign-ups: your email address.
How we use it
We use this information to assess applications, run the program and contact you about it. If you ask to hear about future rounds, we also email you about the program, and you can unsubscribe at any time. A nominated business receives at most one email about it per round, and can opt out of further emails permanently with one click. To honor that opt-out, we keep a one-way coded fingerprint of the email address, not the address itself, so we can recognize it if the business is nominated again. We keep this fingerprint after the contact’s other details are deleted, so the opt-out keeps working.
We may use information from applications, combined and anonymized, in published research about small businesses, for example a yearly report. We never publish anything that identifies you or your business without your permission, and we only report groups of at least 10 businesses. We do not publish the contents of an application without the applicant’s permission.
Sharing
We do not sell this information or share it outside Cobenian, except with the service providers that host our forms and email.
How long we keep it
- Submissions that are never confirmed by email are deleted after 48 hours.
- Applications are kept after the round closes so we can consider them for later rounds, until you ask us to delete them.
- If a nominated business does not apply, we delete its contact’s name and email 90 days after the round closes.
To have your application or other information deleted, email info@cobenian.com.
Finalists and the selected business
Finalists’ working sessions are recorded only with their consent, and finalists are named publicly only with their permission. For the selected business, the information we handle during the build, including any recorded interviews and before-and-after measurements, is governed by the FREE Build Agreement. We use AI development tools, including Anthropic’s Claude, so some project information passes through them under those providers’ terms, including Anthropic’s privacy policy. We work from sample or anonymized data wherever real data isn’t needed, and we tell the business before real data is used. Its software and data are not published; anything we publish about the project shows the software with sample data only.
Schedule F — Cobblebook
Cobblebook is our common-area condition survey service for community associations and the companies that manage them. This schedule covers the information we collect for it. Sections 3–7 above (AI processing, what we do not do, sharing, security, and your choices) apply here as well.
What we collect
- Enquiries: your name and email, the community or company you represent and its approximate number of homes, and what you ask us for.
- Survey records: photos, video, measurements, GPS positions and the route walked, taken from walkways and other common areas of the community that engaged us.
- Reported items: when a board member, manager or resident reports something for us to check, its description and location and, if given, the reporter’s name and contact details.
- Association records: documents an association or its manager gives us to work from, such as asset lists, a reserve study, and repair history and costs.
People, vehicles and homes in photos
We photograph common-area assets such as sidewalks, lights, signs and drains. People, vehicles and homes can appear in the background. We blur faces, license plates and house numbers before a photo is added to a report, we do not photograph into windows or fenced yards, and we leave out photos that cannot be made suitable. We do not survey individual homes or record covenant violations.
How we use it
We use survey records to produce an association’s reports, to track each item until it is resolved, and to forecast what is likely to need work. We use enquiries to answer you. We may use measurements and outcomes, combined across communities and with nothing that identifies a community or a person, to improve our forecasts and to publish comparisons.
Photos and video from a survey may be processed by AI models to find and describe conditions, under the same provider terms described in section 3. A person reviews every finding before it is reported.
Who controls it
The association that engaged us, or the management company acting for it, is the controller of its survey records, and we process them on its behalf. If you live in a community we survey and have a question about a report or a photo, contact your association or its manager; we will help them respond, and you can also write to us at the address below.
Sharing
An association’s reports are shared with its board and its manager, and with anyone else it tells us to share them with. Where an item appears to belong to a public agency or a utility, we report its location, a description and a photo of the item to that body on the association’s behalf. We do not sell survey records or enquiry details, we do not pass them to contractors as leads, and we take no referral fees. Our hosting and email providers process this information for us.
How long we keep it
- Survey records are kept for as long as the association is a client, because the history is the service.
- When an engagement ends, we give the association a copy of its records on request and delete them when it asks us to.
- Original, unblurred photos are kept only as long as needed to produce and check a report.
- Enquiries are kept until you ask us to delete them.
To have an enquiry or other information deleted, email info@cobenian.com.
Contact
Cobenian Corporation · privacy@cobenian.com · +1 703-828-5180