Privacy Policy

Cobenian Corporation ("Company," "we," "us"), a Virginia corporation, operates the Cobenian Suite — the Steward and Panel applications, the Cobenian Accounts control plane, and the Foundry and Data API platform services beneath them (together, the "Service"). This Privacy Policy explains how we collect, use, and protect your information across every product in the Suite. Product-specific detail appears in the schedules at the end.

1. Information we collect

Account information

When you create an account we collect your name, email address, and profile image from your Google or Microsoft account through OAuth authentication. We never ask for or store a password.

Email metadata

Where you connect a mailbox, we access email metadata: sender and recipient addresses, subject lines, timestamps, thread identifiers, and attachment presence indicators. We never access, request, or store the body content of your incoming or outgoing email.

Calendar data

Event titles, descriptions, times, locations, and attendee lists from a connected Google or Microsoft calendar.

Financial and time-tracking data

If you connect QuickBooks, we access customer records, invoice data (amounts, dates, statuses), and estimates. If you connect Harvest, we access time entries, projects, and client records. We use this data solely to provide the Service.

Business records you create in the Service

Records you or your team create or that the Service creates on your instruction — cases and their correspondence, questionnaire responses, documents and their status, monitoring signals and alerts, automation decisions and their audit trail.

SMS and voice data

Where your organization provisions a messaging- or voice-enabled number through us: phone numbers in E.164 format, message content (encrypted at rest), delivery metadata, call timestamps and duration, and call transcripts (encrypted at rest). Voice recordings are retained only if your administrator explicitly opts in; otherwise audio is transcribed and discarded immediately. We retain opt-in and opt-out proof records as compliance evidence under the TCPA and U.S. carrier rules (10DLC / A2P).

Chat data

If you connect Slack or Microsoft Teams, we store the conversation threads in which you interact with the Service and pointers to the business records referenced in them.

Usage data

Standard server logs including IP address, browser type, pages visited, and timestamps, for operating and improving the Service.

2. How we use it

Solely to provide and operate the Service:

• Computing what is normal for each of your clients and detecting meaningful changes
• Generating proposals, drafts, alerts, and inferred deadlines for your review
• Sending you transactional notifications through the channels you connected
• Sending outbound communications you authorize the Service to send on your behalf
• Authenticating you and managing your account, seats, and billing
• Diagnosing technical issues and improving the Service

3. AI processing

The Service uses third-party AI providers to classify information, generate summaries and drafts, and power conversational features. The following categories may be transmitted as needed to operate the Service: email subject lines and other metadata fields; calendar event titles; business records you create in the Service; SMS bodies sent to or by the Service; voice audio and transcripts during a live interaction; and chat content from Slack, Teams, and the in-app assistant.

Email body content is never transmitted to any AI provider, because we never collect it. Our AI providers process data under contractual data-protection terms and do not train their public models on it.

4. What we do not do

• We do not read, access, or store email body content
• We do not sell your data
• We do not share your data with third parties for their marketing purposes
• We do not use your business data to train public AI models

5. Sharing

We share personal information only in these limited circumstances:

• Service providers. The vendors listed in our subprocessor list process data on our behalf under contractual obligations to protect it.
• Legal requirements. Where required by applicable law, regulation, legal process, or governmental request.
• Business transfers. In a merger, acquisition, or sale of assets your data may transfer as part of the transaction. We will notify you.

6. Security

• OAuth tokens encrypted at rest with AES-GCM
• SMS bodies, call transcripts, and any retained recordings encrypted at rest
• HTTPS for all data in transit
• Webhook signature verification on inbound and outbound delivery
• Per-workspace data isolation and scoped, least-privilege access
• Sign-in delegated to Google or Microsoft; we never hold your password

7. Your choices and rights

You can disconnect any integration at any time, which stops further collection from that source. You can export or delete your data, and deleting your account deletes the data associated with it. To exercise any right, or to ask what we hold about you, email privacy@cobenian.com.

8. Retention

We retain your data for as long as your account is active and for the period afterwards needed to meet legal, tax, and compliance obligations. Messaging opt-in and opt-out records are retained as carrier-compliance evidence regardless of account status.

9. Changes

We will post any change here and update the date at the top. Material changes will also be notified in-product or by email.