1. Who we are
Cofleet AB (org. nr. 559594-0965), Finn Malmgrens väg 52, 121 38 Johanneshov, Sweden, provides shared company knowledge and memory for AI tools. Contact markus@cofleet.app about this policy or your personal data.
This notice covers our website, demo and waitlist requests, business contacts, and the hosted Cofleet web and desktop apps. The Terms of Service and Data Processing Agreement govern the service relationship.
2. Our role and your organisation’s role
Cofleet as controller. We decide how to handle website enquiries, business-contact and billing records, and the account administration and security information needed to operate our relationship with you. The purposes and legal bases below apply to processing for which we are controller.
Cofleet as processor. Your organisation selects the content to import and the purposes for using its shared memory. We process that content and associated personal data on its documented instructions under the DPA. If your organisation is itself a processor, we act as its subprocessor. It determines the lawful basis and the notices required for that processing; this policy does not replace its notice.
Imported documents, messages and answers can concern employees, contractors, customers and other people who have never registered with Cofleet. We receive their information from the organisation, its users and the sources it authorises. For requests about that content, contact the organisation or write to us so we can forward the request and assist it.
3. Information we receive
- Account and access information: your name, email/contact address, Google or Microsoft work/school identity, organisation and workspace membership, role, invitations, approval and sign-in/session records. The identity provider supplies sign-in information and handles its own processing under its privacy notice; Cofleet does not receive your provider password.
- Business and support information: contact details, correspondence, general feedback, organisation details, agreed pilot/subscription details and invoicing records. Where an agreement is accepted electronically, the acceptance record identifies the organisation, authorised acceptor, time and document versions.
- Selected customer content: files, notes, questions, answers, chat messages and content from explicitly authorised sources such as Google Drive, SharePoint or Notion. Connected Slack or Teams features may receive messages and deliver replies or notifications when the organisation enables them. This is not access to every tool or every file in your organisation.
- Legacy desktop quick-save: in app versions that include this feature, when you invoke capture, selected text and its source application/window title can be sent to the selected workspace. The desktop app keeps local session settings and may show a saved-content preview in an operating-system notification; restricted captures suppress the content preview.
- Derived service data: extracted text, embeddings, memories, summaries, source references and AI responses. These can contain personal data too. We also handle connector permissions and protected credentials needed to access selected sources.
- Operational information: request and security records, timestamps, IP addresses, user agents, response/error information and usage records needed to protect and operate the service.
Product telemetry. The existing application sends server-side events to PostHog EU Cloud when enabled: account approval, joining a workspace, adding a source, asking or answering a question, opening the app, viewing knowledge and connecting an integration. Events use account/workspace identifiers, timestamps, fixed categories, counts and yes-or-no values. Feature availability checks also send the user identifier to PostHog. Identifiers are personal data even when names and email addresses are excluded.
Product telemetry also includes AI-call metadata (model and run/trace identifiers, token counts, latency, attempt counts, success/failure status and fixed error categories) and daily and month-to-date workspace model-cost totals, including generation/embedding breakdowns and currency. We use these records to understand service use, measure and manage operating costs and diagnose reliability issues. Customer documents, source text, prompts, outputs, memory content, names, email addresses, URLs, window titles and raw error messages or payloads are excluded from PostHog. There is no browser analytics SDK, analytics cookie, session replay, advertising tracking or unrestricted automatic capture. Processing must remain within the scope of the organisation’s accepted DPA; publishing a new version does not expand an existing agreement.
Organisations can request that PostHog telemetry be disabled by contacting us. There is no per-user telemetry switch, and clearing browser storage does not stop server-side processing. See Your rights for the right to object.
Demo requests and waitlist. Current website forms ask only for your email. We record the address, signup type/source, request date, update preference and confirmation-delivery status. We may also hold company-size selections and descriptions submitted through earlier questionnaires. The form explains that submission includes occasional updates. These records are separate from a product account.
Website requests and storage. We run no website analytics or advertising pixels. Cloudflare handles web requests, Google serves the fonts, and our registration service receives submitted forms. The website remembers a chosen theme in local storage and a preview unlock for the current tab. The Cookie Policy describes these and application storage.
We do not sell personal data or use it for advertising. The hosted pilot does not authorise special-category data, criminal-offence data, national identification numbers, payment-card credentials or other highly sensitive regulated data. The Terms and DPA require a separate written agreement and appropriate safeguards before those data types are added.
The web app keeps a sign-in token in local storage. The desktop app protects persisted session secrets using the operating system’s secure storage where available; without it, secrets remain in memory. Clearing local storage does not delete content already saved to your organisation’s workspace.
4. Purposes and legal bases
| Purpose where Cofleet is controller | Legal basis |
|---|---|
| Administer business accounts, membership, customer relationships and service communications | Legitimate interests in providing and administering the service requested by your organisation (GDPR Article 6(1)(f)). Where you personally are a contracting party, necessary processing to perform that contract is based on Article 6(1)(b). |
| Respond to enquiries, demo requests and requested waitlist invitations | Legitimate interests in responding to the contact and service information you requested (Article 6(1)(f)). |
| Send occasional updates to website subscribers | Consent (Article 6(1)(a)), recorded with the signup. Withdraw using the unsubscribe link or by contacting us. You can also contact us directly for a demo without subscribing. |
| Protect accounts, prevent abuse, investigate faults and maintain reliability | Legitimate interests in a secure and reliable service (Article 6(1)(f)); legal obligation (Article 6(1)(c)) where a specific legal duty requires a record or disclosure. |
| Understand product use and operating costs through the limited telemetry described above | Legitimate interests in improving the service and managing its operation (Article 6(1)(f)), subject to the applicable DPA restrictions and your right to object. |
| Handle support, feedback, legal requests and disputes | Legitimate interests in responding, resolving problems and establishing or defending legal claims (Article 6(1)(f)); legal obligation where applicable (Article 6(1)(c)). |
| Maintain invoicing and accounting records | Legal obligation (Article 6(1)(c)). |
We must balance legitimate interests against your rights. You may ask for information about that assessment and object to processing based on those interests. Marketing objections are unconditional: we stop direct marketing when you object.
Sign-in and membership information are needed to provide access; without them we cannot create or authenticate your account. Business billing details are needed when invoicing applies. Support messages, demo requests and marketing subscriptions are voluntary. Withdrawing marketing consent does not remove your product account or prevent essential service messages.
5. AI processing
Cofleet uses Google’s Gemini through Vertex AI for generation and embeddings to organise selected knowledge and answer questions. Self-hosted Hindsight provides the memory service inside Cofleet’s cloud infrastructure; it is not a separate hosted provider.
Cofleet will not use Customer Content or personal-data-bearing Usage Data to train general-purpose or shared models, or authorise its providers to do so. Processing to deliver the agreed service, including generation and embeddings, remains permitted under customer instructions and the DPA. We do not assume that removing a name makes content anonymous.
Google may retain hosted Gemini prompts flagged for suspected abuse for up to 90 days for abuse review. This is distinct from Cofleet’s operational logs and does not permit model training. We do not claim an abuse-monitoring exemption.
AI output can be inaccurate and needs human review. Cofleet does not use these outputs to make solely automated decisions about people with legal or similarly significant effects. Your organisation is responsible for reviewing its own uses of the outputs.
7. Locations and international transfers
Account data and customer content are hosted in the EU. The hosted service uses Google Cloud regional resources in Belgium, generation through Google’s EU endpoint and regional embeddings. PostHog uses EU Cloud in Frankfurt. EU hosting does not mean that every provider operation or support access stays inside the EU.
Cloudflare operates a global network and can process traffic outside the EU/EEA. Google’s provider operations, support, Workspace and Fonts, and permitted PostHog support access can involve other countries. EU storage alone is not a transfer safeguard. The applicable provider agreements and transfer arrangements, including Standard Contractual Clauses where applicable, are identified in the DPA and provider list. Contact us for information or a copy of relevant safeguards.
8. Retention, return and deletion
The limits below describe our retention obligations. The accepted DPA governs customer processing and is not extended by this policy. Deletion includes associated records, rather than only removing an item from view.
| Information | Retention limit or criterion |
|---|---|
| Account information and product feedback | While the account exists, with deletion within 30 days of closure unless a specific legal retention duty applies. |
| Customer content and associated personal-data-bearing records, including audit and identifiable analytics records | While active; complete requested return and remove active records within 30 days after account closure under the DPA. |
| Operational logs | 30 days under the DPA. |
| Website-only server logs outside customer processing under the DPA | Up to 90 days for security and reliability, retaining the previous website limit. Customer-processing operational logs remain subject to the DPA’s shorter 30-day limit. |
| Cofleet-controlled residual backups of customer data | Delete within 90 days after closure; restrict access and prevent ordinary use in the meantime. Reapply deletions if a backup is restored. |
| Provider-controlled residual copies | Prompt deletion instructions when no longer needed. Google’s Cloud Data Processing Addendum permits up to 180 days after an irrecoverable deletion instruction for underlying provider-controlled copies; this does not extend the deadline for Cofleet’s own recoverable copies. |
| Google flagged prompts for abuse review | Up to 90 days, separately from operational logs. |
| PostHog product, AI-usage and cost telemetry | Only as needed for the stated purposes, for no more than 12 months; delete customer-related identifiable records within 30 days after account closure if earlier. Shorter operational-log limits still apply. |
| Session records | 30 days, then expiry and cleanup. |
| Demo/waitlist contact details and historical questionnaire answers | Until the beta opens to everyone or you ask us to remove them, whichever comes first. Unsubscribing removes these fields and the active waitlist subscription. |
| Subscription and suppression evidence | A limited record of consent/withdrawal, an address hash and unsubscribe token remains to evidence preferences and prevent unsolicited resubscription. These are not anonymous data. We review whether continued retention is necessary; they are not used to send marketing. |
| Business correspondence and support records | For the enquiry or relationship and any necessary follow-up or specific legal claim; customer content remains subject to the DPA limits. |
| Invoices and accounting records | Seven years after the end of the calendar year in which the financial year ended, under Swedish bookkeeping rules. |
Disconnecting a connector stops future access and removes its stored credential. It is not the same as deleting information already imported. Removing a source from one brain does not remove a separate copy in another brain. Use the available source-removal controls or contact us to request removal or return; we must apply the relevant instructions across the affected stores.
You may request earlier deletion without waiting for the closure deadline. We will explain any legal reason preventing it. Required residual retention must be limited to the necessary data and purpose, protected and unavailable for ordinary use. Ending a subscription, disconnecting a source and closing an account are distinct actions.
9. Your choices and rights
- Ask for access to your personal data and a copy, and have inaccurate information corrected.
- Ask for erasure or restriction where the applicable conditions are met.
- Receive data you provided in a portable format where processing is automated and based on consent or a contract with you.
- Object, on grounds relating to your situation, to processing based on legitimate interests.
- Object to direct marketing at any time, without giving a reason, and withdraw consent without affecting the lawfulness of earlier processing.
Write to markus@cofleet.app. We may need proportionate information to verify your identity. We answer within one month and do not charge for the request. For customer-controlled content, we forward your request to the organisation and assist it rather than make its decision for it.
Every marketing email provides an unsubscribe route. For the website waitlist, unsubscribe removes the address and questionnaire answers and ends both updates and the invitation list; a limited suppression record remains as described above. You can still contact us directly about a demo.
You can complain to Integritetsskyddsmyndigheten (IMY), the Swedish supervisory authority, or the supervisory authority where you live or work or where you believe an infringement occurred. You do not have to contact Cofleet first.
10. Security and incidents
Safeguards include protected transport and storage, access controls, workspace isolation and restricted administrative access. The DPA describes the agreed measures and the trust page provides further information. We make no independent certification or external-audit claim.
For processing where Cofleet is controller, GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach unless it is unlikely to risk people’s rights and freedoms, and notification to affected people without undue delay where the risk is high. Where we are processor, we notify the customer without undue delay and assist it under the DPA. Report a security concern to our contact address above.
11. Children
Cofleet is a workplace service and is not directed at children. We do not knowingly collect account information from children under 16. If you believe a child has provided information, contact us. We will address deletion, involving the responsible organisation where it controls the information.
12. Keeping this policy up to date
We review this notice when our product, data uses, providers, locations, retention or legal obligations change. We update the date above and preserve previous versions. We do not introduce a new use of personal data simply by changing this page.
If a change is significant, we will tell account holders by email before it takes effect. We will also provide information to other affected people where required, using the contact or collection channel available to us. If a new purpose needs consent, we will request it before that processing begins. A privacy notice is information about processing, not consent to it.
Changes to accepted Terms or a DPA follow their separate notice and express-acceptance rules. This notice does not amend those agreements or remove an existing right.
This revision updates the service description, identity providers, data sources, AI and transfer information, retention disclosures and maintenance process. Read the previous policy, dated 23 September 2026.