1. Who we are
Cofleet AB (org. nr. 559594-0965), Finn Malmgrens väg 52, 121 38 Johanneshov, Sweden, provides shared company knowledge and memory for AI tools. Contact markus@cofleet.app about this policy or your personal data.
This notice covers our website, demo and waitlist requests, business contacts, and the hosted Cofleet web and desktop apps. The Terms of Service and Data Processing Agreement govern the service relationship.
2. Our role and your organisation’s role
Cofleet as controller. We determine the purposes of business-contact and billing administration, agreement records, website enquiries and subscriptions, protection of our own accounts and business systems, and the limited metadata used to understand our operation and improve our Service across customers. The purposes and legal bases below apply to those own purposes. We do not use customer source content, prompts, outputs or memories for cross-customer improvement.
Cofleet as processor. Your organisation selects the content and purposes for using its shared memory. We process that content and associated personal data on its documented instructions under the DPA, including workspace access, operations/security for that processing, support investigations and customer-specific usage/cost reporting where offered. If your organisation is itself a processor, we act as its subprocessor. It determines the lawful basis and notices for those purposes. Roles depend on the purpose of a particular use, not a label applied to an entire dataset; the DPA’s field, purpose and retention restrictions continue to bind us for our own metadata uses.
Imported documents, messages and answers can concern employees, contractors, customers and other people who have never registered with Cofleet. We receive their information from the organisation, its users and the sources it authorises. For requests about that content, contact the organisation or write to us so we can forward the request and assist it.
3. Information we receive
- Account and access information: your name, email/contact address, Google or Microsoft work/school identity, organisation and workspace membership, role, invitations, approval and sign-in/session records. The identity provider supplies sign-in information and handles its own processing under its privacy notice; Cofleet does not receive your provider password.
- Business and support information: contact details, correspondence, feedback, organisation details, agreed pilot/subscription details and invoicing records. Support email and shared Slack channels may include customer information, screenshots and files you send to explain an issue. Where an agreement is accepted electronically, the acceptance record identifies the organisation, authorised acceptor, time and document versions.
- Selected customer content: files, notes, questions, answers, chat messages and content from explicitly authorised sources such as Google Drive, SharePoint or Notion. Connected Slack or Teams features may receive messages and deliver replies or notifications when the organisation enables them. This is not access to every tool or every file in your organisation.
- Desktop quick-save capture: when you invoke capture, selected text and its source application/window title can be sent to the selected workspace. The desktop app keeps local session settings and may show a saved-content preview in an operating-system notification; restricted captures suppress the content preview.
- Derived service data: extracted text, embeddings, memories, summaries, source references and AI responses. These can contain personal data too. We also handle connector permissions and protected credentials needed to access selected sources.
- Operational information: request and security records, timestamps, IP addresses, user agents, response/error information and usage records needed to protect and operate the service.
Product telemetry. The existing application sends server-side events to PostHog EU Cloud when enabled: account approval, joining a workspace, adding a source, asking or answering a question, opening the app, viewing knowledge and connecting an integration. Events use account/workspace identifiers, timestamps, fixed categories, counts and yes-or-no values. Feature availability checks also send the user identifier to PostHog. Identifiers are personal data even when names and email addresses are excluded.
Product telemetry also includes AI-call metadata (model and run/trace identifiers, token counts, latency, attempt counts, success/failure status and fixed error categories) and daily and month-to-date workspace model-cost totals, including generation/embedding breakdowns and currency. We use this limited metadata to understand service use, measure and manage operating costs, diagnose reliability issues, improve our own Service across customers and provide customer usage/cost information where offered. The purpose-specific roles above apply. Customer documents, source text, prompts, outputs, memory content, names, email addresses, URLs, window titles and raw error messages or payloads are excluded from PostHog. There is no browser analytics SDK, analytics cookie, session replay, advertising tracking or unrestricted automatic capture. Processing must remain within the scope of the organisation’s accepted DPA; publishing a new version does not expand an existing agreement.
There is no optional product-analytics opt-out at launch and no per-user telemetry switch. Clearing browser storage does not stop server-side processing. This does not remove applicable data-protection rights, including the right to object to legitimate-interest processing described in Your rights. We assess those requests under applicable law.
Demo requests and waitlist. Current website forms ask only for your email. We record the address, signup type/source, request date, update preference and confirmation-delivery status. We may also hold company-size selections and descriptions submitted through earlier questionnaires. The form explains that submission includes occasional updates. These records are separate from a product account.
Website requests and storage. We run no website analytics or advertising pixels. Cloudflare handles web requests, Google serves the fonts, and our registration service receives submitted forms. The website remembers a chosen theme in local storage and a preview unlock for the current tab. The Cookie Policy describes these and application storage.
We do not sell personal data or use it for advertising. The hosted pilot does not authorise special-category data, criminal-offence data, national identification numbers, payment-card credentials or other highly sensitive regulated data. The Terms and DPA require a separate written agreement and appropriate safeguards before those data types are added.
The web app keeps a sign-in token in local storage. The desktop app protects persisted session secrets using the operating system’s secure storage where available; without it, secrets remain in memory. Clearing local storage does not delete content already saved to your organisation’s workspace.
4. Purposes and legal bases
This table covers our controller purposes. Processing selected content and related records for your organisation, including instructed support and customer usage/cost reporting, follows its instructions and lawful basis under the DPA. Accepting the Terms is not consent on behalf of individuals to our own controller purposes.
| Purpose where Cofleet is controller | Legal basis |
|---|---|
| Administer the business relationship, customer contacts and agreement records, and send essential service communications | Legitimate interests in providing and administering the service requested by your organisation (GDPR Article 6(1)(f)). Where you personally are a contracting party, necessary processing to perform that contract is based on Article 6(1)(b). |
| Respond to enquiries, demo requests and requested waitlist invitations | Legitimate interests in responding to the contact and service information you requested (Article 6(1)(f)). |
| Send occasional updates to website subscribers | Consent (Article 6(1)(a)), recorded with the signup. Withdraw using the unsubscribe link or by contacting us. You can also contact us directly for a demo without subscribing. |
| Protect Cofleet’s own accounts and business systems, prevent abuse and investigate reliability issues | Legitimate interests in a secure and reliable service (Article 6(1)(f)); legal obligation (Article 6(1)(c)) where a specific legal duty requires a record or disclosure. |
| Understand product use and operating costs and improve Cofleet’s Service across customers using only the limited telemetry described above | Legitimate interests in improving the service and managing its operation (Article 6(1)(f)), subject to the applicable DPA restrictions and your right to object. |
| Handle support, feedback, legal requests and disputes | Legitimate interests in responding, resolving problems and establishing or defending legal claims (Article 6(1)(f)); legal obligation where applicable (Article 6(1)(c)). |
| Maintain invoicing and accounting records | Legal obligation (Article 6(1)(c)). |
We must balance legitimate interests against your rights. You may ask for information about that assessment and object to processing based on those interests. Marketing objections are unconditional: we stop direct marketing when you object.
Sign-in and membership information are needed to provide access; without them we cannot create or authenticate your account. Business billing details are needed when invoicing applies. Support messages, demo requests and marketing subscriptions are voluntary. Withdrawing marketing consent does not remove your product account or prevent essential service messages.
5. AI processing
Cofleet uses Google’s Gemini through Vertex AI for generation and embeddings to organise selected knowledge and answer questions. Self-hosted Hindsight provides the memory service inside Cofleet’s cloud infrastructure; it is not a separate hosted provider.
Cofleet’s automated AI features review shared knowledge, identify gaps, contradictions or unconfirmed assumptions, and ask members questions or conduct interviews about their work. These features use the brain’s memory and derived observations; answers become part of that brain’s memory. Their purpose is to help your organisation keep its shared knowledge complete and accurate.
These features operate separately within each shared brain, including Everyone and restricted brains: they read only that brain and ask only its members. Personal brains are not included. Organisation owners control automatic operation or start these features manually. Questions arrive in the Cofleet inbox. Slack or Teams delivery applies only where your organisation has enabled it for Everyone; questions from restricted brains stay in Cofleet.
Cofleet will not use Customer Content or personal-data-bearing Usage Data to train general-purpose or shared models, or authorise its providers to do so. Processing to deliver the agreed service, including generation and embeddings, remains permitted under customer instructions and the DPA. We do not assume that removing a name makes content anonymous.
Google may retain hosted Gemini prompts flagged for suspected abuse for up to 90 days for abuse review. This is distinct from Cofleet’s operational logs and does not permit model training. We do not claim an abuse-monitoring exemption.
AI output can be inaccurate and needs human review. Cofleet does not use these outputs to make solely automated decisions about people with legal or similarly significant effects. Your organisation is responsible for reviewing its own uses of the outputs.
7. Locations and international transfers
Product account data and workspace content are hosted in the EU. The hosted service uses Google Cloud regional resources in Belgium, generation through Google’s EU endpoint and regional embeddings. PostHog uses EU Cloud in Frankfurt. EU hosting does not mean that every provider operation or support access stays inside the EU.
Cloudflare operates a global network and can process traffic outside the EU/EEA. Google’s provider operations, support, Workspace and Fonts, Slack support services, and permitted PostHog support access can involve other countries. EU storage alone is not a transfer safeguard. The applicable provider agreements and transfer arrangements, including Standard Contractual Clauses where applicable, are identified in the DPA and provider list. Contact us for information or a copy of relevant safeguards.
8. Retention, return and deletion
The limits below describe our retention obligations. The accepted DPA governs customer processing and is not extended by this policy. Deletion includes associated records, rather than only removing an item from view.
Request workspace closure and return or deletion by emailing markus@cofleet.app. Workspace deletion is currently handled on request rather than through a self-service control. In Slack Connect, each organisation generally controls its own messages and files under the channel’s permissions. We delete the records and copies we control and coordinate any required action by your organisation; we do not promise deletion of its independently controlled copies. Archiving or disconnecting a channel is not the same as deleting its contents.
| Information | Retention limit or criterion |
|---|---|
| Account information and product feedback | While the account exists, with deletion within 30 days of closure unless a specific legal retention duty applies. |
| Customer content and associated personal-data-bearing records, including audit and identifiable analytics records | While active; complete requested return and remove active records within 30 days after account closure under the DPA. |
| Operational logs | 30 days under the DPA. |
| Website-only server logs outside customer processing under the DPA | Up to 90 days for security and reliability, retaining the previous website limit. Customer-processing operational logs remain subject to the DPA’s shorter 30-day limit. |
| Cofleet-controlled residual backups of customer data | Delete within 90 days after closure; restrict access and prevent ordinary use in the meantime. Reapply deletions if a backup is restored. |
| Provider-controlled residual copies | Prompt deletion instructions when no longer needed. Google’s Cloud Data Processing Addendum permits up to 180 days after an irrecoverable deletion instruction for underlying provider-controlled copies; this does not extend the deadline for Cofleet’s own recoverable copies. |
| Google flagged prompts for abuse review | Up to 90 days, separately from operational logs. |
| PostHog product, AI-usage and cost telemetry | Only as needed for the stated purposes, for no more than 12 months; delete customer-related identifiable records within 30 days after account closure if earlier. Shorter operational-log limits still apply. |
| Session records | 30 days, then expiry and cleanup. |
| Demo/waitlist contact details and historical questionnaire answers | Until the beta opens to everyone or you ask us to remove them, whichever comes first. Unsubscribing removes these fields and the active waitlist subscription. |
| Subscription and suppression evidence | A limited record of consent/withdrawal, an address hash and unsubscribe token remains to evidence preferences and prevent unsolicited resubscription. These are not anonymous data. We review whether continued retention is necessary; they are not used to send marketing. |
| Customer support correspondence, Slack messages, screenshots, files and Cofleet-controlled copies | As needed during the active relationship; remove active customer-specific support records within 30 days after account closure, matching the DPA. Earlier valid deletion requests and specific mandatory legal-retention duties still apply. This is not a rolling 30-day limit while the customer is active. |
| Invoices and accounting records | Seven years after the end of the calendar year in which the financial year ended, under Swedish bookkeeping rules. |
Disconnecting a connector stops future access and removes its stored credential. It is not the same as deleting information already imported. Removing a source from one brain does not remove a separate copy in another brain. Use the available source-removal controls or contact us to request removal or return; we must apply the relevant instructions across the affected stores.
You may request earlier deletion without waiting for the closure deadline. We will explain any legal reason preventing it. Required residual retention must be limited to the necessary data and purpose, protected and unavailable for ordinary use. Ending a subscription, disconnecting a source and closing an account are distinct actions.
Business enquiries that do not become customer workspaces are retained only as needed for the enquiry and necessary follow-up; specific legally required records follow their own limited purpose and period. These criteria do not create a general exception to the customer-data deadlines above.
9. Your choices and rights
- Ask for access to your personal data and a copy, and have inaccurate information corrected.
- Ask for erasure or restriction where the applicable conditions are met.
- Receive data you provided in a portable format where processing is automated and based on consent or a contract with you.
- Object, on grounds relating to your situation, to processing based on legitimate interests.
- Object to direct marketing at any time, without giving a reason, and withdraw consent without affecting the lawfulness of earlier processing.
Write to markus@cofleet.app. We may need proportionate information to verify your identity. We respond without undue delay and normally within one month. Where law permits because of complexity or number of requests, we may extend by up to two further months and will explain the extension within the initial month. Requests are normally free; any permitted fee or refusal for a manifestly unfounded or excessive request must meet the legal conditions and be explained. For customer-controlled content, we promptly forward your request and assist the organisation so it can meet its duties. No separate three-working-day acknowledgement or forwarding guarantee applies.
Every marketing email provides an unsubscribe route. For the website waitlist, unsubscribe removes the address and questionnaire answers and ends both updates and the invitation list; a limited suppression record remains as described above. You can still contact us directly about a demo.
You can complain to Integritetsskyddsmyndigheten (IMY), the Swedish supervisory authority, or the supervisory authority where you live or work or where you believe an infringement occurred. You do not have to contact Cofleet first.
10. Security and incidents
Safeguards include protected transport and storage, access controls, workspace isolation and restricted administrative access. The DPA describes the agreed measures and the trust page provides further information. We make no independent certification or external-audit claim.
For processing where Cofleet is controller, GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach unless it is unlikely to risk people’s rights and freedoms, and notification to affected people without undue delay where the risk is high. Where we are processor, we notify the customer without undue delay and assist it under the DPA. Report a security concern to our contact address above.
11. Children
Cofleet is a workplace service and is not directed at children. We do not knowingly collect account information from children under 16. If you believe a child has provided information, contact us. We will address deletion, involving the responsible organisation where it controls the information.
12. Keeping this policy up to date
We review this notice when our product, data uses, providers, locations, retention or legal obligations change. We update the date above and preserve previous versions. We do not introduce a new use of personal data simply by changing this page.
If a change is significant, we will tell account holders by email before it takes effect. We will also provide information to other affected people where required, using the contact or collection channel available to us. If a new purpose needs consent, we will request it before that processing begins. A privacy notice is information about processing, not consent to it.
Changes to accepted Terms or a DPA follow their separate notice and express-acceptance rules. This notice does not amend those agreements or remove an existing right.
This revision describes AI-started questions and interviews and organisation-owner visibility, and clarifies supported quick-save capture, customer information in support channels, purpose-specific roles, service-improvement and customer cost-reporting metadata, the absence of a voluntary analytics opt-out, statutory request-response deadlines and the aligned support-data deletion period. It does not itself activate new processing or replace the required notice and agreement-acceptance process. Read the previous policy, dated 6 October 2026.