Privacy

This notice explains what we collect about people, why, who else handles it, how long we keep it and what you can ask us to do. It covers:

• visitors to cohavo.io: the demo form, email to us, the website chat and analytics;
• the people at the businesses that use Cohavo: their contacts with us, their sign-in details and the records we keep to run a secure service.

It doesn’t cover the calls, emails, chats, recordings, transcripts and notes that businesses handle using Cohavo. For those, the business is in charge of the data and we act only on its instructions, under our Data processing agreement. If you called, emailed or chatted with a business that uses Cohavo, please read that business’s privacy notice and contact it.

1. Who we are

Cohavo is responsible for the personal data described here. For anything about your data, email support@cohavo.io.

2. What we collect, and why

On this website

When	What we collect	Why, and our reason in law	Kept for
You book a demo	Your name, work email, company, team size, your message, and your phone number if you give it.	To arrange your demo and reply to you. You asked us to, so we rely on our legitimate interest in answering, and on taking steps you asked for before a contract.	2 years after we last heard from you, unless you become a customer. A copy on our web server: 90 days.
You email us	Your email address, name and what you write. If we ask how we did when we close your ticket and you answer, your answer and any comment (answering is optional; the page sets no cookies).	To reply and help. Legitimate interest.	2 years after we last heard from you, unless you become a customer.
You use the website chat	What you type, the name and email you give, the pages of this site you looked at during the visit and, in general terms, how you found us (for example, a search engine), your browser’s language and time zone, your browser and type of device (for example, Chrome on a Mac), and a thumbs up or down and a comment if you rate the chat. Card numbers you type are hidden before anything is saved.	To answer you (an AI assistant may answer first: see below), and to pass your question on if nobody is free (it becomes a support ticket and we reply by email). If you gave your email and leave the page before our reply reaches you, we email you that reply, once. Legitimate interest.	12 months. A question the AI assistant couldn’t answer, with email addresses and numbers hidden: 12 months after it was last asked. A message you leave when nobody is free becomes a support ticket, kept like an email to us.
You accept analytics cookies	The pages you open, what you click, the site you came from, your browser and screen size, and a replay of how you moved around the page, with everything you type hidden.	To see how the site is used and make it better. Your consent: it’s off unless you click Accept. Details on the Cookies page.	Up to 1 year.

The chat’s AI assistant. When it’s switched on, it answers first, it’s always labelled AI, and you can ask for a person at any time with Talk to a person. Before your messages go to the assistant, email addresses and phone and card numbers are hidden. To find the right answer in our help content, your latest messages are also sent to OpenAI’s search service, with those details hidden too. OpenAI is in the USA; it doesn’t use them to train its models and deletes them within 30 days. A question the assistant can’t answer is kept on our server, with those details hidden, so we can add an answer.

Your internet address. Our web server doesn’t keep a log of visitors. The demo form holds your address in memory for up to an hour to stop spam, and doesn’t save it. The chat itself doesn’t store it: while you’re connected it holds a scrambled, one-way version to stop abuse, and keeps that for 30 days only if it has to block someone. The server the chat runs on records internet addresses in its security logs, kept for up to 30 days. Analytics are set not to keep it.

If your business uses Cohavo

Whose data	What we collect	Why, and our reason in law	Kept for
Your business’s contacts with us (owners, admins, billing contacts)	Names, job titles, work email and phone, company, what we’ve agreed and what you’ve ordered.	To make and run our agreement, send service and policy notices, and give support. The contract with your business, and our legitimate interest in running our business relationship.	6 years after the agreement ends (business and tax records).
People who use Cohavo	Name, work email, role, sign-in records (time, internet address and device), two-step code settings, and which apps and versions they use. Requests sent to us from inside the app, with the sender’s name and email.	To sign people in safely, keep the service secure, give support and handle requests. Legitimate interest in providing a secure service to your business.	Sign-in sessions: 7 days. Server logs: 14 days to 8 weeks. Security events: while your business’s server runs. The record of settings changes: 2 years, unless your business sets another period. Requests to us: 2 years after we last heard from you.
Usage	How much each server is used (calls, minutes, AI use, storage).	To bill, plan capacity, and spot fraud and faults. Legitimate interest; legal obligation for tax records.	Usage figures: 13 months. Invoices: 6 years.
Your business’s authorised person, when we register or move your phone numbers	Your business’s legal name, company number and address, and the authorised person’s name, mobile number and work email. To move numbers to us: the signed letter of authority and a recent bill from your current provider.	UK numbering rules and our phone carrier require us to record who uses each number and to show a move was authorised. Legal obligation, and our legitimate interest in providing and moving numbers as you asked. We pass these details to Twilio, in the USA (see Subprocessors).	The authorised person’s details and your address go straight to Twilio: we don’t keep a copy. Signed letters of authority and bills: kept encrypted, and deleted 12 months after the move.
How the app is used (only if your business agrees)	A random id for each person (not their name or email), their role, the pages and buttons they use, and session replays with all text and typing hidden.	To improve Cohavo. Legitimate interest, and it’s off unless your business agrees.	Up to 1 year.

We don’t send marketing emails. If we start, we’ll only send them to people we’re allowed to, with a simple way to stop them.

We don’t sell personal data, we don’t use it for adverts, and we don’t make decisions about anyone based only on automated processing that have legal or similarly significant effects.

3. Who else handles it

We use a few companies to run our website, our email and Cohavo. They only act on our instructions.

For this website and our own email:

• DigitalOcean: our servers, in London. The website, the demo form, the chat and our support desk run there.
• Microsoft: our email (Microsoft 365). Emails you send us arrive there before reaching our support desk.
• Resend: sends our email, including our replies to chat messages, demo requests to our team and a copy of a chat if you ask for one. It’s in the USA.
• OpenAI: powers the website chat’s AI assistant, in the USA (see above).
• PostHog: analytics, on its EU cloud in Germany, and only if you click Accept.
• Cloudflare: runs our domain names.

For Cohavo itself, the full list is on our Subprocessors page.

When personal data goes outside the UK, we rely on the safeguards UK law provides: the UK Extension to the EU-US Data Privacy Framework (DigitalOcean, Resend, PostHog, Cloudflare), the EU Standard Contractual Clauses with the UK’s addendum (OpenAI), or Microsoft’s Standard Contractual Clauses. Our Security page lists each company’s safeguard, with links. Email support@cohavo.io for a copy.

4. On your device

Your answer to the cookie question is kept in your browser so we don’t ask again. If you send a message in the website chat, your browser keeps one item so the chat carries on as you move between pages. Neither is used to track you. Analytics cookies are only set if you accept them. The Cohavo apps keep you signed in and remember your settings. Details on the Cookies page.

5. What you can ask us

You can ask for a copy of what we hold about you, and ask us to correct it, delete it, stop using it or limit how we use it, or give you a copy you can take elsewhere. Where we rely on your consent, you can withdraw it at any time. Email support@cohavo.io. It’s free.

We’ll reply within one month. If a request is complex, we may take up to two more months and will tell you why within the first month. If we need more information to find your data or confirm who you are, the time starts when we get it.

6. Complaints

If you’re unhappy with how we’ve handled your data, please tell us first at support@cohavo.io. We’ll acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome without undue delay. See our Complaints page.

You can also complain to the Information Commission, the UK’s data protection regulator, at ico.org.uk.

7. Changes

When this notice changes, we update this page and its version. Earlier versions and what changed are on our Legal page.