Your data
Privacy Policy
What personal data CogniWork collects, why, who we share it with, how long we keep it, and the rights you have over it.
This policy explains how CogniWork, Inc. (“we”, “us”) handles personal data. It covers the CogniWork service, this website, and our communications with you.
It does not describe how our customers handle personal data inside their own workspaces. When you use a workspace someone else owns, that customer decides what is collected and why; we process it on their instructions as described in the Data Processing Addendum.
Our two roles
We are a controller for account and website data: your identity, your billing details, our security logs, and our marketing communications. This policy governs that.
We are a processor for the content our customers put into their workspaces — their records, files, prompts and conversations. That is governed by the customer’s own privacy notice and by our DPA. If you want your data removed from a customer’s workspace, contact that customer; we will help them, but we cannot decide for them.
What we collect
Account data. Your name, email address, and the authentication identifiers from your sign-in. We do not store passwords — authentication is handled by our identity provider, and we only receive a verified identity token.
Workspace metadata. Names of workspaces, membership and roles, invitations, and timestamps. This is how the service knows who may see what.
Customer Content. Everything you put into a workspace: records, files, uploads, prompts, conversations, worker definitions, view configurations. We process this only to run the service for you.
Usage and metering data. Which features are used, when, and the volume of AI processing consumed per workspace. This drives your Usage page and, in future, billing.
Technical data. IP address, browser and device type, pages requested, timestamps, and error diagnostics. Collected automatically and used for security, abuse prevention and debugging.
Integration credentials. Secrets you supply for systems you connect. Stored encrypted, scoped to the workspace you added them to, and never displayed back to you or included in conversation transcripts.
Communications. Support requests, feedback and correspondence.
We do not intentionally collect special-category data (health, biometrics, religion, political opinions, sexual orientation) about you as an account holder. If you put such data into a workspace as Customer Content, you are responsible for having a lawful basis for it.
Why we use it, and on what basis
| What | Why | Legal basis (UK/EU GDPR) |
|---|---|---|
| Account and workspace data | Create and run your account, control access | Performance of a contract |
| Customer Content | Provide the service you asked for | Performance of a contract / processor on customer instruction |
| Usage and metering | Show you consumption; bill accurately | Contract; legitimate interests |
| Technical and security logs | Detect abuse, prevent fraud, keep the service up | Legitimate interests; legal obligation |
| Product analytics (aggregated) | Improve the product | Legitimate interests |
| Service emails | Tell you about changes that affect you | Contract |
| Marketing emails | Tell you about the product | Consent, withdrawable at any time |
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
AI processing
Prompts and the workspace content needed to answer them are sent to the model providers listed in the AI Disclosure and in our Subprocessors list.
Your content is not used to train foundation models. Our agreements with model providers prohibit training on customer data submitted through the API, and prohibit retention beyond what is needed for abuse monitoring under those providers’ own published terms.
Who we share it with
- Subprocessors — the vendors that host, secure and power the service. Each is listed publicly with what it does and where: see Subprocessors.
- Other members of your workspace — anyone the owner has invited can see the workspace’s content, subject to their role.
- Professional advisers — lawyers, auditors and accountants, under confidentiality.
- Acquirers — if we are involved in a merger or sale, under confidentiality, with notice to you before your data becomes subject to a different policy.
- Authorities — where legally required. We review each request, reject overbroad ones, and notify you unless we are legally prohibited from doing so.
International transfers
We are based in the United States and our infrastructure and subprocessors may process data in the United States and other countries. Where we transfer personal data out of the UK, EEA or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable), together with supplementary technical measures including encryption in transit and at rest.
How long we keep it
| Data | Retention |
|---|---|
| Account data | For the life of the account, then 90 days |
| Customer Content | Until you delete it, or 30 days after termination |
| Backups | Rolling, expiring within 35 days |
| Security and access logs | 12 months |
| Usage and metering records | 24 months |
| Support correspondence | 24 months |
| Records we must keep by law (e.g. tax) | As required, typically 7 years |
Deleting a workspace removes its content from live systems promptly and from backups as those backups expire.
Your rights
Depending on where you live, you may have the right to: access your data; correct it; have it deleted; restrict or object to processing; receive it in a portable format; withdraw consent; and not be subject to solely automated decisions with legal or similarly significant effects.
If you are in the EEA, UK or Switzerland, these come from the GDPR. You also have the right to complain to your local supervisory authority.
If you are in California, you have the rights to know, delete, correct, and to opt out of sale or sharing — we do neither — and the right not to be discriminated against for exercising them. Other US states provide comparable rights.
To exercise any of these, email [email protected]. We respond within 30 days, and will verify your identity before acting on a request. There is no charge unless a request is manifestly unfounded or excessive.
Most rights you can exercise yourself: export or delete your data from inside the app at any time.
Cookies
See the Cookie Policy. Short version: we use what the service needs to work, and we do not use advertising trackers.
Security
See the Security overview for the controls we operate. To report a vulnerability, follow the Responsible Disclosure Policy.
Children
The service is not for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us personal data, contact [email protected] and we will delete it.
Changes
We will post updates here with a new date. For material changes we will notify you by email or in the product before they take effect.
Contact
CogniWork, Inc. {{REGISTERED_ADDRESS}}
Privacy enquiries: [email protected]