Privacy Policy

This policy describes how cofou, the operator of cofou.vercel.app, handles personal information through its website, web application, MCP server, and assistant workspace. For questions or privacy requests, contact support@cofou.com.

Your organization controls the business information and contact data it adds to a workspace. When cofou processes that information to perform your organization’s instructions, the organization remains responsible for its authority to collect and use it.

Connected assistants and third-party services have their own privacy policies. This policy covers cofou’s handling of data, rather than the independent handling of your conversations by ChatGPT or another assistant.

• Account information: your name, email, sign-in details, organization membership, and project permissions. Passwords are stored as hashes. If you use Google sign-in, we receive account information needed to authenticate you.
• Company and GTM records: websites, market definitions, plans, preferences, notes, messages submitted to in-app features, prospect and contact details, draft emails, campaign activity, replies, meetings, outcomes, and business metrics you provide or authorize us to retrieve.
• Connection information: provider credentials, OAuth grants and scopes, token records, and the organization or project each assistant is allowed to access.
• Service and security records: actions taken, request and error details, rate-limit information, and technical information such as IP addresses or derived identifiers, browser details, and timestamps.
• Support information: messages and attachments you send when asking for help.

Information may come from you, authorized workspace members, connected services, public websites, or prospect data providers used for a sourcing action you authorize. Do not add sensitive personal information that cofou does not need, such as government identifiers, health records, or payment card details.

We use information to authenticate accounts, enforce workspace permissions, remember company context, prepare and execute authorized work, synchronize campaign results, show evidence and plans, deliver enabled notifications, answer support requests, and maintain the service.

We also use service records to diagnose failures, prevent abuse, enforce limits, and protect accounts. Where privacy law requires a legal basis, these purposes rely on performing our agreement with you, your instructions or consent where applicable, legitimate interests in operating and protecting the service, and legal obligations.

We do not sell personal information or share it for cross-context behavioral advertising. We do not use your prospect lists to send our own marketing to those prospects.

When you connect an assistant, cofou returns the data needed for the tools it calls within the access you granted. That can include company context, markets, prospect details, email drafts, campaign results, and replies. Read-only access still permits data to leave cofou and reach that assistant.

You can restrict a connection to a project and choose its access level. Revoke it in Settings → Assistant access to prevent future calls. Revocation cannot remove information already returned to an assistant; manage that information through the assistant’s own controls.

Optional in-app AI features, including Ask, research, and generated operating documents, can send relevant prompts and company context to model providers through the configured AI gateway. Their processing and retention are governed by the applicable provider terms. Do not submit information you are not authorized to share with those providers.

An assistant connection cannot approve or send email through cofou. Sending requires the separate signed-in human review flow.

We use Vercel for hosting and application infrastructure and Neon for the production database. Depending on the features you enable, information may also be processed by authentication providers, AI gateway and model providers, connected outreach and research services such as Instantly and rank.ai, prospect sourcing providers, and email or Slack notification services.

For example, an approved campaign sends recipient details and email content to the connected outreach provider. A sourcing request shares search criteria with the data provider. Enabled notifications share their content and delivery destination with the delivery service.

Workspace members may see information according to their permissions. Authorized operators may access records when needed for support, service operation, or security. We may also disclose information when required by law, to protect rights and safety, or as part of a business transfer subject to appropriate protections.

Providers may process information in countries outside your own. Where applicable law requires safeguards for an international transfer, those safeguards must apply to that processing.

cofou uses session and authentication cookies to keep you signed in and protect account flows. Local browser storage remembers interface choices such as your theme. Hosting and security infrastructure may also process request data needed to deliver and protect the service.

You can manage cookies and local storage in your browser. Disabling essential cookies can prevent sign-in or connected account flows from working.

Workspace information is retained while needed to provide the service and preserve the company history you use. Disconnecting a provider or assistant does not automatically delete saved records. You can request deletion through support; we may retain information needed for legal obligations, security, disputes, or records of your request. Backup copies may remain until their normal replacement cycle.

cofou uses HTTPS, password hashing, encrypted stored provider credentials, scoped assistant access, and organization and project checks. These measures reduce risk, but no service can guarantee complete security. Protect your account, revoke exposed tokens, and avoid putting secrets into notes or prompts.

You can edit saved company information through the available tools and app controls, change connection scopes, revoke access, and disable connected features. For access, correction, export, deletion, or an objection to personal information processing, contact support@cofou.com.

Available rights depend on your location and our role in processing the information. We may verify your identity and workspace authority before acting. If a request concerns a prospect record controlled by a customer organization, we may direct it to that organization or help it respond. Where applicable, you may complain to your local data protection authority.

cofou is intended for business users aged 18 or older. We do not knowingly collect personal information from children. Contact us if you believe a child has provided information.

We may update this policy as the service changes. The effective date at the top identifies the current version. We will provide notice of material changes where required.

Privacy questions: support@cofou.com. For connection and account help, visit Support.