Privacy Policy

Last updated: September 21, 2026

1. Data Controller

The data controller for CoSupport AI is:

2. Information We Collect

We collect information you provide directly to us when you:

  • Account information: Email, name, password (encrypted), company name
  • Payment information: Transaction amount, payment status. We do not store full card numbers — card data is handled exclusively by our PCI-DSS compliant payment processor (see Section 5)
  • Helpdesk integration: OAuth tokens for Zendesk, Freshdesk, Salesforce, and other connected platforms
  • Ticket content: Customer support tickets submitted for AI processing, including message text and metadata
  • Communication records: Emails, support tickets, and feedback submitted to our team

We also automatically collect:

  • Device & network: IP address, device model, operating system, browser type, timezone
  • Usage behavior: Page views, feature usage, session duration, API calls
  • Log data: Request timestamps, error logs, performance metrics

3. How We Use Your Information

Purpose Legal Basis
Provide and maintain the service Contract performance
Billing and payment processing Contract performance
Customer support Contract performance / Legitimate interest
Service notifications (billing, security, policy updates) Legitimate interest
Security and fraud prevention Legitimate interest
Product improvement and analytics Legitimate interest
Legal compliance Legal obligation
Marketing communications (optional) User consent

We may aggregate or de-identify data for statistical analysis. Such data cannot be linked back to individual users.

4. Cookies and Tracking Technologies

Type Purpose Can be disabled
Strictly necessary Maintain login, core functionality No
Functional Language preferences, personalized settings Yes
Analytics Anonymous usage statistics, product optimization Yes
Marketing (optional) Targeted advertising and performance measurement Yes

You can adjust cookie preferences through your browser settings or our cookie management center.

5. Data Sharing and Disclosure

We do not sell your personal information, including as defined under applicable privacy laws such as the CCPA. We only share data in the following circumstances:

  • Service providers: Cloud infrastructure, payment processing, customer support, and analytics vendors — all bound by confidentiality agreements. Payment card data is processed exclusively by Waffo Pancake, our PCI-DSS compliant payment processor. We do not store full card numbers on our servers.
  • AI processing providers: DeepSeek — ticket content is processed by DeepSeek's AI models to generate responses. Data processed through DeepSeek is handled under their privacy policy.
  • Helpdesk platforms: Zendesk, Freshdesk, Salesforce — when you connect your account
  • Legal requirements: When required by law, court order, or valid government request
  • Business transfers: In the event of a merger, acquisition, or sale of assets, with advance notice and continued protection obligations
  • With your consent: For any other purpose with your explicit permission

6. Data Security

  • Encryption in transit: All data transmitted to and from our services uses TLS 1.3 encryption
  • Encryption at rest: Sensitive data including passwords is encrypted using industry-standard encryption
  • Access controls: Principle of least privilege; employees only access systems required for their role
  • Security audits: Regular automated and manual security testing

In the event of a security breach affecting your rights, we will notify affected users and relevant authorities within 72 hours of discovery, as required by GDPR.

7. Data Retention

Data Type Retention Period Disposal
Account information Active period + 90 days after deletion Delete or anonymize
Transaction records As required by law (typically 7 years) Archive or delete
Support records 3 years Secure deletion
Security audit logs 12 months Secure deletion
Ticket content (AI processing) Until processing complete + 30 days Delete or anonymize

8. Your Data Rights

Depending on your jurisdiction, you may have the following rights. To exercise these rights, contact us at privacy@cosupport.ai. We will respond within 30 calendar days.

Right Description
Right to access Learn what personal data we collect and how we use it
Right to access Receive a copy of your personal data in a machine-readable format
Right to rectification Correct inaccurate or incomplete personal data
Right to erasure Request deletion of your personal data under certain conditions
Right to restrict processing Pause processing of your data under certain conditions
Right to data portability Receive your data in a structured, machine-readable format
Right to object Object to processing based on legitimate interest or marketing
Right to withdraw consent Withdraw consent for processing based on consent at any time

If you believe we have not handled your data properly, you have the right to lodge a complaint with your local data protection authority.

9. Marketing Communications

With your consent, we may send you marketing emails about our products and services. You can unsubscribe at any time by:

  • Clicking the "unsubscribe" link in any marketing email
  • Disabling marketing notifications in your account settings
  • Contacting us at support@cosupport.ai

Unsubscribing from marketing does not affect service-related notifications such as billing reminders, security alerts, or policy updates.

10. International Data Transfers

Our servers and service providers may be located outside your country of residence. When we transfer data internationally, we ensure appropriate safeguards are in place, including:

  • Data Processing Agreements incorporating Standard Contractual Clauses (SCCs) for transfers from the EU/UK
  • Transfers only to recipients providing equivalent data protection standards
  • Additional safeguards as required by applicable law

11. Children's Privacy

CoSupport AI is not intended for individuals under the age of 16 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, please contact us at privacy@cosupport.ai and we will promptly delete it.

12. Third-Party Links

Our service may contain links to third-party websites or services. This Privacy Policy applies only to data we directly collect. We are not responsible for the data practices of third parties. We recommend reviewing their privacy policies before providing any personal data.

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you at least 15 days in advance by email or by posting a notice on our platform. Your continued use of our service after changes take effect constitutes acceptance of the updated policy. The "Last updated" date at the top of this page reflects the effective date of the current policy.

14. Contact Us

For privacy-related inquiries, data rights requests, or complaints: