1. Controller
Artificial Innovations Oy, Business ID 3546350-7, Tynnyritie 1 C 98, 02230 Espoo, Finland. Privacy contact and support: cora@hellocora.co. We have not appointed a data protection officer; every privacy question goes to that address.
2. What this notice covers
This notice explains how CORA processes personal data as a controller: when you visit getcora.co, contact us, create or use a CORA account on the web or in the CORA apps for iPhone, desktop and the browser, are invited to a workspace, or buy the service.
It does not cover the content that companies and their people put into a CORA workspace, such as documents, chats, meetings, and connected mail. For that content the company that owns the workspace is the controller and CORA is its processor under the data processing agreement between us. If you have a question about content in your employer's workspace, contact your employer; we support them in answering you.
The same goes for pages read by the CORA browser extension for Chrome and Edge. When you hand CORA a tab, or your company has turned on a check for a site you allowed, the extension reads that page (its text, tables and form values, and a picture of the tab when CORA needs to look) and sends it to your company's CORA workspace. There it is workspace content, processed by CORA and the providers on our sub-processor list for the company that owns the workspace. The extension never reads password, one-time-code or payment card fields. CORA's use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
The same goes for a Google account you connect. CORA reads your Gmail and Google Calendar only for what you use them for in CORA: answering what you ask, writing the drafts you ask for, and sending the emails you approve. It is workspace content, private to you, processed by CORA and the providers on our sub-processor list. Nobody at CORA reads it unless you ask us to, for security, or when the law requires it, and it is never used to train AI models. CORA's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
3. Data, purposes, and legal bases
| Data | Source | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Account data: name, email, profile picture, how you sign in (Microsoft, Google, Discord, email one-time code, password or passkey) and whether multi-factor authentication is on, your language, theme and notification choices, and when you last signed in and last used CORA in a workspace | You, your identity provider | Create and secure your account, workspace membership, notifications | Contract | Life of the account |
| Invitations and joining: the email address a colleague invites, or the email domain your company lets join its workspace | The person who invites you, your company | Let you join your company's workspace | Legitimate interest of you and your company in working together | An invitation is valid for 14 days; the record of it stays with the workspace |
| Linked accounts: your Discord account, when you link it to CORA | You | Let you use CORA from Discord | Contract | Until you unlink it or your account ends |
| Security data: IP address, device and browser, session tokens, sign-in events | Your browser | Keep you signed in, protect accounts, detect abuse | Legitimate interest in security | For as long as a session lasts; our authentication provider's security logs are kept for the limited period its service sets |
| Billing data, if you pay by card: company name, billing address, VAT ID, invoices. Card details are entered on Stripe's pages and never reach our systems. Invoiced customers pay by invoice and Stripe is not used | You, Stripe | Charge for the service, accounting | Contract, legal obligation | 6 years after the end of the accounting year (Finnish Accounting Act) |
| Usage metering: token counts, capacity consumed, feature usage per workspace | The service | Measure plan capacity, prevent abuse, improve the product | Contract, legitimate interest | Duration of the agreement plus the accounting period |
| Web analytics on getcora.co and the app: page views, counted without cookies. Our hosting provider sees your IP address and browser to count a visit and keeps only aggregated figures | Your browser | Understand which pages are used | Legitimate interest | Aggregated figures only |
| Contact form: your name, work email, company and message, sent to our inbox. Your IP address is held for 10 minutes to stop spam | You | Answer you | Legitimate interest, steps before a contract | 2 years after last contact |
| Support and sales communication | You | Answer you, keep records | Contract, legitimate interest | 2 years after last contact |
| Marketing: product news and tips by email, only if you turn them on in your notification settings. Every such email has a one-click unsubscribe. Business contacts we reach out to directly | You, public business sources | Tell you about CORA | Consent for product emails; legitimate interest for business contacts, which you can object to at any time | Until you turn them off or object; 1 year after last contact for business contacts |
| Product-improvement signals: de-identified signals about how CORA's answers perform, never message text. On by default; the owner of a paid workspace can turn them off in Settings → Privacy. They are part of free and trial access, and always off in workspaces under an EU Strict contract | The service | Improve answer quality | Legitimate interest in improving the service | Duration of the agreement |
You need to give your name and email address to have a CORA account; without them we cannot create one. Everything else in the table is optional or follows from how you use CORA.
We do not buy personal data, do not sell it, and do not use advertising trackers. We do not make decisions about you by automated means that have legal or similarly significant effects.
4. Cookies and local storage
CORA sets only cookies it needs to work: your sign-in session, and, for field inspections, which role you work in. It also keeps some data in your browser: interface preferences, drafts you have not saved yet, and entries made offline that wait to be sent. The CORA browser extension keeps its own settings in your browser: its tab group, the last tab CORA used, and your choices for checks on other systems' screens. It holds no passwords. Web analytics runs without cookies. There is no consent banner because there is nothing optional to consent to.
5. Recipients
The providers in our sub-processor list host, sign in, and email for CORA, and our payment processor Stripe handles card payments, under data processing agreements. When you sign in with Microsoft, Google or Discord, that provider takes part in the sign-in. We also disclose data to authorities when the law requires it, to professional advisers under confidentiality, and to a buyer of our business if it is sold.
We do not send your account data to AI model providers, and nothing about you is used to train AI models. When you ask CORA to act on your own profile, for example to change your display name, that value is part of your request.
6. Location and transfers
We store data in Frankfurt, Germany, and process it in the EU. Some of our providers are established outside the EEA and may access data for support from outside the EEA; those transfers rely on the EU Standard Contractual Clauses in each provider's data processing agreement, or on an adequacy decision where one applies. AI processing of workspace content stays in the EEA by default. If a workspace owner asks us in writing to turn on Flexible processing, AI inference on that workspace's content may also run outside the EEA. Workspace settings show which one applies.
7. Security
Every workspace's data is kept apart from every other workspace's in the database itself. Data is encrypted in transit and at rest. Platform administration requires multi-factor authentication. Our security standard describes the measures in full and is available on request. If a personal data breach puts your rights at risk, we notify the Data Protection Ombudsman within 72 hours of becoming aware of it, and you without undue delay when the risk is high.
8. Your rights
You can see and correct your name, profile picture and preferences in your profile settings. To get a copy of your data, have your account deleted, or use any other right below, email cora@hellocora.co. We answer within one month, and may ask you to confirm your identity first.
You have the right to access your data, to have it corrected or erased, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interest, including marketing. Where we rely on consent, you can withdraw it at any time; this does not affect processing before you withdrew it. You may lodge a complaint with the Data Protection Ombudsman of Finland (tietosuoja.fi), or with the supervisory authority of the EU country where you live, work, or where you consider the alleged violation occurred.
9. Children
CORA is a workplace tool offered to businesses and is not intended for anyone under 18.
10. Changes
We announce material changes in the product and on getcora.co at least 30 days before they take effect. Previous versions are available on request.