Privacy Policy

This Privacy Policy explains how [Legal Entity Name] (“Cosecant,” “we,” “us”) collects, uses, discloses, and protects information when you visit cosecant.io, use our products (including Echo), or otherwise interact with us. It is written to be consistent with the principles of the GDPR, UK GDPR, and CCPA, but is a template and must be reviewed against your actual data flows and applicable law before publication.

We collect information in the following categories:

• Information you provide — name, company, email, phone number, project budget, and message content submitted through our contact form.
• Business data — information provided by clients in the course of a project engagement, including operational and configuration data needed to deliver our software.
• API and product data — data processed through Echo or other products, including call transcripts, order data, and usage metadata generated during normal operation.
• Automatically collected data — IP address, browser type, device information, and usage patterns collected via cookies and similar technologies.

Our products, including Echo, use third-party and proprietary AI models (including but not limited to models from OpenAI, Anthropic, and Google, and speech-to-text systems such as Whisper) to process voice, text, and order data in order to deliver the service. Data submitted to these models may be transmitted to the respective model providers for inference, subject to their own data handling terms. We do not use client business data to train foundation models we do not control.

We use cookies and similar technologies for:

• Essential site functionality (e.g. session state, security).
• Analytics, to understand aggregate usage of our website.
• Preference storage, such as remembering display settings between visits.

You can control cookies through your browser settings. Disabling cookies may affect some site functionality.

We may use privacy-conscious analytics tools to understand how visitors use our site. Analytics data is generally aggregated and does not directly identify individuals, except where necessary to investigate abuse or security incidents.

• To respond to inquiries submitted through our contact form.
• To deliver, maintain, and improve our products and services.
• To meet contractual obligations with clients and business customers.
• To comply with legal obligations and enforce our agreements.

We share information with service providers who help us operate our business, including cloud infrastructure providers (e.g. AWS), AI model providers (e.g. OpenAI, Anthropic, Google), database and backend infrastructure providers (e.g. Supabase), and email delivery providers. These providers are contractually restricted from using your data for purposes other than providing services to us.

Where data is transferred outside your country of residence, including to [Governing Jurisdiction] or other jurisdictions where our providers operate, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms recognized under applicable data protection law.

We retain personal data only as long as necessary for the purposes described in this policy, to comply with legal obligations, resolve disputes, and enforce our agreements. Contact form submissions are retained for [Retention Period] unless a longer period is required by law or an active business relationship.

We apply reasonable technical and organizational measures designed to protect information against unauthorized access, alteration, disclosure, or destruction. No system is completely secure, and we cannot guarantee absolute security of information transmitted to us.

Depending on your jurisdiction, you may have the right to access, correct, delete, or port your personal data, object to or restrict certain processing, and withdraw consent where processing is based on consent. To exercise these rights, contact us using the details below.

Clients who submit end-user or business data to us for processing (e.g. via Echo) are responsible for ensuring they have a lawful basis to share that data and for providing appropriate notice to their own customers, in accordance with applicable law.

Questions about this policy can be directed to cosecentai@gmail.com.