Privacy policy
What we collect, what we never collect, and your rights.
1. Who is responsible for your data
- The controller of your personal data is Take Group sp. z o.o., ul. Wincentego Janasa 4, 40-855 Katowice, Poland, entered in the National Court Register (KRS) under number 0000871398 by the District Court Katowice-Wschód in Katowice, 8th Commercial Division of the National Court Register, NIP 6342984273, REGON 387616994, share capital PLN 5,000 ("Take Group", "we").
- For any privacy question or request, write to contact@cotlet.dev. We have not appointed a data protection officer, as the law does not require one for our processing; this address reaches the people responsible for privacy.
- This policy covers cotlet.dev, the Cotlet console, the REST API and the MCP server. It is written to meet the EU and UK General Data Protection Regulation (GDPR) and the privacy laws of US states, including California.
2. Our role
- We are the controller for your account, billing, support, security and website data.
- When a business uses Cotlet, the data its Connected Apps hold about other people is processed on that business's instructions: we act as its processor (in US terms, service provider) under the data processing addendum, and that business's own privacy notice applies.
- When you use Cotlet for your own personal accounts, we process that data to perform the actions you ask for, as described below.
3. What we collect
- Account data: your email address, name, a hash of your Cotlet password (never the password itself), and, if you sign in with Google, your Google account ID and profile picture. We also record when you signed up and last signed in, and whether your email is verified.
- Access request data: the apps you pick, what you want to do with them, and anything else you tell us in the form, such as your company or role.
- Billing data: your name, billing address, country, tax ID if you give one, plan and invoices. Card details go directly to Stripe; we see only the card brand, last four digits and expiry date.
- Connected App sessions: the cookies or tokens created when you sign in to a Connected App yourself, encrypted with AES-256 and kept in an isolated session per user and app.
- Call records: for each API or MCP call, the time, integration, endpoint, status, credits used, error code, the client name your agent sends and the IP address it came from.
- Call content: the inputs you send and the data a Connected App returns pass through our servers while a call runs. We do not keep them after the call completes.
- Support and communications: the messages you send us and our replies.
- Technical data: IP address, browser and device type, and pages requested, in short-lived server and security logs. Our CDN processes the same data to deliver and protect the site.
- Website analytics, only if you accept analytics cookies: pages you visit on our site, the referring page, device, browser and approximate location from your IP address, with a random identifier, through Google Analytics.
- Requests for missing apps: the app name, its address, the use case and the client name your agent sends, and the IP address for rate limiting.
4. What we never collect or do
- We never ask for, receive or store your Connected App passwords, one-time codes or CAPTCHA answers.
- We do not sell personal data, share it for cross-context behavioral advertising, or use advertising trackers. Analytics runs on our public pages only with your consent, never in the console.
- We do not use your data or Connected App content to train AI models, and we do not send it to AI model providers. The AI agent you use is chosen and run by you, under its provider's terms.
5. Why we use it, and our legal bases
- To review your access request, create and run your account, connect your apps and perform the calls you instruct, and to bill you: necessary for our contract with you or for steps you ask for before it (GDPR Article 6(1)(b)).
- To keep accounting and tax records and to answer lawful requests from authorities: our legal obligations (Article 6(1)(c)).
- To secure the Service, prevent fraud and abuse, enforce rate limits and our terms, fix errors, measure usage in aggregate to improve the Service, and establish or defend legal claims: our legitimate interests in a safe, working service (Article 6(1)(f)).
- To understand which pages of our site people use, with Google Analytics: your consent, which you can withdraw at any time with Cookie settings at the bottom of every page (Article 6(1)(a)).
- To email you about the Service, such as access, security, billing and changes to terms: our contract with you. Product news only if you opt in, which you can withdraw at any time (Article 6(1)(a)).
- You must give us your account data to use the Service; without it we cannot provide it. We make no decisions about you based solely on automated processing that have legal or similarly significant effects. Access requests are reviewed by people.
6. Data about other people in your Connected Apps
- Your Connected Apps may hold data about other people, such as members, clients or guests. The Service processes it only as needed to perform the call you instruct and does not keep it after the call completes.
- If you use Cotlet for a business, you are responsible for having a legal basis for that processing and for informing those people. We do not combine their data across customers or use it for our own purposes.
- Anyone whose data reaches us through a customer's Connected App can write to contact@cotlet.dev; we pass the request to the customer and help them answer it.
8. International transfers
- Our servers and the session vault are in the European Union. Some providers, such as our CDN and payment processor, may process data in the United States or other countries.
- Such transfers rely on an adequacy decision, including the EU-US Data Privacy Framework for certified providers, or on the European Commission's Standard Contractual Clauses and, for the UK, the International Data Transfer Addendum. You can ask us for a copy of the safeguards.
9. How long we keep it
- Connected App sessions: until you disconnect the app or close your account; then deleted at once.
- Call content: not kept after the call completes.
- Account data: while your account is open, and deleted within 30 days after you close it. Encrypted backups are overwritten within a further 35 days.
- Call records: 12 months, for billing questions and security; then deleted or kept only in aggregate form that does not identify you.
- Billing records and invoices: for the period required by tax and accounting law, in Poland 5 years from the end of the year in which the tax became due.
- Access requests that do not lead to an account: 24 months after our last contact.
- Support messages: up to 3 years after the conversation ends, to handle follow-up questions and claims.
- Server and security logs: up to 30 days, longer only when needed to investigate a specific incident.
- Website analytics, if you accepted it: 14 months in Google Analytics, then deleted by Google.
10. How we protect it
- Sessions are encrypted with AES-256 and isolated per user and app; traffic is encrypted in transit; access by our staff is limited to what their work requires; tokens are removed from logs; the AI model never sees a login. More on the security page.
- If a breach puts your data at risk, we notify the supervisory authority and you as the law requires.
11. Your rights in the EU, EEA and UK
- You have the right to access your data and get a copy, to have it corrected or deleted, to restrict its processing, to receive it in a machine-readable format and to have it sent to another provider.
- You can object at any time to processing based on our legitimate interests, and always to direct marketing. Where we rely on your consent, you can withdraw it at any time without affecting earlier processing.
- To use your rights, write to contact@cotlet.dev from the email address of your account, or use the settings in your dashboard. We answer within one month, which we may extend by two months for complex requests, and we tell you if we do.
- You can complain to a supervisory authority: in Poland the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl; in the UK the Information Commissioner's Office, ico.org.uk; or the authority where you live or work.
12. Your rights in the United States
- Notice at collection. In the last 12 months we collected these categories of personal information, from you, your devices, your Connected Apps at your direction, Stripe and Google: identifiers (name, email, IP address, account ID); customer records (billing details); commercial information (plan, payments, credits); internet activity (call records, logs); approximate location derived from IP address; professional information you give in an access request; and account log-in data (Connected App sessions), which is sensitive personal information.
- We use these categories only for the purposes in this policy and keep them for the periods in "How long we keep it". We use sensitive personal information only to provide the Service you request, so the right to limit its use does not apply.
- We do not sell or share personal information, as those terms are defined in California law, and have not done so in the last 12 months. We have no actual knowledge of selling or sharing data of anyone under 16. We honor Global Privacy Control signals as an opt-out request.
- Depending on your state, you have the right to know what personal information we collect, use and disclose, to access it and receive a portable copy, to correct it, to delete it, and to opt out of sale, sharing, targeted advertising and profiling. We do not discriminate against you for using these rights.
- To make a request, write to contact@cotlet.dev. We verify your request by matching it to your account email and may ask for more details. An authorized agent may act for you with your signed permission. We respond within 45 days, extendable once by 45 days with notice.
- If we decline your request, you can appeal by replying with "Appeal" in the subject within 45 days. We answer the appeal within the time your state law sets; if you disagree, you may contact your state attorney general.
- California "Shine the Light": we do not disclose personal information to third parties for their direct marketing.
13. Children
- The Service is not for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us data, tell us and we will delete it.
15. Changes to this policy
- We update this policy when our processing changes. We tell you about material changes by email before they apply. The effective date is at the top of this page.
16. Contact
- Take Group sp. z o.o., ul. Wincentego Janasa 4, 40-855 Katowice, Poland.
- Write to contact@cotlet.dev with any question about this policy or your data. We answer in English or Polish.