Legal

Privacy statement

Version of 20 October 2026. Coofi, KvK 42214936. This text is being reviewed by our lawyer before launch.

The short version

We use your data to run Coofi for you, and for nothing else.
Your company’s data is kept apart from every other company’s, down to the database.
To do the work, the text your team needs is sent to AI model providers. We list them below.
You can see, export or delete your data at any time.

Who is responsible

Coofi, postal address Avenue Céramique 221, 6221 KX Maastricht, KvK 42214936, is responsible (the controller) for the data of the people who use Coofi: accounts, billing and logs. For everything a company puts in Coofi, that company is responsible and we process it on its instruction, under our data processing agreement.

What we collect and why

Data

Why

Legal basis

Kept for

Account details

Name, email and login, to give you access.

Contract

Until you delete your account, then removed within 30 days

Company content

Documents, conversations and tasks, so the team can do the work you ask for.

On your company’s instruction (we are its processor)

Until you delete it (then removed within 35 days) or end your account (within 50 days); mail bodies 60 days

Billing details

To charge your plan. Card details stay with the payment provider.

Contract and legal obligation

Invoices 7 years (tax law); the rest with your account

Contact form messages

To answer you when you write to us from the website.

Steps before a contract, or your consent

12 months

Website visitor counts

Built-in counters on sites we host for you, used to measure goals.

On your company’s instruction

Until you delete the site

Usage and logs

To keep Coofi secure and fix problems, and to count credits used against your plan.

Legitimate interest (security)

365 days

Who else handles it

We use a small number of providers to run Coofi, named below. Each one gets only what it needs. Your data is stored in Frankfurt, in the EU; to do a task, the text it needs goes to the AI providers listed here.

Hosting and databaseAmazon Web Services (AWS)Runs the app and stores your company data.Location: Frankfurt, Germany (EU)

File storageAmazon Web Services (AWS)Stores uploaded documents and files, separated per company.Location: Frankfurt, Germany (EU)

AI gatewayCortecsPasses the text a task needs to the AI model and returns the result. Keeps none of it.Location: Vienna, Austria (EU)

AI modelEU AI providers, through CortecsRun the model that does the work. Not allowed to keep your data or train on it.Location: EU

AI model, only if you choose OpusAmazon Web Services, through CortecsRuns Opus for a job you choose it for. Keeps nothing and may not train on it; Amazon is a US company.Location: Ireland and France (EU)

Email deliveryResendDelivers Coofi's own emails: sign-in links, codes and notifications.Location: Ireland (EU)

Build sandboxModalRuns the code of your website or app while Coofi builds and checks it.Location: EU (Modal is a US company)

Web searchLinkupOnly if your company switches web search on: receives the search words, never your documents. Zero data retention.Location: EU

PaymentsStripeProcesses your subscription. Card details stay with Stripe.Location: EU and US (EU-US Data Privacy Framework, standard contractual clauses)

Accounts you connectGoogle, Microsoft, Moneybird, e-Boekhouden, Klaviyo, Instagram, LinkedIn, Zapier or MakeOnly the ones you connect, to do the work you approve with them. Their own terms apply.Location: Where each provider runs your account

How we keep companies apart

Every record belongs to one company. The database itself refuses to show one company’s rows to another, and files are stored in a separate space per company. Departments inside your company share with each other. Nothing crosses to another company.

AI and your data

Documents are turned into text before an AI model reads them. For each task, only the text that task needs is sent. Every task runs on models hosted by providers in the EU, reached through Cortecs in Vienna; only Opus, if you choose it for a job, runs at Amazon in EU data centres. None of them keeps the text or may train on it. See who else handles it. Coofi does not train its own AI models on your data. Drafts made by AI are marked as AI in the app, and nothing that goes out is sent without a person’s OK.

Your rights

You can ask to see, correct, export or delete your personal data, and object to uses based on our legitimate interest. You can export your data and delete your account yourself, in the app’s settings. For anything else, write to us (see contact below); we answer within one month. If you think we handle your data wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

If you are a customer or contact of a company that uses Coofi, that company is responsible for your data: ask it first. We help it answer you.

Cookies

Coofi sets a few short-lived cookies while you sign in or connect an account, and keeps your login and your choices in your browser’s own storage. We use no analytics or advertising trackers. The full list is on cookies and storage.

Contact

Privacy questions go to hallo@coofi.ai.