Privacy Policy

This Privacy Policy explains what personal data Cotekumi, Inc. ("we", "us") collects when you use Cotekumi (the "Service"), how we use it, who we share it with and the choices you have. We are the controller of this data.

• Account data: your email address, name and profile picture if you give them, and, if you sign in with Google, the identifier Google gives us. If you set a password, we store only a secure hash of it. • Your Content: prompts, messages, files you upload, and the pictures, videos, sounds and replies the Service produces, together with the notes the Service writes about the assets in each conversation so it can reuse them. • Payment data: your plan, purchases, credit balance and invoices. Card details are collected and held by Stripe; we never see or store your full card number. • Usage and device data: IP address, browser and device type, pages and features used, request logs, and error reports. • Messages you send us, for example support requests.

• To provide the Service: create your account, run your requests, keep your conversations and asset library, and handle payments and credits (performance of our contract with you). • To keep the Service safe: prevent fraud and abuse, enforce our Terms, check requests against our content rules, and secure our systems (legitimate interests, and legal obligations). • To fix and improve the Service: understand how features are used and find errors (legitimate interests). • To contact you about your account, security, billing and important changes (contract and legitimate interests). • To meet legal and tax obligations. Where the GDPR applies, the legal basis for each use is shown in brackets. We do not use Your Content to train AI models, we do not sell personal data, and we do not share it for cross-context behavioural advertising.

We share personal data only with providers that help us run the Service, under contracts that limit their use of it: • Hosting, storage and databases: Google Cloud, MongoDB Atlas. • AI model providers, which receive the prompts and files a request needs to produce its result: OpenRouter (which routes text requests to model providers), SpicyAPI, ModelsLab and ATP. • Payments: Stripe. • Sign-in: Google. • Email: Resend. • Error monitoring: Sentry. We may also disclose data when the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the business, in which case this policy continues to apply.

We and our providers process data in the United States and other countries. If you use the Service from outside the United States, your data is transferred to the United States; where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses.

We keep account data and Your Content while your account is open. You can delete your account in your account settings. When you delete content or your account, we remove it from our active systems within 30 days; copies in backups are overwritten within a further 35 days. We keep payment and tax records for as long as the law requires, and logs for up to 90 days unless they are needed to investigate abuse.

Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with consumer privacy laws may have the right to know what personal data we hold about them, to get a copy, to correct it and to delete it, and to opt out of the sale or sharing of personal data, targeted advertising and profiling. We do not sell personal data or share it for cross-context behavioural advertising, and we do not use it for targeted advertising or for profiling that produces legal or similarly significant effects. We do not use or disclose sensitive personal information except to provide the Service. To make a request, email support@cotekumi.ai from the address on your account. We will verify the request and reply within 45 days. You may use an authorised agent, and if we decline a request you may appeal by replying to our decision. We will not treat you differently for using these rights.

If you are in the European Economic Area, the United Kingdom or Switzerland, you also have rights under the GDPR, including to access, correct, delete and receive a copy of your data, to object to or restrict some processing, and to complain to your local data protection authority. We rely on performance of our contract with you, our legitimate interests, your consent and our legal obligations to process your data. Contact support@cotekumi.ai to use these rights.

We use encryption in transit, access controls and other measures to protect personal data. No online service can be completely secure, so please use a strong password and keep your API keys private.

The Service is not for anyone under 18. We do not knowingly collect personal data from children under 13, as defined by the Children's Online Privacy Protection Act, or from anyone under 18. If you believe a child has given us personal data, contact support@cotekumi.ai and we will delete it.

We may update this policy. If a change is material we will tell you by email or in the Service before it takes effect.

Cotekumi, Inc.: support@cotekumi.ai.