Privacy Policy

1. Our approach to privacy

co|op is built around a simple principle: the sensitive data we help you protect should never touch our servers. Detection happens locally in the browser. This policy explains what we do and don't collect.

2. What we do NOT collect

We do not collect, store, or transmit the actual sensitive content that the extension detects. When an employee types an SSN, credit card, or API key into an AI tool, that text is scanned in the browser and never sent to us.

3. What we do collect

We collect limited metadata needed to operate the Service:

• Incident metadata — the type of data detected, a risk score, and a timestamp (never the content itself)
• Account information — your organization name, admin email, and license key
• Team information — employee emails associated with your organization, for management purposes
• Basic usage data — to keep the Service running reliably

4. How we use information

We use the information we collect to provide the dashboard, scope incidents to your organization, send account-related emails, and improve the Service. We do not sell your data.

5. Data isolation

Every organization's data is isolated. Your incidents, team, and settings are scoped to your account and are never visible to other organizations.

6. Third-party services

We use trusted infrastructure providers to host the Service and send transactional email. These providers process data only as needed to operate co|op.

7. Data retention

Incident metadata is retained according to your plan's history window. You may request deletion of your organization's data by contacting us.

8. Your rights

You may access, correct, or request deletion of your organization's data at any time. Contact us to exercise these rights.

Questions?

If you have any questions about this document, contact us at syphir26@gmail.com.