Last updated: July 31, 2026

1. Introduction

Welcome to Corvos ("Corvos", "we", "us", or "our"). We operate the website at www.corvos.com and the Corvos application (collectively, the "Service"), and we also publish Corvos as open-source software that you may self-host. This Privacy Policy covers the hosted Service; if you self-host Corvos, you control your own deployment and this policy does not apply to your instance. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what data we collect, how we use it, who we share it with, and the rights you have over your data.

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our policies and practices, do not use the Service. We may modify this policy from time to time; material changes will be reflected by updating the "Last updated" date above.

2. Data We Collect

We collect the following categories of personal data:

Identity Data includes first name, last name, username, or similar identifier you provide when registering for an account.
Contact Data includes email address and any contact information you provide when reaching out to support or completing the contact form.
Account and Authentication Data includes hashed passwords (for local authentication) and OAuth tokens issued by identity providers such as Google when you sign in with a third-party account.
Chat and Knowledge Base Data includes the messages, prompts, documents, and notes you submit through the Service when signed in. Anonymous chat sessions on our free pages are not stored in any user-linked database.
Document and Integration Data includes content from files you upload and data fetched from third-party services you connect (such as Slack, Google Drive, Notion, Confluence, GitHub, and others) under the scopes you authorize.
Billing Data includes information necessary to process payments (such as transaction identifiers and credit balances). Card details are handled by our payment processor and are not stored on our servers.
Technical Data includes internet protocol (IP) address, browser type and version, time zone, operating system, device identifiers, and other technology identifiers from the devices you use to access the Service.
Usage Data includes information about how you interact with the Service, such as pages visited, features used, referring URLs, and timestamps.
Marketing and Communications Data includes your preferences for receiving marketing communications from us.
Aggregated Data derived from any of the above and stripped of identifiers. Aggregated data is not considered personal data under most laws.

3. How We Use Your Data

We use your personal data only where we have a lawful basis to do so, including:

To create and manage your account, authenticate you, and provide the Service you have requested.
To process payments, manage your credit balance, and prevent fraud and abuse of the Service.
To answer your queries by sending prompts and content you submit to large language model providers (see Section 7) and return the responses to you.
To synchronize data from third-party services you have explicitly connected (such as Slack, Google Drive, or Notion) so that the Service can search and reference that content on your behalf.
To monitor, analyze, and improve the Service, diagnose issues, and detect security incidents.
To communicate with you about product updates, security notices, support requests, and (with your consent where required) marketing.
To comply with legal obligations and enforce our Terms of Service.

4. Cookies and Tracking Technologies

We use cookies, local storage, and similar technologies to operate the Service, remember your preferences, and measure usage. This includes strictly necessary cookies (for authentication, session management, and security) and analytics cookies (we use PostHog for product analytics). We do not run advertising on the Service and do not use advertising cookies.

See our Cookie Policy for the full list of cookies we use and how to control them. Blocking strictly necessary cookies will prevent the Service from functioning correctly.

5. Data Security

We implement technical and organizational measures designed to protect your personal data against accidental loss, unauthorized access, alteration, and disclosure. Access to personal data is limited to personnel who need it to operate the Service.

No system can be guaranteed to be fully secure. We cannot guarantee that personal data transmitted to or stored by the Service will be free from unauthorized access. You are responsible for keeping your account credentials confidential. If you discover a vulnerability, please report it per our Security Policy.

6. Data Retention

We retain personal data only for as long as necessary to provide the Service and to comply with our legal, accounting, and reporting obligations. Account data is retained for the life of your account; you can request deletion at any time. Aggregated data that no longer identifies you may be retained indefinitely for analytics and product improvement purposes. Anonymous chat sessions on our free pages are not retained in any user-linked database.

7. Third-Party Services

We rely on the following categories of third-party processors and providers to operate the Service. Each is bound by its own privacy policy, which we encourage you to review:

Authentication: Google (OAuth sign-in).
Hosting and infrastructure: Vercel, Cloudflare (CAPTCHA via Cloudflare Turnstile, DNS, and edge protection).
Analytics: PostHog (product analytics).
Large language model providers: OpenAI, Anthropic, Google, and other LLM providers process the prompts and content you submit to the Service in order to generate responses.
Integration providers: When you explicitly connect a third-party service (such as Slack, Google Drive, Notion, Confluence, GitHub, Jira, Linear, or similar), data is exchanged with that service under the scopes you authorize.

We do not sell personal data to third parties. We share data with the providers above only to the extent needed to operate the Service.

8. Your Legal Rights (Including GDPR)

Subject to applicable law, you have the following rights in relation to your personal data:

The right to access the personal data we hold about you.
The right to request correction of inaccurate or incomplete data.
The right to request erasure of your personal data ("right to be forgotten").
The right to object to or restrict certain processing of your data.
The right to data portability (to receive your data in a portable format).
The right to withdraw consent at any time where we rely on consent to process your data.
The right to lodge a complaint with your local supervisory authority if you believe our processing of your data infringes applicable law.

To exercise any of these rights, please contact us using the details in Section 11. We may need to verify your identity before responding to your request.

9. California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (as amended by the CPRA), including:

The right to know what categories of personal information we have collected about you and how it is used and shared.
The right to delete personal information we have collected from you.
The right to correct inaccurate personal information.
The right not to be discriminated against for exercising your privacy rights.

We do not sell or share personal information for cross-context behavioral advertising. To exercise your CCPA rights, please contact us using the details in Section 11.

10. Children's Privacy

The Service is not directed to children under 13 (or under 16 in the EEA, UK, and Switzerland). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, provide additional notice (such as an in-product notification or email). Your continued use of the Service after the updated policy becomes effective constitutes your acceptance of the revised policy.

12. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or if you want to exercise any of your rights, please contact us at:

Email: hafizmoazkhalid@gmail.com