Privacy Policy

Who is responsible

The data controller is COCEYO OÜ, Ruunaoja tn 3, Lasmäe linnaosa, Tallinn, Harju maakond, 11415, Estonia (registration number 17358237). Coceyo was created by Mindzy, which also delivers custom Enterprise projects. Full details are in the 法律声明. Privacy questions: contact@mindzy.me.

When you use Coceyo for an organization and process data about other people (for example your contacts), you decide how that data is used and Coceyo processes it on your behalf.

Local first

Coceyo runs on your computer and phone. By default, your workspace data (conversations, files, contacts, agent work) is stored on your devices and we have no access to it. Cloud sync is optional: when you turn it on, your workspace is stored encrypted in Coceyo Cloud, hosted in the European Union. We only access synced data with your explicit permission, for example to resolve a support request, and every access is logged.

Data we collect

Account and billing: name, email, organization, plan and device identifiers. Payments are handled by Stripe; we do not see your full card number.

Your content: what you give Coceyo and what it produces (messages, voice, files, call transcripts, and data from apps you connect), processed to provide the Services.

Technical data: app version, error reports with personal data removed, and the security information needed to protect your account.

Website: when you contact us or join the waitlist (the form is hosted on mindzy.me), your name, email, phone number and message. Our hosting provider processes technical data such as your IP address to deliver and secure the site. We do not use advertising or analytics trackers.

How AI models process your content

To answer you, Coceyo sends the relevant part of your content to an AI model. Depending on your settings, this model runs on your device (Private Mode) or at a model provider listed in our Subprocessors. Coceyo’s default model providers are used with zero data retention: they process your content to generate an answer and do not keep it or use it for training. Confidential data can be restricted to on-device or zero-retention models.

If you add your own API key for a provider, your content is processed under your agreement with that provider.

Model training

We do not use your content to train AI models unless you opt in. You can change this choice at any time in your settings, and it never applies retroactively to content you did not share.

Support and quality review

To provide support and improve Coceyo, authorized Coceyo staff may review requests with personal data removed. Your organization can turn this off in its settings.

Why we use your data

To provide and secure the Services, process payments, answer your requests, send service messages, and, only with your consent, send marketing communications. The legal bases are the performance of our contract with you, your consent, our legal obligations, and our legitimate interest in securing and improving the Services.

Sharing

We do not sell personal data. We share it only with the service providers listed in our Subprocessors, who act on our instructions, with third-party services you choose to connect, or when the law requires it.

International transfers

Some providers are located outside the European Union, for example in the United States. In that case, we rely on safeguards recognized by the GDPR, such as the European Commission’s standard contractual clauses or an adequacy decision.

Security

Data is encrypted in transit and at rest. Every action taken in your workspace is recorded in a tamper-evident audit log written by the system, not by the AI. Read more in Security.

Retention and deletion

We keep account data while your account is active, and billing records as long as accounting law requires. Data you store locally stays under your control. You can export your data and delete your account at any time; synced data is then deleted, including by destroying its encryption keys. Website contact data is kept for a maximum of 3 years from your last contact with us.

Your rights

Under the GDPR you have the rights of access, rectification, erasure, restriction of processing, data portability and objection, and you can withdraw your consent at any time. To exercise them, write to contact@mindzy.me. You may also lodge a complaint with your data protection authority (in Estonia: the Data Protection Inspectorate, Andmekaitse Inspektsioon; in France: the CNIL).

Children

Coceyo is not intended for anyone under 18, and we do not knowingly collect their personal data.

Cookies

This website uses no tracking or advertising cookies. Details are in our Cookie 政策.

Changes

We may update this policy. We will notify you of material changes, and the date at the top shows the latest update.