Privacy Policy
Last updated · v1.2
Cosend is WhatsApp coexistence and automation infrastructure operated by True North Tech Group LLC, Wyoming, USA. This policy explains what personal data we handle, why, for how long, and what you can do about it.
1. Controller and processor
The distinction matters, and the whole Data Processing Addendum rests on it:
- We are the controller of your account data: the name, email address and workspace settings of the people who sign in to Cosend, and our billing records.
- We are a processor of your customers' data: WhatsApp message content, phone numbers, contact records and anything your automations touch. That data is yours. We process it on your documented instructions and for no purpose of our own.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, password hash or identity-provider subject, workspace and seat membership | You, at sign-up |
| Billing data | Plan, subscription state, invoices, usage counts. Card details are handled by Stripe and never reach our servers | You, and Stripe |
| Connection data | WhatsApp Business Account and phone-number identifiers, connection settings, webhook URLs, encrypted credentials | You, and Meta |
| Message data | Message content and media, phone numbers, message identifiers, delivery statuses, direction and timestamps | Meta, on your behalf |
| Connector data | Only what your automations send to or read from a connected service | You, through your automations |
| Operational data | API request logs, IP addresses, user-agent strings, audit events, error metadata | Automatically, when the service is used |
3. Message content
By default, Cosend stores the content of the WhatsApp messages it routes. That is what makes the shared inbox, the 180-day history import, AI replies and content-based automation triggers possible. We are not going to describe that as anything other than what it is.
Message content is processed to deliver and receive messages through Meta's WhatsApp Business Platform, to render your inbox, to run the automations you configure, and, only if you enable AI, to generate replies. It is isolated per workspace at the database level by row-level security, so one customer's data is not reachable from another's session. We do not sell it, and we do not use it to train models.
Direct-delivery mode is the alternative, and it is free on every plan. Set a connection to direct and Cosend records metadata only (timestamp, direction, message identifier, contact hash, type and status), forwards the full payload to your endpoint, and never writes the body. It is a per-connection setting, so a workspace can run some connections in direct mode and others normally. Turning it on disables the inbox, history import, AI and content-based triggers for that connection, and the dashboard tells you so before you save rather than failing later.
4. Lawful basis
Under Article 6 GDPR, for the data we control:
| Purpose | Basis |
|---|---|
| Providing the service you signed up for | Contract: Art. 6(1)(b) |
| Billing, invoicing and tax records | Legal obligation: Art. 6(1)(c), and contract |
| Security, abuse prevention, rate limiting and audit logging | Legitimate interests: Art. 6(1)(f) |
| Service email about your account, incidents and billing | Contract: Art. 6(1)(b) |
| Product analytics on the marketing site | Legitimate interests: Art. 6(1)(f). Cookieless and not tied to an identity, see §14 |
For message data we act on your instructions as processor, and the lawful basis for processing your customers' data is yours to establish as controller. The DPA sets that out.
5. Retention
Deletion is hard deletion of the database row and the stored object, not a flag, and it is carried out by a scheduled sweep per workspace.
| Data | Default | Configurable |
|---|---|---|
| Message content and media | 3 months on Free, 12 on Starter, 24 on Growth and Scale | 3, 6, 12 or 24 months, or until you delete it |
| Message metadata, without the body | As above | As above |
| Webhook delivery payloads | 30 days | No |
| Automation run logs | 90 days | 30, 90 or 365 days |
| Audit events | 24 months | No |
| Usage events, as billing records | 7 years | No |
Lowering a retention setting schedules a sweep and tells you how many records it will delete before you confirm. If you cancel, your data is retained for 30 days and then deleted. Export it before or during that window.
6. Google user data
Cosend connects to Google Sheets and Google Calendar only when you choose to connect them, and only through Google's own OAuth consent screen. This section describes the manner in which Cosend accesses, uses, stores and shares Google user data.
What we access
Five scopes, and no others:
- drive.file (Google Sheets). This grants access only to the individual files you select through the Google Picker, or that Cosend creates itself. Cosend cannot list, search, browse or open any other file in your Drive.
- calendar.events.readonly (Google Calendar). This one is broad. Google describes it as "View events on all your calendars": it lets Cosend read the events on every calendar in your Google account, not only ones Cosend created. It is read-only, so it cannot create, change or delete an event. Cosend uses it to send a WhatsApp reminder before an appointment (reading your upcoming appointments, and checking again just before the reminder goes out that the appointment has not been cancelled or moved), and to read upcoming events in an automation step you add yourself.
- calendar.app.created (Google Calendar). This grants access only to the calendars and events Cosend itself creates.
- openid (both connections). This identifies which Google account you connected.
- email (both connections). This gives the email address of the Google account you connected, used to label the connection with that account. Cosend does not request your name, photo or any other profile information.
How we use it
Only to run the automation you configured: appending or reading a row in a sheet you picked, creating or updating an event Cosend created, or reading your upcoming calendar events in order to send a WhatsApp reminder before an appointment. Cosend does not use Google user data for any other purpose.
How we store it
OAuth refresh tokens are stored encrypted with per-record keys and are never written to logs. Data read from a Google API is held only for the duration of the automation run that requested it, except where your own automation writes it into your Cosend data (a form response copied into a message, for example), in which case it is retained under your message retention setting in §5 and deleted with it.
How we share it
Cosend does not sell Google user data, does not use it for advertising or ad targeting, does not use it to develop, improve or train generalised AI or machine-learning models, and does not use it for creditworthiness or lending purposes. It is not transferred to any third party except the sub-processors listed at /subprocessors that are necessary to operate the service, or where required by law. Humans do not read it, other than with your explicit consent, where necessary for security purposes, to comply with applicable law, or where the data has been aggregated and anonymised. Where one of your own automations passes Google data into an AI step, that content reaches the AI sub-processor named at /subprocessors, at your configuration, and only while AI is enabled.
Cosend's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke Cosend's access at any time, from your Google Account permissions page or by disconnecting the integration in the Cosend dashboard. Revoking access stops future calls immediately; data already written into your Cosend workspace is removed under §5 or on request.
7. Sub-processors
The current list, with each vendor's purpose, the data categories they can see and where they process it, is published at /subprocessors and generated from the same source the service is configured from. The same list is available as machine-readable JSON at /subprocessors.json.
Two entries there are worth stating here because they are unusual. Message content reaches an AI provider only when you enable AI. If you use Cosend for routing and the inbox, you have no AI sub-processor at all. And our error tracking never receives message content: secrets and message bodies are wrapped in a type that cannot be serialised, so redaction is structural rather than a pattern match that might miss.
8. International transfers
Your database, your API hosting and your automation execution are in Germany. Some sub-processors are outside the EEA, and they are marked as such at /subprocessors. Where personal data is transferred out of the EEA we rely on the European Commission's Standard Contractual Clauses, which are incorporated into our DPA.
9. EU representative
We have not yet designated a representative in the Union under Article 27 GDPR. This section names one as soon as the appointment is made. Nobody holds that role for Cosend today, and no name appears here until somebody does.
In the meantime, anything you would send to a representative (a data-subject request, or an enquiry from a supervisory authority) goes to privacy@cosend.app and we answer it directly. Using this route costs you nothing: the rights in section 10 apply in full and on the same deadlines either way.
10. Your rights
If you are in the EEA or the UK you have the rights below. For account data, exercise them directly with us. For message data we are the processor. If you are the end recipient of a WhatsApp message, your request goes to the business you were messaging, and we will assist them with it.
| Right | How to exercise it |
|---|---|
| Access: Art. 15 | Email privacy@cosend.app |
| Rectification: Art. 16 | Edit it in the dashboard, or email us |
| Erasure: Art. 17 | Delete the record or the workspace in the dashboard, or email us. Deletion is hard deletion, and it reaches sub-processors |
| Restriction: Art. 18 | Email us |
| Portability: Art. 20 | Export your data from the dashboard, in a machine-readable format |
| Objection: Art. 21 | Email us. Where we rely on legitimate interests you can object at any time |
| Complaint | You may complain to your local supervisory authority. We would rather you told us first |
We respond within one month, as Art. 12(3) requires. We do not charge for a request unless it is manifestly unfounded or excessive.
Automated decision-making. We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you, and we do not profile you. Your own automations act automatically on your customers' messages; whether Art. 22 applies to what you have configured is yours to assess as controller.
11. US state privacy rights
If you live in California, Colorado, Connecticut, Texas, Virginia or another US state with a comprehensive privacy law, this section applies to you in addition to the rest of this policy.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months, and that includes the personal information of anyone under 16. There is nothing to opt out of, which is why this site carries no "Do Not Sell or Share My Personal Information" link. We treat a Global Privacy Control signal as an opt-out request in any case.
The categories we collect, where they come from and what we use them for are in §2 and §4. How long we keep each one is in §5. The categories disclosed to a service provider for a business purpose are in §7 and at /subprocessors. We do not use or disclose sensitive personal information for any purpose beyond those for which the California Consumer Privacy Act gives no right to limit.
Subject to our verifying who you are, you may:
- know what we have collected about you, and receive a copy in a portable format;
- correct personal information that is wrong;
- delete personal information we hold about you;
- opt out of sale, sharing and profiling, none of which we do; and
- appeal a decision on your request, where your state gives you that right. Say you are appealing and a different person will review it and reply with reasons.
Email privacy@cosend.app. We reply within 45 days, and may extend once by a further 45 days if we tell you why. An authorised agent may make a request for you with written permission we can verify. We will not discriminate against you for exercising any of these rights: not by refusing service, not by charging a different price, not by giving you a worse version.
Where we process message content for a business customer we do so as that customer's service provider, for their purposes and not our own, and we do not retain, use or disclose it outside that relationship. A request about a message you sent to or received from a business using Cosend goes to that business; tell us and we will help them answer it.
12. Children
Cosend is business software and is not directed to children. You must be at least 18 to hold an account, and we do not knowingly collect personal data from anyone under 16. If you believe a child's data has reached us, email privacy@cosend.app and we will delete it.
Your own customers may be any age, and their messages reach us because you are messaging them. Whether you may lawfully process a child's data in that conversation is yours to decide as controller; the DPA sets out that division of responsibility.
13. How we protect data
Encryption in transit on every connection; envelope encryption at rest for secrets and credentials, with a key bound to the record it belongs to; tenant isolation enforced by row-level security in the database rather than by application code; signed webhooks in both directions; an outbound HTTP client with an allowlist that is re-resolved on every delivery; and error tracking that structurally cannot receive a message body. The full description is at /security, and our DPA incorporates it as our Art. 32 measures.
No system is immune. Where a breach affects personal data we control, we notify the competent supervisory authority within 72 hours where Art. 33 requires it, and we tell you directly where the risk to you is high. Where the data is processed for a business customer, we notify that customer instead, on the timing in §9 of the DPA.
14. Cookies and analytics
This website sets no analytics or advertising cookies, so there is no consent banner. Our product analytics is cookieless: it records page views without a cookie, without a device identifier and without anything that identifies you personally. We have chosen that deliberately, and the absence of a banner is the visible consequence.
The Cosend dashboard sets a session cookie when you sign in. That cookie is strictly necessary to keep you signed in and is not used for tracking.
15. Contact
Privacy questions, data-subject requests and anything in this policy: privacy@cosend.app. Everything else: hello@cosend.app.
True North Tech Group LLC, Wyoming, USA. We update this policy when what we do changes, and the date at the top of the page is the date of the last change. Where a change materially affects how we handle personal data we control, we give at least 30 days' notice by email to the address on your account before it takes effect.