Privacy Policy

1. Scope and contact

This policy applies to the Cohuno website, sign-in flows, private workflow studio, and related support. Cohuno is the name used for this service. Questions, access requests, or deletion requests can be sent to Contact form.

2. Information we process

• Google account information: your Google account identifier, verified email address, display name, and profile image when supplied by Google. Cohuno requests only the openid, email, and profile scopes for sign-in. Cohuno does not receive your Google password, verifies the returned identity token, and does not retain a Google access or refresh token.
• Email account information: your verified email address, display name, and a one-way password hash when you choose email access. Cohuno never stores the plaintext password. Short-lived verification codes are protected, expire, and cannot be reused after successful verification.
• Workspace content: workflows, agent and task configurations, run inputs and outputs, schedules, evaluations, knowledge sources, and other content you choose to store or process.
• Connection information: provider, tool, and MCP connection settings. Secret values saved in Cohuno are encrypted at rest.
• Billing and AI-usage information: credit purchases, balances, temporary holds, immutable ledger entries, performance-profile selections, measured usage, provider request references, charge records, refunds, and disputes. The payment processor handles card details; Cohuno receives transaction identifiers and payment status rather than your complete card number.
• Technical information: request, error, security, and diagnostic data generated when the service operates. This may include IP address, browser information, timestamps, and requested routes.
• Support communications: your name, email address, category, subject, message, case history, delivery status, and operator actions when you contact Cohuno. Contact requests are sent from the Cohuno contact form to the private Asterix support queue after email verification. A four-digit code is emailed to confirm ownership of the contact address.
• Presence and operator information: an opaque, keyed digest derived from the signed browser session, the associated account, and first- and last-seen timestamps. This supports approximate active-account and active-session counts. The presence store does not receive the raw session cookie, IP address, or user agent.

3. How information is used

Cohuno uses information to authenticate authorized users; provide, secure, troubleshoot, and improve the service; run the workflows and integrations you request; communicate about support and service changes; calculate and settle managed-AI usage; process credit purchases, refunds, and disputes; maintain financial records; and prevent misuse. Cohuno does not sell personal information or use workspace content for third-party advertising.

4. Service providers and integrations

Google processes Google sign-in information under its own terms. Email delivery providers process the address and message metadata needed to send verification messages. Hosting and infrastructure providers may process technical data to operate Cohuno. Payment processors process checkout, payment, refund, and dispute information under their own privacy terms. When you use Cohuno-managed AI, Cohuno sends the information required for your requested action to an internally selected AI processor. When you connect an MCP server, knowledge source, or other tool, Cohuno sends the required information to that connected provider. Those third-party services apply their own privacy terms, and workspace administrators are responsible for the services they connect and configure.

ChatGPT connection and integration authoring

Every Cohuno tool requires you to connect your Cohuno account through OAuth. You approve the requested permissions on Cohuno; do not share your password in ChatGPT. Tools process the WSDLs, WADLs, application source, sample XML and mock responses you choose to provide. Reading a saved project shares its source with ChatGPT; saving a reviewed application creates a project belonging to your connected account. Mock tests do not contact service endpoints or deploy applications.

Inspection and validation inputs are processed in memory. Compiled XML schemas may be cached temporarily in a bounded worker cache. Saved projects remain in your Cohuno account until deleted. OAuth grant records support authorization and revocation; raw access and refresh tokens are not stored in the grant database. Infrastructure logs may record IP addresses, timestamps and requested routes. Results return to ChatGPT, where OpenAI's data controls and retention terms apply. Disconnect the integration in Cohuno to revoke its access. Use synthetic test data and do not send connection secrets. Contact support for privacy or deletion requests.

5. Cookies and session security

Cohuno uses strictly necessary cookies to protect Google OAuth and email authentication, and to maintain an authenticated session. Session and request protection cookies are signed and configured with HttpOnly, SameSite, and HTTPS protections in production, and the signed session expires after 12 hours. Cohuno does not currently use advertising cookies on these pages.

6. Retention, security, and deletion

Information is retained while needed to provide the workspace, comply with applicable obligations, maintain billing and transaction records, resolve disputes, and protect the service. Retention can also depend on the connected provider and the workspace administrator's configuration. Cohuno uses access controls, encrypted secret storage, private network boundaries, and transport security, but no system can guarantee absolute security. Support cases and their delivery history are retained as needed to answer the request, maintain service and security records, and meet applicable obligations. Presence rows older than 24 hours are eligible for bounded cleanup; the dashboard counts a session as active only within the configured short heartbeat window. Contact support to request account or workspace deletion; transaction, support, audit, and limited backup records may remain where retention is required.

7. Your choices and rights

You can choose which workflows, knowledge, and third-party connections to provide. You may also ask to access, correct, export, object to, restrict, or delete personal information where applicable. Cohuno may need to verify your identity before completing a request. You may also have a right to contact your local data-protection authority.

8. International use, children, and updates

Cohuno and connected providers may process information in countries other than yours. The service is designed for organizations and is not directed to children under 18. This policy may change as the service or legal requirements evolve. Material changes will be reflected here with a new effective date.