1. Introduction

Corebee Chat LTD ("Corebee," "we," "our," or "us") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered customer support platform at corebee.ai and any related services (collectively, the "Service").

2. Data Controller and Processor Roles

Corebee as Data Controller

Corebee is the data controller for personal data collected through our website, marketing activities, and account management. This includes data from website visitors, account holders, and marketing contacts. We process this data for the purposes of managing our relationship with you, operating our business, and complying with legal obligations.

Corebee as Data Processor

When our customers use Corebee to provide support to their end-users, the customer is the data controller and Corebee acts as a data processor. In this capacity, we process personal data only in accordance with the customer's instructions and our Data Processing Agreement. This Privacy Policy does not govern our processing of personal data as a data processor on behalf of our customers. If you are an end-user seeking information about how your data is processed, please contact the organization that uses Corebee for their customer support.

3. Information We Collect

Information You Provide

Account information: name, email address, company name, and password when you register
Payment information: processed securely through our payment provider (Polar/Stripe), or Shopify, if you subscribe through the Shopify App Store. We do not store credit card numbers on our servers
Customer Data: support conversation data, chat transcripts, and knowledge base content you create
Communications: messages you send to us via email, chat, or other channels

Information Collected Automatically

Device data: browser type, operating system, device type, screen resolution, and language preferences
Usage data: pages visited, features used, session duration, click patterns, and referral sources
Network data: IP address (anonymized for EU/EEA visitors in analytics), approximate geographic location
Connected apps: which apps and AI agents you connect to your workspace, when you approved them, the permissions you granted, and a log of the tools they call (see Connected AI Apps and Agents in Section 10)
Cookie data: as described in the Analytics and Tracking Technologies section below and our Cookie Policy

Information from Third Parties

Authentication providers: when you sign in via Google or other OAuth providers, we receive your name, email, and profile picture (see Section 9)
Payment providers: transaction confirmation and billing status

Google User Data (Gmail API)

If you choose to connect a Gmail or Google Workspace account so that Corebee can send support replies from your own email address, Corebee requests the https://www.googleapis.com/auth/gmail.send scope, plus the basic openid and email scopes that tell us which Google account you connected. The gmail.send permission lets Corebee send email as you, and Corebee uses it only to send replies to customers who emailed your support address first. We never use it to send marketing, bulk, or unsolicited email. We do not read, list, modify, label, or delete the contents of your Gmail mailbox, and we do not request any Gmail read scope.

The only Google user data we store is the email address of the connected mailbox, your Google account identifier, the list of permissions you granted, and the OAuth tokens needed to send on your behalf. The tokens are stored encrypted at rest and are used solely to send your outbound support replies. You can disconnect the mailbox at any time from your email channel settings: Corebee then asks Google to revoke Corebee's access and deletes the stored tokens. You may also revoke access directly from your Google Account permissions.

Corebee's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, and do not transfer it except as necessary to provide the Corebee support features you request, to comply with applicable law, or as part of a merger or acquisition with equivalent protections. No person at Corebee reads Google user data unless you ask us to for support, it is needed for security purposes or to comply with applicable law.

No AI/ML training on Google user data. Corebee does not use data obtained through Google Workspace APIs, including Gmail, to develop, improve, or train generalized or non-personalized AI and/or ML models, and does not allow any third party to do so.

4. Legal Bases for Processing (GDPR)

We process your personal data on the following legal bases under the GDPR:

Contract performance (Article 6(1)(b)): processing necessary to provide the Service, manage your account, and process payments
Consent (Article 6(1)(a)): analytics and marketing cookies, and email marketing
Legitimate interests (Article 6(1)(f)): security monitoring, fraud prevention, service improvement, usage analytics, and business-to-business outreach to prospective customers (where not overridden by your rights)
Legitimate interests (Article 6(1)(f)), team directory and team performance for connected apps: when a member of your workspace connects an app (see Connected AI Apps and Agents in Section 10) and the app has permission to read workspace settings or support metrics, we give it the names, email addresses and roles of the members of that workspace. With permission to read workspace settings it also gets their availability, join dates and profile pictures. With permission to read support metrics it also gets each member's number of conversations assigned and resolved, and their resolution rate. Our interest, and the workspace's, is that members can assign and hand over customer conversations, and review team performance, from the tools they choose. We limit this to members of the same workspace, to those fields, and to apps a member approved or connected with an API key. Workspace owners can revoke any member's app, and you can object by contacting us.
Legal obligation (Article 6(1)(c)): tax records, regulatory compliance, and responding to lawful requests from authorities

Business Contact Data and Outbound Communications

We process limited business contact information about individuals at companies we believe may benefit from Corebee. This is limited to name, job role, employer, business email address, and publicly available information about the company.

Lawful basis. We rely on legitimate interests (Article 6(1)(f)) to contact business representatives about products relevant to their professional role. We have assessed that this processing is necessary for our business development and proportionate in its impact, on the basis that the contact is professional rather than personal in nature, relates directly to the recipient's role, and can be stopped immediately on request. Where required, we contact corporate subscribers in accordance with the applicable electronic marketing rules in the recipient's jurisdiction.

Sources. Publicly available business sources such as company websites and public business directories, and commercial data and email verification providers. We do not purchase consumer data, and we do not process special category data for this purpose.

Your rights. You may object to this processing at any time and we will stop contacting you immediately. Every message includes a means of opting out, and you can also write to support@corebee.ai. When you object, we add your address to a suppression list retained solely to ensure we do not contact you again. If you would prefer erasure instead of suppression, tell us and we will delete your details rather than retain them on that list.

Retention. Business contact data is retained for up to 24 months from the date of last contact, after which it is deleted. Suppression list entries are retained indefinitely, as deleting them would risk re-contacting someone who has asked us not to.

5. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our services
Process transactions and send related information
Send technical notices, security alerts, updates, and support messages
Respond to your comments and questions
Detect, investigate, and prevent fraudulent, unauthorized, or illegal activity
Monitor and analyze usage trends to improve user experience
Comply with legal obligations

6. AI Data Usage and Transparency

Our Service uses artificial intelligence, including third-party large language models, to generate responses to customer queries. Here is how your data is handled in connection with AI features:

Data submitted to AI: when you use AI features, relevant Customer Data (such as conversation context and knowledge base content) is sent to our AI providers as input to generate responses ("AI Output")
No training by our AI model providers: none of our AI model providers (OpenAI, Anthropic, Google Gemini) may use API inputs or outputs to train their models. Your data is used solely to generate responses within the Service
Apps you connect are not our AI providers: the no-training and deletion commitments in this section cover Corebee and the AI model providers named above (OpenAI, Anthropic, Google Gemini). They do not cover third-party apps or AI agents you connect to your workspace yourself, which follow their own terms (see Connected AI Apps and Agents in Section 10)
Data retention by AI providers: our AI model providers keep inputs only for a limited period for abuse monitoring (about 30 days for OpenAI and Anthropic, up to 55 days for Google), then delete them
Data sanitization: we apply safeguards to minimize the inclusion of personally identifiable information in AI processing where feasible
AI Output accuracy: AI-generated content may contain inaccuracies. Customers are responsible for reviewing AI Output before it reaches end-users (see our Terms of Service, Section 9)

7. Analytics and Tracking Technologies

We use the following analytics and marketing technologies on our website. Where consent is required, no tracking cookies are set until you give it. Section 8 explains where we turn them on by default. For a complete list of cookies, see our Cookie Policy.

Google Analytics 4

We use Google Analytics 4, provided by Google LLC, to understand how visitors interact with our website. GA4 collects information such as pages visited, session duration, device type, and traffic source. IP addresses are anonymized by default for visitors in the EU/EEA. We have configured a data retention period of 14 months.

Legal basis: Consent (GDPR Article 6(1)(a)). Opt-out: Google Analytics Opt-out Browser Add-on.

PostHog

We use PostHog, provided by PostHog Inc., for product analytics and (separately) optional session replay. Our PostHog instance runs on EU Cloud (Frankfurt, Germany); all data is stored and processed within the European Union. PostHog does not collect passwords, credit card numbers, or other sensitive form data.

We split PostHog usage into two separate consent categories because EU data protection authorities (CNIL, Garante, Datatilsynet) treat session replay as higher-risk than ordinary analytics:

Analytics: pageviews, click events, heatmaps. No form input values. Retained 12 months. Sampled at 100%.
Session replay: recordings of how you use the product, linked to your account. All form inputs, passwords, email fields, and bodies of requests to /api/auth/*,/api/billing/*, /api/conversations/*, and /api/account/* are masked before being sent. Retained 30 days. You can turn it on or off at any time via the cookie preferences modal linked in the footer. Session replay runs only with your consent, and form fields are masked. It never runs in the agency console, on your customers' chat pages, or for signed-in Corebee staff.

You can change either toggle at any time via the cookie preferences modal (accessible from any page footer). Revoking consent stops future collection. When your account is closed, we also delete your PostHog person record. For more information, see the PostHog Privacy Policy. Legal basis: Website-visitor analytics, and session replay for everyone: Consent (GDPR Article 6(1)(a)).

Meta Pixel and Conversions API

We use the Meta Pixel (client-side) and Meta Conversions API (server-side), provided by Meta Platforms, Inc., to measure the effectiveness of our advertising on Facebook and Instagram. The Pixel collects page view and conversion events. The Conversions API sends event data server-side, including SHA-256 hashed email addresses for conversion attribution.

Important: Hashing is not anonymization. Meta can match hashed identifiers against its user database to attribute conversions to specific users. This data processing only occurs with your marketing consent.

For more information, see Meta's Data Policy. You can manage your ad preferences through your Facebook Ad Preferences. Legal basis: Consent (GDPR Article 6(1)(a)).

Google Ads Conversion Tracking

We use Google Ads conversion tracking, provided by Google LLC, to measure the effectiveness of our advertising campaigns. When you click on a Google ad and subsequently take an action on our website (such as signing up), a conversion is recorded. For more information, see Google's Advertising Privacy Policy. Legal basis: Consent (GDPR Article 6(1)(a)).

Google Consent Mode v2

We implement Google Consent Mode v2, which communicates your consent choices to Google services in real time. When you deny consent, Google Analytics and Google Ads operate in a cookieless mode that collects no personally identifiable information. Google may use these cookieless signals for modeled (estimated) reporting only.

8. Cookie Consent

If you visit corebee.ai from the EEA, the UK, Canada, Brazil or Israel, we present a cookie consent banner with three equal options: Accept All, Reject All, or Customize. No non-essential cookies are placed on your device until you choose. Until then, product analytics runs in memory only: no cookies, no session replay.

If you visit from any other country, or we cannot tell your country, we turn on analytics, session replay and marketing cookies by default, because those places do not require prior opt-in. You can change your preferences at any time via the "Cookie Settings" link in the footer.

If your browser sends a Global Privacy Control (GPC) signal, we honor it as an opt-out of all non-essential cookies, as required by applicable US state privacy laws (including the California Consumer Privacy Act).

9. Google User Data

When you sign in to Corebee using Google ("Sign in with Google"), we access the following information from your Google account:

Email address: used to create and identify your Corebee account
Name: used to personalize your experience
Profile picture: displayed in the dashboard as your avatar

We do not sell, rent, or trade Google user data. We do not use Google user data for advertising. The sign-in profile data listed above (email address, name and profile picture) is shared only with service providers that process it on our behalf to run the Service (for example Supabase and Vercel for hosting, Resend for account emails and PostHog for product analytics; see our sub-processors page), and with apps a member of your workspace connects (for example a teammate's name, email address and profile picture, which an app with permission to read workspace settings receives when it lists your team so it can assign a conversation, or a teammate's name and email address, which an app with permission to read support metrics receives with team performance; see Connected AI Apps and Agents in Section 10), which happens only because a member of your workspace chose to connect that app. The legal basis for that sharing is set out in Section 4.

Data from a Gmail connection (the connected mailbox address, your Google account identifier, the permissions you granted and the OAuth tokens) is never sent to analytics providers or to connected apps. It is handled under the Limited Use requirements described in Google User Data (Gmail API) in Section 3. Corebee does not use any Google user data, including sign-in data, to develop, improve, or train generalized or non-personalized AI and/or ML models.

You may revoke Corebee's access to your Google account at any time through your Google Account permissions. To request full data deletion, contact support@corebee.ai.

10. Data Sharing and Disclosure

SMS/Text Messaging Consent and Mobile Information

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service or messaging delivery, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

If you opt in to receive SMS/text messages from Corebee (for example, by agreeing on a phone call to have your free-trial link texted to the number you provided), your mobile phone number and your SMS consent will not be sold, and will not be shared with third parties for their own promotional or marketing purposes. You may opt out of text messages at any time by replying STOP to any message. Message and data rates may apply, and message frequency may vary. Reply HELP for help.

We do not sell your personal information. We may share your data with the following categories of recipients:

Service Providers (Sub-Processors), including:

The full, current list is on our sub-processors page.

Supabase: database hosting and authentication
Vercel: application hosting and edge delivery
Fly.io: hosting for the real-time voice servers (United States)
AI model providers (OpenAI, Anthropic, Google Gemini): AI inference for processing support queries (they may not use your data to train their models; see Section 6)
Polar/Stripe: payment processing, or Shopify, if you subscribe through the Shopify App Store
Inngest: background job processing

Analytics and Advertising (with consent)

Google: website analytics and advertising measurement
PostHog: product analytics and session replay
Meta: advertising measurement and conversion tracking

Apps You Connect (at Your Direction)

Third-party AI apps and agents you connect (for example Meta Muse, Claude, ChatGPT or Cursor): only the data and permissions you approve, and only because you chose to connect them. They are not our sub-processors. See Connected AI Apps and Agents below.

Other Disclosures

Legal authorities: when required by law, regulation, legal process, or enforceable governmental request
Safety and security: to protect the rights, property, or safety of Corebee, our users, or the public
Business transfers: in connection with a merger, acquisition, reorganization, or sale of assets, in which case we will notify you before your data is transferred and becomes subject to a different privacy policy

For a complete and current list of sub-processors, see our sub-processors page.

Connected AI Apps and Agents (MCP)

You can connect third-party apps and AI agents, for example Meta Muse, Claude, ChatGPT or Cursor, to your Corebee workspace. They connect through our Model Context Protocol (MCP) server at https://corebee.ai/api/v1/mcp/stream, either with OAuth after you sign in to Corebee and authorize them, or with an API key created in your workspace settings. Apps that connect with OAuth must be approved by you when you sign in to Corebee. For most apps, including Meta Muse, Corebee shows a consent screen that lists the permissions. Corebee's own Claude connector is approved when you sign in and receives your role's permissions. We share data with a connected app only because you, or a member of your workspace, chose to connect it.

What the app can access: only the permissions shown on the Corebee consent screen (or, for an API key, the permissions set when the key was created). An app can read conversations, contacts, the knowledge base, support metrics, team members and chat widget settings. It can change conversations, contacts, the knowledge base and chat widget settings, and delete contacts and knowledge base content. On the consent screen, permission to delete data is off unless you tick it. Meta Muse is never offered permission to delete data. ChatGPT is not offered it either. Access is limited to one workspace and never goes beyond the role of the member who approved the app or created the key: owners can grant everything, agents cannot delete data or change settings, and viewers can only read. That member's membership and role are checked again on every request (a change takes effect within about a minute), so if their role changes or they leave the workspace, the app's access changes with it. A few older API keys do not record who created them. They are limited only by the permissions set on the key, and an owner can revoke them under Settings, Developer API.
What we share: when the app calls a Corebee tool, we send it the data that tool returns. This can include support conversations and messages, your customers' names, email addresses, phone numbers and notes, the custom fields and external identifiers (such as the ID your own systems use for a customer) your workspace stores for a contact, whether a contact is blocked, technical details recorded with a contact or conversation (such as the page or channel it came from), knowledge base content, support metrics, the names, email addresses, roles, availability, join dates and profile pictures of your workspace members, and per-member support statistics (conversations assigned and resolved, resolution rate). The app can also act for you, for example reply to a customer, assign a conversation or add a page to your knowledge base. Replies it sends are saved in the conversation history like any other reply.
Who is responsible: you decide to connect the app and what it may do. Once data reaches the app, its provider handles it under its own terms and privacy policy, not ours. We do not control connected apps and are not responsible for how they use, store or share data. A connected app is not one of our sub-processors or AI providers (see Section 6). Where the data is about your customers, you remain its controller.
What we keep: for each tool call from a connected app we log the tool name, the time, whether it worked, how long it took, the size of the reply, which kind of credential was used (OAuth, or the short public prefix of an API key, never the key itself; for OAuth, a one-way code that identifies the connection, so its log can be deleted when you revoke it), the names of the fields sent and, if it failed, a short error type such as “not found”. We never log the field values, the error message or the reply. We keep this log for 30 days to secure and fix the Service. If an app asks for a report that runs in the background, we keep the request and the finished report so the app can collect it, and delete them within 2 days.
Credentials: an app that connects with OAuth gets an access token that expires after 1 hour and a refresh token that expires 30 days after it is issued. Each refresh token is replaced when it is used. If the same refresh request is repeated within 15 seconds, it returns the same new tokens. After that an old refresh token is refused. If it is used after the app has already refreshed again, we treat it as possibly stolen: we revoke that connection and the app must be approved again. An app that is not used for 30 days loses access. The app never receives your Corebee password.
Your controls: see and revoke connected apps in Settings, Login & security, Connected apps. Workspace owners can see and revoke every member's apps. A revoked app normally loses access within about a minute. Workspace owners can revoke API keys in Settings, Developer API. Revoking does not delete data the app already received, so ask its provider to delete it.
When the app is run by a platform such as Meta Muse: Corebee and the platform each act as independent controllers of the data about you that passes through the connection, such as your requests and account identifiers. Personal data about your customers in tool results remains Customer Data that Corebee processes for your workspace under our DPA; once the platform receives it, the platform handles it under its own terms. For ChatGPT, the platform is OpenAI. Corebee uses the connection data only to carry out the request you made through the app, within the permissions you approved, and to secure and support the connection. Data about your customers stays under your workspace's control as described in Section 2. When you revoke the app, or ask us to delete its data, we revoke its tokens at once (it loses access within about a minute), delete the background reports it requested, and delete the activity log for that connection within 30 days. Content the app created in your workspace at your request, such as replies and knowledge base pages, stays part of your Customer Data until you delete it.
No sale: we do not sell data to connected apps.
No secondary use: Corebee does not use Customer Data, or data received from or returned to connected apps, to train or fine-tune AI models. Corebee does not sell it, use it for advertising, combine it across customers, or build profiles for its own purposes, and does not use it to infer sensitive characteristics such as health, religion, sexual orientation, political views or ethnic origin. Analytics the Service computes for your workspace, such as conversation sentiment, CSAT, customer health scores and team performance metrics, are produced only on your instructions, stay within your workspace, and are used only to provide the Service to you.

11. International Data Transfers

Where your data is hosted. The Corebee application runs on infrastructure physically located in Mumbai, India:

Application & serverless functions (Vercel): deployed to the bom1 region (Mumbai, India).
Primary database (Supabase / AWS Postgres): ap-south-1 (Mumbai, India). Backups remain in the same region.
Product analytics (PostHog): EU Cloud (Frankfurt, Germany).
Voice servers (Fly.io): United States (Ashburn, Virginia).
Error monitoring (Sentry): United States (ingest.us.sentry.io).
Other sub-processors: may operate in the United States or globally. See the full list and per-processor location in our Data Processing Agreement.

Cross-border transfer mechanisms. India has not received an adequacy decision from the European Commission, so transfers from the European Economic Area (EEA), the United Kingdom, or Switzerland to our Indian hosting providers, and any onward transfer to the United States, are treated as third-country transfers under Chapter V of the GDPR. We rely on the following safeguards:

Standard Contractual Clauses (SCCs): We have executed the Standard Contractual Clauses approved by the European Commission (Implementing Decision 2021/914) with our Indian and US sub-processors as the primary transfer mechanism for personal data leaving the EEA.
EU-US Data Privacy Framework (DPF): Where a US sub-processor (e.g. Sentry, Resend, OpenAI, Anthropic, Stripe, Google, Meta) is self-certified under the EU-US Data Privacy Framework (European Commission adequacy decision C(2023) 4745), we additionally rely on that certification. The DPF does not cover transfers to India and is therefore not the mechanism we rely on for the Vercel Mumbai or Supabase Mumbai hosting tier; SCCs are. For Cloudflare we rely on SCCs.
UK International Data Transfer Agreement: For transfers originating in the United Kingdom we rely on the UK Addendum to the EU SCCs issued by the UK Information Commissioner (ICO).
Transfer Impact Assessment (TIA): For each third-country transfer we perform a Transfer Impact Assessment covering the destination country's surveillance laws, practical access by public authorities, and supplementary technical measures (encryption in transit and at rest, row-level tenant isolation, access controls). A summary is available on request from support@corebee.ai.

Apps you connect. Apps you connect (see Connected AI Apps and Agents in Section 10) receive data at your direction, wherever their provider operates. Those transfers are not covered by the safeguards above; their provider's terms apply.

You may request a copy of the applicable SCCs, the UK Addendum, or the Transfer Impact Assessment summary by contacting us at support@corebee.ai.

12. Data Security

We implement industry-standard security measures to protect your data, including:

TLS 1.2 or higher for all data in transit
AES-256 encryption for data at rest
Row-level security (RLS) for tenant isolation
Regular security assessments and monitoring
Access controls and authentication for all administrative access
OAuth 2.1 with PKCE for connected apps, with short-lived access tokens and permission checks on every request

No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security. If we become aware of a security breach that affects your personal data, we will notify you and any applicable regulatory authority in accordance with applicable law (including within 72 hours for GDPR-regulated breaches where feasible).

13. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. Specific retention periods:

Account and Customer Data (conversations, contacts, knowledge base): for as long as your account is active. After an account ends, you have 30 days to export your Customer Data. Corebee then deletes it from its live systems within a further 30 days, and encrypted backups roll off within 90 days.
Analytics data: 14 months (Google Analytics); 12 months for PostHog events; 30 days for PostHog session replay recordings (shorter due to the richer personal-data content of replays).
Consent records: duration of processing plus 3 years (to demonstrate compliance)
Payment records: 7 years (as required by tax law)
Audit logs: 3 years (who changed what in your workspace, including security events)
Connected app activity log: 30 days (tool name, time, result, error type, duration, response size, credential type and field names; never values or content)

You can request deletion of your data at any time by contacting us. When there is no ongoing legitimate business need or lawful legal ground to retain your data, we will delete, anonymize, or securely isolate it until deletion is possible.

Closing your account: to close your account and delete its data, email support@corebee.ai from an owner's address. An audit log entry of the request is kept for three years. Your Customer Data is then deleted on the timeline above.

After an account's data is deleted we keep only: billing records (7 years), audit log entries (3 years), consent records, the workspace record those entries point to, and the phone number or email address and date of anyone who opted out or asked not to be contacted, so we keep honouring that request.

14. Your Rights Under GDPR

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights:

Access your personal data (Article 15)
Correct inaccurate data (Article 16)
Delete your data ("right to be forgotten") (Article 17)
Restrict processing of your data (Article 18)
Data portability: receive your data in a structured, commonly used, machine-readable format (Article 20)
Object to processing of your data, including for direct marketing (Article 21)
Withdraw consent at any time, without affecting the lawfulness of processing prior to withdrawal (Article 7(3))
Not be subject to automated decision-making that produces legal effects, unless necessary for contract performance or based on your explicit consent (Article 22)
Lodge a complaint with your local supervisory authority

We respond to all data subject requests within 30 days. If we need additional time (up to a further 60 days for complex requests), we will inform you within the initial 30-day period. Contact support@corebee.ai to exercise any of these rights.

15. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to know: what personal information we collect, the categories of sources, the business purpose for collecting it, and the categories of third parties with whom we share it
Right to delete: request deletion of your personal information, subject to certain exceptions
Right to correct: request correction of inaccurate personal information
Right to opt out: of the sale or sharing of personal information
Right to non-discrimination: for exercising your privacy rights

We do not sell personal information. We do not use or disclose sensitive personal information for purposes other than providing the Service. We honor Global Privacy Control (GPC) signals as a valid opt-out request under California law. You can also exercise your right to opt out at any time via the "Do Not Sell or Share My Personal Information" link in our website footer, which opens the cookie preferences modal where you can disable analytics and marketing cookies.

Categories shared with advertising partners (with your consent): identifiers, internet or electronic network activity information, and approximate geolocation. Under California law, the use of certain advertising technologies may constitute "sharing" of personal information. You may opt out at any time via the cookie consent banner or GPC signal.

16. Other US State Privacy Rights

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with comprehensive privacy laws have similar rights to access, correct, delete, and opt out of certain processing of personal data. We honor these rights consistent with the applicable state laws. To exercise your rights, contact us at support@corebee.ai.

17. Children's Privacy

The Service is for businesses and for users aged 18 or older. It is not directed at children. If you believe we have collected information from a child, please contact us and we will delete it promptly.

18. Data Breach Notification

In the event of a confirmed security breach affecting your personal data, we will promptly notify you and any applicable regulatory authority in accordance with applicable law. For breaches subject to GDPR, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach where feasible, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. Notifications will describe the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken or proposed to address the breach. We also notify platform partners whose users are affected within the time our agreements with them require.

19. Third-Party Developer Setup Emails

When you use our onboarding assistant, you may designate a third-party developer, agency, or technical installer (a "Designated Developer") to complete installation of Corebee on your behalf by providing that person's email address. This section describes how we process personal data in connection with that feature.

Controller. Corebee is the data controller for Designated Developer email addresses and related processing activities described in this Section.

Categories of data processed. recipient email address; the originating customer's company domain; the timestamps of the initial setup email and any follow-up; the delivery, open, click, and bounce status of those emails (where available from our email service provider); and the unsubscribe status associated with the recipient email.

Purpose. to deliver the one-time setup email requested by the customer, to send at most one operational follow-up email approximately two (2) days later to facilitate completion of the installation, and to suppress future emails to recipients who unsubscribe or bounce.

Legal basis. Legitimate interests under GDPR Article 6(1)(f) and equivalent provisions of the UK-GDPR. Our legitimate interest is the operational delivery of a B2B setup workflow that the customer has expressly requested and where the Designated Developer is identified as a professional technical contact with a pre-existing relationship to the customer. We have assessed the balance of interests and determined that the limited frequency (at most two emails), operational subject matter, clearly visible unsubscribe mechanism, and absence of marketing content mean that the processing does not override the rights and freedoms of the recipient. Where applicable, we also rely on the functional-unsubscribe and sender-identification requirements of the CAN-SPAM Act, and on the business-to-business exemptions under CASL.

Retention. Email delivery and follow-up tracking records (including send timestamps, open, click, and bounce events) are retained for 30 days after the initial send, after which they are deleted or aggregated into anonymous analytics. Unsubscribe records, consisting of the recipient email address (hashed where technically feasible) and the timestamp of the unsubscribe request, are retained for as long as necessary to prevent re-emailing, for the sole purpose of ensuring that the recipient is not re-emailed by Corebee or any of our customers using this feature.

Right to object. If you are a Designated Developer who received a setup or follow-up email from Corebee, you may object to further processing at any time by using the unsubscribe link included in the email (in the form https://corebee.ai/unsubscribe/{token}) or by emailing support@corebee.ai. Upon receipt of an objection, we will stop sending further emails to you under this feature and will add your email to our suppression list described above. You also retain all rights described in Section 14 (Your Rights Under GDPR) and applicable US state privacy laws.

Transmission. Setup and follow-up emails are sent from a Corebee-operated or Corebee-designated sending domain through our transactional email sub-processor, which acts as a processor on our behalf under a data processing agreement and in accordance with the international-transfer safeguards described in Section 11. The customer that designated you warrants that it has the authority to share your email address with Corebee; a customer's misuse of this feature does not affect your rights under this Privacy Policy or applicable law.

20. Assistant Flow, Magic Resume, and Onboarding Data

The onboarding assistant maintains conversational state and related technical data to support the setup experience. This section supplements Sections 3, 5, and 13 above with specifics for that feature.

Assistant Conversational State. We store transient conversational state (question responses, branching context, and progress markers) in a field called assistant_flow_state. Anonymous sessions are retained for up to 30 days from the last interaction; authenticated sessions are retained for up to 90 days or the lifetime of your account, whichever is shorter. This data is processed on the legal basis of contract performance (GDPR Article 6(1)(b)) for authenticated users and legitimate interests (GDPR Article 6(1)(f)) for anonymous setup flows, with the interest being the operation of a stateful onboarding experience that resumes correctly across page reloads.

Cross-Device Magic Resume Tokens. To let you resume an in-progress setup on a different device, we generate short-lived resume tokens that are delivered to you via email or magic link. Only a cryptographic hash of each token is stored in our database; the raw token is never persisted server side. Resume tokens expire seven (7) days after creation and are single-use. The legal basis for this processing is contract performance (GDPR Article 6(1)(b)) or, where the setup flow is pre-account, legitimate interests (GDPR Article 6(1)(f)) in providing a continuous onboarding experience.

Company Domain Enrichment. Where technically enabled for your onboarding session, we may enrich your company email domain with publicly available firmographic information (such as company name, industry, and approximate size) via a third-party enrichment provider. This enrichment is performed at the domain level only. We do not submit individual names, personal email addresses, or other personal identifiers to the enrichment provider for this purpose. Enrichment results are used solely to tailor the onboarding experience (for example, to suggest relevant templates) and are retained for the duration of your account plus the retention periods described in Section 13.

Behavioral Analytics During Onboarding. Assistant interactions generate behavioral events (such as step completions, drop-off points, and latency measurements) that are sent to our product analytics provider (PostHog; see Section 7). Before transmission, these events pass through a runtime personally-identifiable-information redaction filter that removes free-text answer content, email addresses, and other identifiers from the event payload. Events are used to measure onboarding completion rates and diagnose issues, and are governed by the retention, legal-basis, and opt-out provisions set out in Section 7.

21. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of changes by posting the new policy on this page and updating the "Last updated" date. If we make material changes that affect how we process your personal data, we will notify you by email or through a prominent notice on our website at least thirty (30) days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

22. Contact Us

If you have any questions about this privacy policy, our data practices, or wish to exercise your privacy rights, please contact us:

Email: support@corebee.ai
Data protection inquiries: support@corebee.ai
Entity: Corebee Chat LTD, company no. 517303483, Poalei HaRakevet 26, Givatayim 5325717, Israel