This policy explains how Cotara Technology LLC ("Cotara", "we", "us") collects, uses and protects personal information. It covers three groups of people: visitors to our website, people who use Cotara for an organization, and supporters whose information an organization keeps in Cotara. We serve organizations in the United States, Canada and the United Kingdom.
1. Who we are and how to reach us
Cotara Technology LLC, 1450 Sunset Pointe, Suite 130, Cross Roads, Texas 76227, United States.
- Privacy questions and requests: privacy@usecotara.com.
- Privacy Officer: Wale Abba, Co-Founder and Chief Science Officer, who is responsible for our privacy practices. Email: wale@usecotara.com.
- UK representative under Article 27 of the UK GDPR, for people in the United Kingdom: Kudi. Email: kudi@usecotara.com.
- Questions about how we handle an organization's supporter data: data@usecotara.com.
2. Our role
- Visitors and account holders (for example, a person who books a demo or signs in): Cotara decides why and how the information is used. We are the controller, or the "business" under US state laws.
- Supporters of an organization (donors, volunteers, members, event guests): the organization that uses Cotara decides why and how their information is used. Cotara is its processor, or "service provider", and acts only on its instructions. If you are a supporter, please contact that organization first. Its own privacy notice applies.
3. What we collect
From visitors and account holders:
- Name, work email, organization, role, and what you tell us when you book a demo or write to us.
- Account and sign-in details, and billing information for the plan. Card details are collected and held by Stripe, not by us.
- Technical data, such as browser and device type, pages viewed, referring page and approximate location from your IP address. Section 13 explains analytics.
- If you apply to our Partner Program: your name, work email, organization, website, partner type, country, approximate network size, phone number and what you tell us about the partnership.
From connected accounts: if an organization connects Gmail, Google Sheets, Outlook or Microsoft Excel, we access the data that the connection screen describes, such as messages with supporters or the rows of a spreadsheet, only to provide the feature that the organization turned on. Section 6 sets out the limits.
On behalf of organizations (Customer Data): supporter contact details, gift history, receipts, event attendance, communication history and notes that the organization's team records, and information that supporters give through donation pages, forms and surveys.
We do not ask for government identity numbers, and we do not hold full card numbers.
4. How we use information
- To provide, run, secure and support the Service.
- To process donations and subscription payments through Stripe.
- To send receipts and service messages, and, for supporters, the messages that an organization's team approves.
- To answer questions you send us, to hold demos you book, and to review Partner Program applications and reply to them.
- To keep the Service safe, prevent fraud and abuse, and meet legal duties.
- To measure and improve the Service, using information that is aggregated and de-identified so that it does not identify a person.
We do not use one organization's supporter information to serve another organization. We do not collect email addresses on our website for newsletters or marketing.
5. Legal bases (UK and EEA)
Where the UK GDPR or EU GDPR applies to us as controller, we rely on: performance of a contract (to run your account); legitimate interests (to secure and improve the Service, and to reply to business enquiries), which we balance against your rights; legal obligation (for example tax and accounting); and consent (for analytics cookies), which you may withdraw at any time.
6. Google and Microsoft account data
- Cotara's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We use data from a connected Google or Microsoft account only to provide the features the organization turned on. We do not use it for advertising, we do not sell it, and we do not use it to train general AI models.
- Our staff do not read it unless the organization asks us to for support, it is needed for security or to investigate abuse, or the law requires it.
- An organization can disconnect the account at any time. We then stop accessing it.
7. AI-assisted features
Some features, such as Cotara Relationship Director, use software, including AI models, to suggest who to contact and to draft messages. A person on the organization's team reviews suggestions, and no personal message is sent to a supporter without that person's approval. Cotara does not make decisions about people that have legal or similarly significant effects. Where an AI provider processes data for us, it does so under contract, only to return the result to us, and not to train its own models.
8. Who we share information with
We share information only as needed to run the Service:
- Payments: Stripe, to process donations and subscription payments.
- Website analytics: Google Analytics, only if you accept analytics cookies. See section 13.
- Demo booking: Google Calendar, when you book a demo.
- Email delivery for partner applications: Resend, which delivers Partner Program applications from our website to our team.
- Website hosting: Vercel, which serves this website and counts visits without cookies. See section 13.
- Connected accounts: Google and Microsoft, when an organization connects an account.
- Service providers: the hosting, database, email delivery and AI providers that run the Cotara app. They work under written contracts and process data only on our instructions.
- Professional advisers, such as lawyers and accountants, under a duty of confidentiality.
- Authorities, where the law requires it, or where it is needed to protect rights, safety or property.
- A successor, if Cotara is part of a merger, acquisition or sale of assets. The successor must protect the information as this policy describes, and we will tell you before your information becomes subject to a different policy.
We do not sell personal information. We do not share it for cross-context behavioral advertising, and we do not use supporter information for advertising. A full list of our service providers is available on request at privacy@usecotara.com.
9. Where information is processed
We are based in the United States, and information is processed in the United States and in other countries where our providers operate. When we transfer personal information from the UK or the EEA, we use a lawful safeguard, such as the UK International Data Transfer Agreement or Addendum, the EU standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework where the recipient takes part in it. If you are in Canada, your information may be processed outside Canada and may be accessible to courts and authorities in other countries under their laws.
10. How long we keep information
- Customer Data stays while the organization has an account. After the account ends, the organization can export it for 30 days. We then delete it within a further 60 days, unless the law requires us to keep it.
- Billing and tax records stay for the period the law requires, usually up to 7 years.
- Demo, enquiry and Partner Program application information stays until you ask us to delete it, or for up to 24 months after our last contact.
- Google Analytics data is kept for the retention period we set in Google Analytics, which is no longer than 14 months.
11. Security
We protect information with measures that suit the risk. Today these include encrypted (HTTPS) connections, card details held by Stripe and not by us, and access to an organization's data limited to the people that organization invites. We are adding further safeguards and will describe each one on our Data Governance page once it is in place and verified. No system is perfectly secure. If we confirm a breach that affects personal information, we will tell the affected organization without undue delay, so it can meet its own duties, and we will notify people and regulators where the law requires us to.
12. Your rights
Depending on where you live, you may have the right to know what we hold about you, to get a copy, to correct it, to delete it, to move it, to restrict or object to some uses, and to withdraw consent.
- United States: residents of California and other states with privacy laws have these rights where those laws apply, and the right not to be treated unfairly for using them. If we decline your request, you may appeal by replying to our decision. If we deny your appeal, you may contact your state attorney general.
- Canada: you have rights under PIPEDA and provincial laws, including Quebec's privacy law. You may withdraw consent, subject to legal or contract limits, and ask how your information was used and to whom it was given.
- United Kingdom and EEA: you have rights under the UK GDPR or EU GDPR, including the right to object to processing based on legitimate interests.
How to make a request. Visitors and account holders: email privacy@usecotara.com. We reply within 30 days, and we may need to confirm who you are first. An authorized agent may make a request for you with your signed permission. Supporters: send your request to the organization you gave to. If you write to us, we will pass it to that organization and help it respond.
13. Cookies, analytics and free tools
Analytics. With your consent, our website uses Google Analytics to count visits and see which pages people use. Google Analytics sets cookies and receives your IP address, browser details and the pages you view. It does not load until you choose Accept. You can change your choice at any time with the “Cookie settings” link at the foot of every page. If your browser sends a Global Privacy Control signal, we treat it as a refusal and do not load Google Analytics.
Product demo. Our demo at usecotara.com/demo runs in your browser. Files you add to it are read on your device and are not uploaded. If tracking is switched on, the demo counts anonymous steps, such as which buttons are pressed, under a random code that lasts only while the page is open, and the link label we gave you. It does not record names, email addresses, file names or contents, or your IP address, and it sets no cookies. The counts are stored in a Google Sheet that only Cotara can open. If you type a question to Relationship Director in the demo and its live answers are switched on, your question, the recent conversation and a summary of the demo results are sent to our AI provider, Anthropic, to write the reply. In that summary people are replaced by codes, and names, email addresses and file contents are left out. We do not store the conversation, and it clears when you close the tab. Please do not type personal details into the demo chat.
Host analytics. Our website host, Vercel, counts page visits and measures page speed (Vercel Web Analytics and Speed Insights). These do not use cookies. They record the page address, the referring page, browser and device type, and an approximate country. They run on every page, including the free tools.
Other storage. We store your cookie choice and your light or dark theme choice in your browser. We do not use advertising cookies.
Free tools. Our free tools run in your browser. Files you upload and numbers you type into them are not sent to us or to anyone else. The tools that read donor files never load Google Analytics, and no analytics tool receives your file or what you type.
14. Children
Our website and the Service are for organizations and are not directed to children. We do not knowingly collect information from children for our own purposes. Organizations that collect information about young people are responsible for getting any consent the law requires.
15. Changes to this policy
We will post changes on this page and update the effective date at the top. For a material change, we will also tell account holders by email before it takes effect.
16. Contact and complaints
Cotara Technology LLC, 1450 Sunset Pointe, Suite 130, Cross Roads, Texas 76227, United States. Email: privacy@usecotara.com.
If you are not satisfied with our answer, you may complain to your data protection authority, for example the UK Information Commissioner's Office, the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or your state attorney general.
