Cotool procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Depending on where you live, you may have the right to access, correct, delete, or port your personal data; to object to or restrict certain processing; to withdraw consent; and to lodge a complaint with a supervisory authority. To exercise these rights, contact us using the details below, and we will respond as required by applicable law. We will not discriminate against you for exercising your rights. Where we process data on behalf of a customer, we will route your request to that customer. If you are a California resident, you have rights under the CCPA/CPRA to know, delete, and correct your personal data and to opt out of its sale or sharing. As noted above, we do not sell your personal data or share it for cross-context behavioral advertising. You may use an authorized agent to submit a request, and we will verify it as required by law.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Our production data centers are in the United States, and your personal data may be processed there. Where we transfer personal data from the EEA, UK, or Switzerland to a country without an adequacy determination, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable). Contact us for more information.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Cotool, Inc. · 2130 Bay St., San Francisco, CA 94123 · legal@cotool.ai Data Protection Officer / Privacy contact: Max Pollard, Chief Executive Officer — legal@cotool.ai” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Our enterprise customers may use the Services to process their organization's cloud application data, which may contain your personal data. We process that data on their behalf, governed by our agreements with them (including our Data Processing Agreement), not this policy. If you have questions about that data or want to exercise your rights, contact the customer (the data controller) that engaged us. We assist our customers with such requests as required by our agreements.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ We retain personal data for as long as you use the Services or as needed to fulfill the purposes described here, comply with our legal obligations, resolve disputes, and enforce our agreements. After you terminate the Services, we delete the associated personal data within 60 days, except where we are required to retain it by law. Once deleted, it cannot be restored. You may request transfer of your personal data on termination by contacting us.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We share personal data only with trusted subprocessors that help us operate our Services and that are bound to keep it confidential and process it only on our instructions. Our current subprocessors are listed at cotool.ai/subprocessors . We may also disclose information where required to comply with law or to protect the rights, property, or safety of Cotool or others. If we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, as permitted by law.” | Captured 2026-07-20Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.