Privacy Policy
The short version — no legalese
- We only collect what you voluntarily type into our consultation form. Nothing is hidden.
- No tracking cookies, no analytics, no advertising pixels. We don't profile you or follow you around the web.
- We never sell or rent your data. To anyone, under any circumstances.
- We use your data to reply to you and prepare your consultation. That's it.
- You can ask us to show, correct or delete your data at any time at info@cogrowthai.com.
01 Who is responsible for your data
The controller of your personal data — that is, the party who decides why and how it is used — is:
Referred to below as "Cogrowth", "we" or "us". "You" or "the user" means anyone who visits this website or sends us information through it.
02 Scope and applicable law
Cogrowth operates from Venezuela and serves clients in several countries, mainly in Spain and the European Union, the United States and Latin America. We therefore apply, cumulatively, the highest standard of protection across the following frameworks:
- Regulation (EU) 2016/679 (GDPR) and Spain's Organic Law 3/2018 (LOPDGDD), which apply to us by virtue of Article 3(2) GDPR, since we offer services to people located in the European Union.
- The California Consumer Privacy Act (CCPA), as amended by the CPRA, and any other applicable US state privacy laws.
- Article 28 of the Constitution of the Bolivarian Republic of Venezuela, which recognises the right of habeas data: to access the data held about you, to know the use and purpose given to it, and to request its updating, rectification or destruction.
Venezuela currently has no comprehensive data protection statute equivalent to the GDPR. Rather than relying on that gap, we have chosen to voluntarily apply the European standard to every user, regardless of where they live. The rights described in this policy are available to you even if you are not in the EU.
03 What data we collect
3.1. Data you give us voluntarily
Through the consultation form at cogrowthai.com/en/form we collect:
- Identity and contact details: name, email address and phone number.
- Professional details: your company name and, optionally, your website address.
- Details about your operation: your business stage, an indicative budget range and the main priority you want to solve.
- Free-text content: whatever message or description you choose to write. We recommend you do not include sensitive information (health, beliefs, detailed financial data, credentials) in that field.
- Submission metadata: form language, originating page and the date and time of submission.
Any field marked optional can be left blank without preventing submission.
3.2. Data generated automatically
Our hosting provider logs basic request information for technical and security reasons: IP address, browser type and version, operating system, date and time of access and the page requested. These logs are managed by the provider, kept for a limited period, and we do not use them for profiling or cross-reference them with form data.
3.3. Data from our correspondence with you
If we reply to your enquiry by email, we keep the history of that correspondence and any internal notes on the status of your request.
3.4. Data we do NOT collect
- We do not collect special categories of data (health, ethnic origin, political opinions, religion, sexual orientation, biometric or genetic data).
- We do not collect payment card or banking information through this website.
- We do not buy databases or obtain your data from third-party sources: everything we hold, you gave us directly.
04 Why we use your data and on what legal basis
The GDPR requires every processing activity to rest on a lawful basis. Ours are as follows:
| Purpose | Data used | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Handling your enquiry and replying to you | Identity, contact, professional, operation, message | Pre-contractual steps taken at your request — Art. 6(1)(b) |
| Preparing and holding the diagnostic call | Contact details and operational details | Pre-contractual steps — Art. 6(1)(b) |
| Managing the commercial relationship if you engage us | All of the above | Performance of a contract — Art. 6(1)(b) |
| Site security, abuse prevention and blocking automated submissions | Technical data and server logs | Legitimate interest in protecting our systems — Art. 6(1)(f) |
| Improving our services and materials in aggregate form | Operational data, without identifying you | Legitimate interest — Art. 6(1)(f) |
| Sending you marketing about similar services | Name and email address | Consent, or legitimate interest for existing clients — Art. 6(1)(a) / 6(1)(f) |
| Meeting legal, accounting and tax obligations | Identity and billing data | Legal obligation — Art. 6(1)(c) |
On legitimate interest: whenever we rely on this basis we have first assessed that our interest does not override your rights and freedoms. You can object to any of these processing activities at any time, as explained in section 9.
If you don't provide the data: the mandatory form fields are needed to contact you and prepare the consultation. Without them we cannot handle your request, though you can continue browsing the site normally.
06 Who we share your data with
We do not sell, rent or trade your personal data to third parties for commercial purposes. Ever. No exceptions.
We do rely on technology providers who process data on our behalf — what the GDPR calls processors — and who are contractually bound to use it only on our instructions:
| Provider | Role | Data processed | Location |
|---|---|---|---|
| Vercel Inc. | Website hosting and form execution | All form data and technical logs | USA / global |
| Make.com (Celonis) | Automating the enquiry workflow | All form data | USA |
| Notion Labs, Inc. | Internal record and tracking of requests | All form data | USA |
| Resend, Inc. | Sending confirmation and notification emails | Name, email and message content | USA |
| Google LLC (Gmail) | Mailbox where we receive and answer your enquiry | Name, email and message content | USA / global |
Beyond these processors, we may disclose your data to:
- Professional advisers (lawyers, accountants) where necessary and under a duty of confidentiality.
- Public authorities and courts, where we are legally required to do so or where it is necessary to establish, exercise or defend legal claims.
- A potential acquirer, in the event of a restructuring or sale of the business, in which case we would inform you beforehand and the acquirer would be bound by this same policy.
07 International data transfers
Given the nature of our business, your data is processed outside the European Economic Area (EEA): both in Venezuela, where we operate, and in the United States, where most of our providers are based.
Neither Venezuela nor the United States generally benefits from a European Commission adequacy decision declaring their level of protection equivalent to the EU's. To safeguard these transfers we rely on the mechanisms set out in Chapter V of the GDPR:
- Standard Contractual Clauses (SCCs) approved by the European Commission in Implementing Decision (EU) 2021/914, incorporated into the data processing agreements with our providers (Art. 46(2)(c) GDPR).
- The EU-US Data Privacy Framework, for those US providers certified under it and for transfers covered by that certification.
- Supplementary measures — encryption in transit and at rest, minimisation of the data transferred and access controls — in line with EDPB Recommendations 01/2020.
- For transfers to Venezuela made in the context of a pre-contractual or contractual relationship with you, the derogation in Article 49(1)(b) GDPR also applies, as the transfer is necessary to perform the contract or the pre-contractual steps you yourself requested.
You can request a copy of the safeguards in place by writing to info@cogrowthai.com.
08 How long we keep your data
We apply the storage limitation principle: we keep each piece of data only while it serves a legitimate purpose.
| Type of data | Retention period |
|---|---|
| Enquiries that do not lead to a commercial relationship | Up to 24 months from last contact, unless you ask us to delete it sooner |
| Client data under contract | For the duration of the relationship plus 6 years, for accounting and tax obligations |
| Email correspondence | Up to 24 months from the last exchange |
| Server technical logs | Per the hosting provider's retention policy, typically no more than 30 days |
| Data processed on the basis of your consent | Until you withdraw it |
Once these periods elapse, data is deleted or irreversibly anonymised. Where a claim is ongoing, we will retain strictly what is necessary until it is finally resolved.
09 Your rights
Regardless of where you live, we grant you the following rights over your personal data:
How to exercise them
Write to info@cogrowthai.com stating which right you wish to exercise. To protect your privacy we may ask you to verify your identity before acting on the request.
- Exercising these rights is free of charge.
- We will respond within one month of receiving the request, extendable by a further two months for particularly complex requests, in which case we will let you know.
- If we cannot act on your request, we will explain why in writing.
10 Additional information for EEA and UK users
If you are located in the European Economic Area or the United Kingdom, the following also applies:
- Right to lodge a complaint with a supervisory authority. If you believe our processing infringes data protection law, you may complain to the authority in your country of residence. In Spain this is the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es. In the UK it is the Information Commissioner's Office (ICO) — ico.org.uk. We would appreciate the chance to resolve the matter with you directly first.
- EU representative (Art. 27 GDPR). Controllers not established in the EU must designate a representative in the Union in writing, unless the processing is occasional, does not include large-scale processing of special categories of data, and is unlikely to result in a risk to the rights and freedoms of individuals. Given the current, limited scale of our processing — occasional commercial enquiries, with no sensitive data and no profiling — we consider that derogation to apply. We review this assessment periodically and will designate a representative as soon as it ceases to apply, publishing their contact details here.
- Data Protection Officer. We are not required to appoint a DPO under Article 37 GDPR, as our core activities do not consist of processing operations requiring regular and systematic monitoring of data subjects on a large scale. Privacy matters are handled directly at info@cogrowthai.com.
11 Additional information for United States residents
If you are a California resident, the CCPA/CPRA gives you specific rights. We disclose the following:
- We do not sell or share personal information as those terms are defined by the CCPA. We have not sold or shared personal information in the preceding twelve months, including that of consumers under 16.
- Categories collected: identifiers (name, email, phone), commercial and professional information, and the contents of electronic communications. All of it comes directly from you.
- Business purposes: responding to your request, providing our services and securing the site, as detailed in section 4.
- Your rights: to know what information we hold, to request its deletion, to correct inaccurate information, to limit the use of sensitive information, and not to be discriminated against for exercising any of them.
- How to exercise them: by writing to info@cogrowthai.com. You may appoint an authorised agent to act for you, subject to proof of authority.
We do not currently meet the CCPA's mandatory applicability thresholds — annual gross revenue above USD 26.6 million, processing the data of 100,000 or more California consumers, or deriving 50% or more of revenue from selling data. We nonetheless honour these requests voluntarily on the same terms. If you reside in another state with its own privacy statute (Virginia, Colorado, Connecticut, Utah, Texas and others), we will honour the equivalent rights that law grants you.
12 Artificial intelligence and automated decisions
Cogrowth designs and deploys automation and AI systems for its clients. Two clearly separate planes are worth distinguishing:
12.1. Your data as a visitor to this site
- We make no automated decisions with legal or similarly significant effects on you. Every assessment of your enquiry is made by a person.
- We do not profile you or subject your data to algorithmic scoring.
- We do not use your personal data to train AI models, whether our own or third parties'.
- The automations involved when you submit the form simply move your request between our internal tools and send the corresponding emails.
12.2. The systems we build for clients
When we develop infrastructure for a client, the client acts as controller of its own users' data and Cogrowth acts as processor. That relationship is governed by a specific data processing agreement, separate from this policy, containing the obligations set out in Article 28 GDPR.
13 Use of Google API data
Cogrowth uses Google APIs (Gmail and Google Sheets) to run automation workflows on its self-hosted n8n platform, both for its own internal operations and in connection with automation services engaged by its clients.
Where these permissions are used on behalf of a client, that client connects its own Google account directly and independently, and the data accessed is processed exclusively within the workflows configured for that specific client — Cogrowth acts as a processor with respect to that data, as described in section 12.2 of this policy.
Cogrowth's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
This data is never sold, never shared between clients or with unrelated third parties outside the corresponding automation process, and is never used to train artificial intelligence models or for advertising purposes. It is retained only for as long as necessary to run the workflow for which it was authorised.
14 Information security
We apply appropriate technical and organisational measures to protect your data against destruction, loss, alteration or unauthorised access:
- HTTPS/TLS encryption of all traffic across the site.
- Third-party service credentials stored as encrypted environment variables, never in the site's source code.
- Access to data limited to those who need it to deliver the service.
- Two-factor authentication on the tools involved in processing.
- Selection of providers holding recognised information security certifications.
- Minimisation: we only ask for what is strictly necessary.
No system is invulnerable. Should a security breach occur that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and report it to the competent supervisory authority within 72 hours, in accordance with Articles 33 and 34 GDPR.
15 Children
This website and our services are aimed exclusively at professionals and businesses, and never at minors. We do not knowingly collect data from anyone under 18. If we find that we have received a minor's data without the authorisation of their parent or guardian, we will delete it immediately. If you are a parent or guardian and believe a child in your care has given us data, write to info@cogrowthai.com and we will erase it.
16 Changes to this policy
We may update this policy to reflect changes in our services, in the providers we use, or in applicable law. When we do:
- We will change the "Last updated" date shown at the top of this document.
- We will increment the version number.
- If the changes are substantial and significantly affect how we handle your data, we will notify you by email where we hold a valid address, with reasonable notice before they take effect.
We recommend reviewing this page periodically. Continued use of the site after an updated version is published means you are aware of it.
17 Contact
For anything relating to this policy, to how we handle your data, or to exercise your rights:
See also our Terms & Conditions, which govern the use of this website and our services.
Want to talk about your operation?
30 min · No commitment · Reply within 24h