Privacy Policy

1. Scope

This Privacy Policy applies to: website visitors; customers and prospective customers; workspace admins and authorised users; individuals who contact us; individuals whose data may appear in records uploaded to or processed through the Services; and users interacting with our AI, GPT, bot, automation, or messaging features.

Where we process data on behalf of a business customer, that customer may act as the primary party deciding why and how such data is used, and our processing may also be governed by separate contractual terms.

2. Information We Collect

Depending on how you use the Services, we may collect the following categories of data:

A. Identity and Contact Information: Full name; business name; phone number; email address; address; job title; billing details; and business registration details.

B. Account and Workspace Information: Usernames; login identifiers; hashed passwords or authentication credentials; workspace details; organisation profile details; and user roles and permissions.

C. Financial and Business Information: Invoices; receipts; purchase records; statements; ledger entries; transaction records; reconciliation data; GST, VAT, tax, or similar compliance-related records; payout or disbursement information; reporting data; and other finance and accounting records made available through the Services.

D. KYC, Verification, and Compliance Information: Where relevant, we may collect: business registration details; tax registration numbers; authorised signatory details; compliance documents; and verification records.

E. Technical and Usage Information: IP address; browser type; operating system; app and device information; crash logs; session activity; timestamps; feature usage data; and cookies and similar technologies.

F. Communications: Support tickets; emails; chatbot interactions; feedback; call notes; survey responses; and in-app messages.

G. Integration Data: Information received from third-party systems you connect to Co-book, such as: accounting platforms; ERP systems; CRMs; banks; payment tools; messaging tools; email systems; cloud storage tools; automation services; and other approved software.

H. AI / GPT Interaction Data: Prompts; instructions; user queries; task requests; uploaded files or text sent to AI-enabled features; extracted data; generated summaries; recommendations; classifications; suggested replies; and feedback on AI outputs.

I. Messaging and WhatsApp Data: Phone numbers; WhatsApp identifiers; message content; message templates used; delivery or read metadata where available; timestamps; opt-in records; opt-out or blocked state records; messaging history; notification logs; and campaign or communication preference records.

3. How We Collect Information

We collect data: directly from you when you sign up, contact us, upload files, book demos, use workflows, or use messaging features; automatically through your use of the Services; from integrations and third-party systems enabled by you; from communication activity with us; and from authorised partners, service providers, or publicly available business sources where lawful.

4. How We Use Information

We may use information for the following purposes: to provide, maintain, operate, and improve the Services; to create and manage accounts and workspaces; to process uploaded files, records, and workflows; to enable bookkeeping, reporting, analytics, compliance-support, reconciliations, and dashboards; to support AI, GPT, bot, and automation features; to personalise the user experience; to send support, operational, utility, onboarding, notification, reminder, and where applicable promotional communications; to operate WhatsApp or messaging features; to verify users, maintain logs, and provide customer support; to prevent fraud, abuse, spam, unauthorised access, and misuse; to test, audit, monitor, and troubleshoot the Services; to enforce our Terms and protect our rights; to comply with legal, contractual, tax, accounting, security, and regulatory obligations; and to conduct internal analytics using aggregated or de-identified data.

5. Basis of Processing

We process personal data where lawful, including: with consent, where consent is required; to provide the Services requested by you or your organisation; to perform contractual obligations; to comply with legal obligations; and for reasonable and lawful operational purposes connected with running, securing, and improving the Services.

6. Cookies and Similar Technologies

We may use cookies, tags, pixels, SDKs, local storage, and similar technologies to: keep users signed in; remember preferences; understand usage patterns; improve security and performance; and measure feature or campaign effectiveness.

You may be able to manage cookies through your browser settings, but disabling some technologies may affect functionality.

7. How We Use AI / GPT-Related Data

We may use AI, GPT, OCR, model-based, or automation-related data to: provide co-pilot, chatbot, assistant, and conversational features; extract and structure information from business records; generate summaries, drafts, explanations, or replies; support document understanding; automate workflows; detect anomalies or exceptions; assist users through bots or guided interactions; and improve quality assurance, abuse prevention, and platform reliability.

8. Automated Processing Notice

Some Co-book features may use automated tools, machine learning, OCR, rules engines, language models, and bot workflows to: analyse data; classify records; generate recommendations; draft communications; respond to user prompts; and assist in workflow execution.

These features are intended to support human decision-making and operational efficiency and should not be treated as a substitute for professional judgment, tax advice, legal advice, audit review, or statutory review.

9. WhatsApp and Messaging Data Use

We may use messaging and WhatsApp-related data to: send service, support, utility, reminder, onboarding, verification, workflow, and notification messages; respond to inbound queries; provide bot-driven assistance; maintain communication logs; monitor message delivery or performance where available; comply with platform rules; prevent spam, abuse, and fraud; and manage campaign or communication preferences.

10. Legal Basis / Permission for Messaging

Where required, Co-book relies on the permissions, opt-ins, or instructions provided by you or your organisation to send WhatsApp or similar messages.

If you use Co-book to message customers, leads, employees, vendors, or other contacts, you are responsible for ensuring that a valid legal and platform basis exists for such communication.

11. Message Preferences and Opt-Outs

Where applicable, we may maintain records of: communication preferences; unsubscribe requests; opt-out choices; blocked states; template restrictions; and other messaging preferences to help respect future communication restrictions and comply with legal or platform requirements.

12. Sharing of Information

We may share information with:

A. Service Providers and Subprocessors: Cloud hosting providers, analytics vendors, messaging providers, customer support vendors, OCR vendors, AI providers, automation tools, security partners, payment processors, and infrastructure providers who process data on our behalf.

B. Third-Party Integration Partners: Software or services you connect to Co-book, where sharing is required to provide the requested integration or workflow.

C. AI, GPT, OCR, and Automation Providers: Approved third-party providers that help us deliver AI-enabled, document-processing, chatbot, automation, classification, drafting, or summarisation features.

D. Messaging and Communication Providers: WhatsApp Business Platform partners, SMS providers, email delivery providers, communication API tools, and similar messaging vendors.

E. Affiliates and Group Entities: Where necessary for support, billing, internal administration, or operations.

F. Professional Advisers: Lawyers, auditors, insurers, consultants, accountants, or similar advisers under suitable confidentiality obligations.

G. Legal and Regulatory Authorities: Where required by law, court order, legal process, regulatory request, or to protect rights, prevent fraud, investigate misuse, or respond to security incidents.

H. Business Transfers: In connection with a merger, acquisition, financing, restructuring, sale of assets, or similar transaction, subject to appropriate protections.

13. Cross-Border Transfers

Your information may be stored or processed in India and in other countries where our service providers, subprocessors, AI providers, cloud providers, analytics vendors, or messaging vendors operate.

Where this occurs, we take reasonable steps to require suitable contractual and operational safeguards in accordance with applicable law and our internal security standards.

14. Data Retention

We retain information only for as long as necessary for the purposes described in this Privacy Policy, including: to provide the Services; to maintain records, audit logs, and service integrity; to comply with contractual, legal, regulatory, accounting, tax, and security obligations; to resolve disputes and enforce agreements; and to detect, investigate, and prevent fraud or misuse.

Different categories of data may be retained for different periods depending on business needs, legal requirements, technical constraints, and contractual terms.

15. Third-Party Provider Retention and Controls

Retention periods and processing settings for third-party AI, automation, messaging, hosting, or analytics providers may vary depending on the provider and service configuration in use.

Where such providers process information on our behalf or as part of an enabled feature, their internal technical controls, retention periods, and subprocessors may apply in addition to our own practices.

16. Data Security

We use reasonable technical, organisational, administrative, and contractual safeguards designed to protect information against unauthorised access, misuse, alteration, loss, or disclosure.

These may include: access control; role-based permissions; authentication measures; encryption in transit and, where applicable, at rest; audit logging; monitoring and alerting; secure development practices; backups and recovery procedures; vendor due diligence; and restricted internal access.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

17. Personal Data Breach Response

If we become aware of a personal data breach or security incident affecting information under our control, we may take steps such as: containment; investigation; remediation; internal escalation; notifying affected customers or individuals where required; and notifying regulators or authorities where required by law.

18. Your Rights

Subject to applicable law and the nature of our role in processing the data, you may have the right to: request access to your personal data; request correction or updating of inaccurate data; request deletion or erasure, subject to lawful retention requirements; withdraw consent where processing is based on consent; seek grievance redressal; and contact our privacy or grievance contact for questions.

To exercise your rights, contact: hello@co-book.com

19. Children's Privacy

The Services are intended for businesses and authorised adult users. We do not knowingly provide ordinary business Services directly to children. If we become aware that data of a child has been collected contrary to applicable law, we may take appropriate steps to delete or restrict such information.

20. Third-Party Links and Services

Our website, platform, or communications may contain links to third-party websites, apps, or services. We are not responsible for the privacy, security, or content practices of those third parties.

21. Grievance / Privacy Contact

For questions, requests, complaints, or concerns relating to privacy or personal data, please contact:

22. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted on our website, app, dashboard, or otherwise communicated to you, together with a revised "Last Updated" date.

Your continued use of the Services after the effective date of the updated Privacy Policy constitutes acknowledgement of the updated version.

23. Contact Us