Privacy Policy

Who is responsible

Coffee CEO operates this service and decides how the data described below is used. You can reach us at contact@coffeeceo.ai for any question about this policy, and for any request under the sections below.

What we collect about you

Four things, and nothing beyond them.

• Your account: the email address you sign up with, and the password you choose — stored only as a cryptographic hash, never in readable form.
• Your company: the idea you describe, the name, the market, the offers and prices you settle on, and every document the service produces for you.
• Your usage: which screens you reach and which tasks you approve, so the service can show you an activity trail and so a failure can be explained.
• Your payments: what you bought and when. Card numbers never reach us — they go straight to Stripe, and we only see the result.

What we collect about the people your company contacts

When you use Coffee CEO to prospect, it holds the professional contact details of the businesses you target — a company name, a website, a professional email address — and the messages exchanged with them.

For that data, you are the one who decides what happens to it: we hold it on your behalf. We check that an address exists before writing to it, every message we send carries a working unsubscribe link, and an unsubscribe is honoured immediately and permanently.

Why we are allowed to hold it

Each kind of data rests on a different reason, and here they are.

• Your account and company data: because we cannot provide the service you asked for without it.
• Prospect data: because you have a legitimate interest in contacting other businesses about a professional offer — which is also why every message must let them stop it in one click.
• Error reports: because a service that cannot be debugged cannot be kept safe.

Who else sees it

We do not sell your data and we do not use it to train anyone's models. It is handled by the following providers, each only for the part they perform:

• Supabase (database, authentication and file storage, hosted in Paris, eu-west-3)
• Vercel (application hosting and delivery)
• Trigger.dev (background execution of the work you ask for)
• Anthropic, OpenAI and Google (the models that draft and review your documents)
• Stripe (payments, and the payouts of what your own clients pay you)
• OVH (domain names and the professional mailbox we set up for your company)
• Tavily (web research used to study your market)
• Enrow and MillionVerifier (checking that a prospect's email address exists before we write to it)
• Sentry (error reports, so a crash can be fixed)

Your data is stored in the European Union. Some of the model providers above process a request outside the EU; only the content needed to answer that request is sent, and none of it is retained to train a model.

How long we keep it

Nothing is kept indefinitely, and nothing is kept in secret.

• Your account and everything attached to your company: for as long as your account exists.
• Deleted content: removed for good, not hidden. Deletion is irreversible and we will say so before you confirm it.
• Error reports: kept for a limited period and then discarded automatically.
• Records we are required to keep — invoices, and the proof that someone unsubscribed — are kept for as long as the law requires, and no longer.

Your rights, and the button that exercises them

You can ask for a copy of everything we hold about you, correct it, or have it erased. You can also object to a particular use, or ask us to restrict it.

Two of those do not need to go through us at all: Settings → Personal data, inside the app, exports your data and files an erasure request directly. Every request is written to an append-only journal, so you can see what happened and when.

For anything else, write to contact@coffeeceo.ai. If you believe we have handled your data wrongly, you can also complain to your national data protection authority — in France, the CNIL.

Cookies

Coffee CEO sets the cookies that keep you signed in, and nothing else. There is no advertising cookie and no third-party tracker, which is why you are not asked to accept anything on arrival.

The websites Coffee CEO builds for you follow the same rule: they count a visit, a form seen and a form sent, without any personal data and without any identifier that follows a visitor around.

Changes

If this policy changes in a way that affects you, we will tell you before it takes effect. The date at the top of this page always says when it was last changed.