Privacy policy

Version 1.0, October 2026

Who is responsible

Codiro BV, Balgweg 6, 1764 KB Breezand, the Netherlands, aron@codiro.io. For your own account data we are the controller. For the emails, tickets and contacts in your workspace, you are the controller and we are your processor (GDPR art. 28).

What we process

• Account: name, email, password (hashed), sign-in provider ID if you use Google or Apple.
• Workspace content: imported emails and attachments, contacts, replies, notes, saved replies, knowledge (websites, documents, notes).
• Usage: sign-in times, activity on tickets, and whether replies were opened (only when open tracking is on).

Where it is stored

On our own servers in the Netherlands (EU). Mailbox passwords and API keys are stored encrypted.

Sub-processors

• Anthropic (Claude AI), only when AI is enabled: email text and attachments are sent to classify, summarise, translate and draft replies. Anthropic does not use API data to train its models.
• Google / Apple, only if you choose to sign in with them.

How long

As long as your workspace exists. Deleted tickets are removed; deleting a workspace removes its data within 30 days, backups within 90 days.

Your rights

You can view, correct, export or delete your data. Email us; we answer within 30 days. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Security

Encrypted connections (HTTPS, TLS for mail), encrypted secrets, access only for your workspace members, and daily backups.