COREWORKS AI INC ("Coreworks," "we," "our," or "us") respects your privacy. This Policy explains how we collect, use, disclose, and protect personal information when you visit coreworks.ai or use our Service. It covers visitors to our website and users of our platform. For personal data we process on behalf of our customers as part of Customer Data, we act as a processor or service provider, and our customer's own privacy policy and our Data Processing Agreement govern that processing.
1. Information We Collect
We may collect the following types of information:
Account and contact data
- Name, work email, company, role
Usage data
- Log data, device and browser information, IP address
- Feature usage, pages visited, and interactions on our site
Customer Data
- Data you connect or submit to the Service to be queried or analysed, including your business's financial and operational data, which may include personal data of your own end users
Payment data
- Processed entirely by Stripe. We do not store card numbers or any payment instrument details
Cookies and analytics
- We use cookies and analytics tools for website and product analytics
2. How We Use Information
We use your information to:
- Provide, secure, and improve the Service
- Authenticate users and manage accounts
- Process payments
- Communicate with you about updates, access, and support
- Comply with legal obligations
- Detect and prevent abuse
We do not sell personal information.
3. AI Processing
We use AI and large language models to deliver the Service.
- We do not use Customer Data to train foundation models. Your Customer Data is never used to train general-purpose AI models and is never used to benefit other customers.
- Our AI model providers act as subprocessors under contractual confidentiality and no-training terms.
4. How We Share Information
We share information with service providers that help us run the Service, under appropriate agreements. These include:
- Cloud hosting and infrastructure
- Database hosting
- Email and productivity tools
- Payment processing
- AI model providers
- Customer relationship management and sales and marketing tools
We may also disclose information to comply with law or protect legal rights, and in connection with a merger or acquisition.
5. Google User Data
Coreworks connects to Google services only when you explicitly choose to connect one, and only after you grant access through Google's own OAuth consent screen. This section describes how we access, use, store, and share Google user data.
Scopes we request and why
- Google Drive (drive.file) — read only the individual files you select yourself in the Google file picker. We cannot see any other file in your Drive.
- Google Analytics (analytics.readonly) — read-only access to list the GA4 properties you have access to and run the reports you choose. We cannot modify your Analytics configuration.
- Google Ads (adwords) — read the report data for the Google Ads accounts you select. Google publishes no read-only Ads scope, so this is the narrowest scope available; we only issue read requests.
- BigQuery (bigquery) — list the projects, datasets, and tables you have access to, and run the read-only queries you write. We do not create, modify, or delete your data. Google's narrower bigquery.readonly scope cannot run a query at all, so this is the minimum scope that works.
- Email address (userinfo.email) — identify which Google account a connection belongs to, so you can tell your connections apart and disconnect the right one.
How we use Google user data
- We fetch only the data you request, at the time you request it, to produce the spreadsheets, reports, and presentations you ask for
- Imported data lands only in your own Coreworks workspace and is visible only to you and the people you share that workspace with
- We use it for no other purpose — no cross-user analysis, no aggregation, no enrichment
How we store Google user data
- OAuth tokens are held encrypted by our authentication provider and are used only to make the API calls described above
- Imported data is stored encrypted in your workspace and is retained until you delete it, or in line with section 7 below if you close your account
- Deleting an imported file, or disconnecting the source, removes the corresponding data from your workspace
What we never do
- We never sell Google user data
- We never use Google user data for advertising, or transfer it to advertising platforms, data brokers, or information resellers
- We never use Google user data to train, retrain, or improve generalized or shared AI/ML models
- We never allow humans to read Google user data, except with your explicit consent for a specific support request, where required by law, or where necessary for security or to comply with applicable law
Limited Use
Coreworks' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Revoking access
You can disconnect a Google source at any time from the connections area of the Coreworks app, which deletes the stored token. You can also revoke Coreworks' access directly from your Google account at myaccount.google.com/permissions. To have imported data deleted, contact us at privacy@coreworks.ai.
6. Data Location
Coreworks is based in the United States. Your information is processed and stored in the United States.
7. Data Retention
We retain account and usage data for as long as needed to provide the Service and for legitimate and legal purposes.
We retain Customer Data for up to 90 days after account closure, to allow you to export and recover it, then delete or anonymise it, unless a longer period is required by law.
8. Security
Consistent with industry-standard practices, we maintain administrative, technical, and physical safeguards, including encryption in transit and at rest, access controls, and monitoring.
We rely on third-party service providers to operate the Service and cannot guarantee the uninterrupted availability, security, or performance of those providers.
9. Your Rights
California residents have rights under the CCPA and CPRA to access, correct, delete, and port their personal information, to opt out of certain processing, and to non-discrimination for exercising these rights. Residents of other US states may have similar rights under applicable law.
You may also opt out of our marketing communications at any time.
To exercise any right, contact us at privacy@coreworks.ai.
10. Cookies and Tracking
We use cookies and similar technologies for functionality, analytics, and preferences. You can control cookies through your browser settings.
11. Third-Party Links
Our website may contain links to third-party sites. We are not responsible for their privacy practices.
12. Children
The Service is not directed to individuals under 18, and we do not knowingly collect their data.
13. Changes to This Policy
We may update this Policy. We will post the new effective date on this page and, for material changes, provide notice.
14. Contact
If you have questions about this Privacy Policy, contact us at: