Coactra ("we," "our," or "us") prepared this Privacy Policy to explain how we collect, use, and disclose information about you when you use our platform at app.coactra.com, our marketing website at coactra.com, and related services (collectively, the "Services").
1. Information We Collect
We collect information from you in several ways depending on how you interact with the Services:
a. Account and Registration Information
When you create an account, we collect identifiers such as your name and email address, and information from third-party authentication providers (Google, Microsoft) if you use OAuth sign-in.
b. Your Content and Data
"Content" means all data, records, files, configurations, and other information you upload, create, import, or store through the Services. This includes data you connect from third-party services via integrations. You own and control all Content you create, subject to these Terms.
c. Usage and Activity Information
We collect information about how you use the Services, including: automation run history, feature usage patterns, error logs, and timestamps of your activity. This helps us provide, maintain, and improve the Services.
d. Billing Information
When you subscribe to a paid plan, our payment processor collects your payment details. We retain only non-sensitive billing identifiers (such as subscription status and transaction references) necessary to manage your account.
e. Technical and Device Information
We automatically collect technical information when you visit the Services, including your IP address, browser type, operating system, and device identifiers. We use this information for security monitoring, abuse prevention, and service improvement.
f. Communications
When you contact us for support, submit help requests through the platform, or communicate with our team, we retain those communications and any information provided within them.
2. How We Use Your Information
We use the information we collect to:
- Provide and operate the Services — running automations, processing your data, generating reports, enabling connections, and delivering features you use
- Process payments and manage subscriptions — billing, invoicing, and account management
- Communicate with you — sending transactional emails (automation results, invoices, security alerts, account notifications)
- Provide support — responding to inquiries and resolving issues
- Ensure security and prevent abuse — detecting fraudulent activity, unauthorized access, and violations of our Terms
- Improve the Services — analyzing usage patterns to improve features, fix bugs, and develop new capabilities
- Comply with legal obligations — responding to lawful requests, enforcing our Terms, and protecting our rights
We do not sell your personal information. We do not use your Content for advertising. We do not use your Content to train AI models without your explicit consent.
3. AI-Powered Features and Third-Party Providers
a. AI Service Providers
When you use AI-powered features (such as qualification, scoring, analysis, drafting, or the AI assistant), your Content or portions of it may be processed by third-party AI service providers. We use established providers that offer API-based processing with contractual terms prohibiting the use of your data for model training or their own purposes.
A complete list of AI providers is available to customers on request via privacy@coactra.com.
b. Data Enrichment Services
When you use data enrichment features (such as company research, contact discovery, or job signal tracking), we send limited identifiers (such as company name or domain) to third-party data enrichment providers. These providers return publicly available business information. They do not receive access to your full workspace data.
A complete list of enrichment providers is available to customers on request via privacy@coactra.com.
c. Opting Out
You can disable AI features and data enrichment from your workspace settings at any time. Disabling these features will prevent any data from being sent to third-party providers.
4. Operator Access to Your Workspace
When you request human operator assistance, you explicitly grant a Coactra operator access to specific workspaces you designate. This access is:
- Initiated only by your deliberate action (clicking "Grant Access")
- Limited to the workspaces you specify — not your entire account
- Time-limited — automatically expires at the end of the engagement
- Recorded — every action the operator takes is logged in an immutable audit trail visible to you
- Revocable — you may revoke access immediately at any time from your settings
Operators access your workspace solely to fulfill your service request. Information accessed during service delivery is treated as confidential and is not used for any other purpose.
5. How We Share Information
We share information only in the following circumstances:
- Service providers — We use trusted third-party providers to help operate the Services (such as payment processing, email delivery, and infrastructure). These providers are contractually bound to use your data only to perform services for us.
- Third-party integrations you connect — When you connect external tools (such as HubSpot, Shopify, Google Sheets), data is shared with those services as directed by you through automations or manual actions you configure.
- Legal requirements — We may disclose information when required by law, legal process, or to protect the rights, privacy, safety, or property of you, us, or others.
- Business transfers — In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.
- With your consent — We may share information for other purposes with your explicit permission.
6. Data Isolation, Security, and Breach Notification
a. Data Isolation
Each customer account has its own isolated database environment. Your data is physically separated from other customers' data at the infrastructure level. No application error or query can expose your data to another customer.
b. Security Measures
We implement technical and organizational measures designed to protect your information, including:
- TLS encryption for all data in transit
- AES-256 encryption for data at rest
- Multi-factor authentication (MFA) available for all accounts
- Role-based access controls within workspaces
- Automatic daily backups with 30-day retention
- Infrastructure-level DDoS protection
- Regular security monitoring and logging
No system is completely secure, and we cannot guarantee absolute security.
c. Data Breach Notification
In the event of a data breach that affects your personal information or Content, we will:
- Notify supervisory authorities within 72 hours where required by GDPR or other applicable laws
- Notify you directly within 24 hours of confirming the breach via email to your registered account email
- Provide details including: nature of the breach, categories of data affected, likely consequences, and remedial measures taken
- Post a public notice at coactra.com/security if the breach affects multiple customers
We maintain an incident response plan and conduct regular security reviews to minimize breach risk.
d. Security Contact
To report a security vulnerability, contact: security@coactra.com
7. Data Retention
We retain your information for as long as necessary to provide the Services and fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law.
- Active accounts — data retained for the duration of your subscription
- After cancellation — your workspace data remains accessible for 30 days, then is permanently deleted
- Soft-deleted records — billing records, payment receipts, invoices, and legal records are archived (not deleted) to comply with financial regulations and to establish/defend legal claims. Personal identifiers in these records are retained only as necessary for these purposes.
- Data snapshots — retained for 7 to 90 days depending on your plan, then automatically deleted
- Operator audit logs — retained for 2 years for legal compliance and security purposes, then deleted
- Billing and payment records — retained for 7 years as required by applicable financial regulations (tax, accounting, anti-money laundering)
If you request deletion of your personal information under data protection laws, we will delete or anonymize your data except where retention is required by law (e.g., billing records for tax compliance).
8. Cookies and Tracking Technologies
We use cookies and similar technologies on our websites and platform. Types of cookies we use:
- Strictly necessary cookies — Required for authentication, security, and core platform functionality. These cannot be disabled without breaking the Services.
- Analytics cookies — We use analytics tools to understand how visitors interact with our marketing website (coactra.com). This helps us improve our content and understand what features matter to users. These cookies are only placed with your consent.
- Marketing cookies — If you arrive from a marketing campaign, cookies may be used to measure the effectiveness of that campaign. These are only placed with your consent.
You can manage your cookie preferences through our Cookie Settings panel. Note that disabling certain cookies may affect the functionality of the Services.
9. International Data Transfers
The Services are operated from servers in the European Union. If you access the Services from outside the EU, your information may be transferred to and processed in a different jurisdiction. Where required by law, we rely on appropriate legal mechanisms (such as standard contractual clauses) for such transfers.
10. Your Rights and Choices
a. General Rights
Depending on where you live, you may have rights regarding your personal information, including:
- Access — Request a copy of the personal information we hold about you
- Correction — Request correction of inaccurate information
- Deletion — Request deletion of your account and personal information
- Export — Export your Content data from within the platform
- Restrict processing — Request that we limit how we use your information
- Object — Object to processing based on legitimate interests
- Opt out of marketing — Unsubscribe from marketing emails at any time
b. Your Privacy Rights (All Users)
Regardless of where you live, you have rights regarding your personal information. The specific rights and how you exercise them may vary by jurisdiction:
Rights Available to All Users:
- Access — Request a copy of the personal information we hold about you
- Correction — Request correction of inaccurate information
- Deletion — Request deletion of your account and personal information
- Export — Export your Content data from within the platform
- Restrict processing — Request that we limit how we use your information
- Object — Object to processing based on legitimate interests
- Opt out of marketing — Unsubscribe from marketing emails at any time
Additional Rights by Jurisdiction:
- EU/EEA/UK (GDPR & UK GDPR): Right to data portability, right to object to automated decision-making, right to lodge a complaint with your supervisory authority
- Canada (PIPEDA): Right to know what personal information we hold, right to challenge completeness and accuracy
- California (CCPA/CPRA): Additional rights detailed below
- Other jurisdictions: We honor equivalent rights under applicable local data protection laws
Categories of Personal Information We Collect:
- Identifiers: Name, email address, IP address, device identifiers
- Commercial information: Subscription details, payment history, usage records
- Internet activity: Browsing history on our site, feature usage, automation run logs
- Professional information: Company name, job title (if provided)
- Inferences: Usage patterns, preferences derived from activity
Categories of Third Parties We Share With:
- Infrastructure providers: Cloud hosting, storage, and backup services
- Payment processors: Subscription billing and transaction processing
- Email delivery services: Transactional and account-related emails
- AI service providers: Used only when you enable AI features
- Data enrichment providers: Used only when you enable enrichment features
- Integrations you connect: CRM, email, calendar tools you explicitly authorize
A complete list of specific third-party providers is available to customers on request via privacy@coactra.com.
Retention Periods:
- Account information: Duration of subscription + 30 days
- Content data: Duration of subscription + 30 days, then permanently deleted
- Operator audit logs: 2 years for legal compliance
- Billing records: 7 years (required by financial regulations)
- Marketing data: Until you unsubscribe or request deletion
Your CCPA/CPRA Rights:
- Right to Know: Request details about the personal information we collect, use, disclose, or sell
- Right to Delete: Request deletion of your personal information (subject to legal retention requirements)
- Right to Correct: Request correction of inaccurate personal information
- Right to Opt-Out: We do not sell personal information, but you can opt out of AI/enrichment processing
- Right to Non-Discrimination: We will not discriminate against you for exercising your rights
- Right to Limit Sensitive Personal Information: We do not use sensitive PI for purposes other than service delivery
Sale of Personal Information: We do not sell your personal information and have not sold personal information in the preceding 12 months. See our Do Not Sell My Personal Information page.
Sensitive Personal Information: We do not knowingly collect or process sensitive personal information as defined by CPRA (e.g., precise geolocation, health data, financial account credentials).
c. Exercising Your Rights
To exercise any privacy rights:
- Email: privacy@coactra.com
- Subject line: "Privacy Request - [Your Request Type]"
- Include: Your account email, specific request, and verification details
We respond within 30 days (45 days for CCPA requests if needed). We may require verification of your identity before fulfilling requests.
Authorized Agent: You may designate an authorized agent to submit requests on your behalf. The agent must provide written authorization from you. This right is available to all users, not just California residents.
11. Children's Privacy
The Services are not directed to children under 16 years of age. We do not knowingly collect personal information from children under 16. If we learn that we have collected information from a child under 16, we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify active users of material changes via email at least 30 days before they take effect. The updated policy will be posted at this URL with a revised effective date.