What we collect, and what we do with it.

01What this covers

This policy applies to the Cordanis application and website at cordanis.com, operated by Cordanis. It covers the people who sign in to Cordanis (sellers, managers, and administrators at customer organizations) and the data those people bring into their workspace or connect through third-party sources.

Cordanis is used by organizations. If you use Cordanis through your employer, your employer is the customer and decides what data is connected, who can see it, and when it is deleted. This policy describes how Cordanis, as the provider, handles that data.

02Information we process

• Account data. Your name, work email address, and organization, collected when your account is created or you are invited. Authentication is handled by Amazon Cognito; Cordanis never stores your password.
• Workspace data. Accounts, contacts, notes, research, documents, and messaging that you or your organization upload, write, or generate inside Cordanis. When you dictate a message or record a meeting, the audio is turned into text and the audio itself is not kept; a meeting's transcript is saved under its account.
• Connected source data. Data read from services you choose to connect, such as Google Workspace (Gmail and Calendar), Microsoft Outlook, Salesforce, HubSpot, Zoho CRM, Slack, Granola, and Apollo. Sections 03 and 04 describe this in detail.
• Cordanis keeps an Assistant record for each request to the Assistant, and for each piece of work it does in the background, such as a routine. The record holds what every AI model call was sent and answered and what every tool read or returned, with passwords, keys, and access tokens removed. It can hold the email, calendar, CRM, and document content the request used. It is stored in your organization's workspace on AWS, beside the conversation it belongs to, and is used to show you what a run did and to investigate problems. A shorter list of each request's steps, which can include search terms and file names, is kept in our database and our AWS storage. Section 07 says how long each is kept.
• Usage and operational data. Request logs, run events, error reports, and timing. Operational logs carry identifiers, status, and timestamps, and do not contain message bodies, file contents, prompts, tokens, or credentials.

Cordanis does not use advertising trackers on the application and does not sell personal information.

03Google user data

When you connect a Google account, Cordanis requests only the scopes it needs for the features you enable:

• Cordanis uses Google user data only to provide and improve the features you see in the product for your own use. It does not use Google user data for advertising, does not sell it, and does not transfer it to third parties except as needed to provide the service (the AWS infrastructure the service runs on, including its web search, and the AI model providers named in sections 05 and 06 that do the work you ask for), to comply with law, or with your explicit consent.
• People at Cordanis do not read your Gmail or Calendar data. The exceptions are the ones Google permits: you send us a feedback report that includes a request, it is needed to investigate a bug or abuse, it is needed to comply with law, or the data has been aggregated and anonymized for internal operations. Each time someone at Cordanis opens a request to investigate, it is logged.
• Cordanis does not use Google user data to train artificial intelligence or machine learning models, and does not send it to an AI model whose provider's terms allow training on it. When you ask the Assistant about an email or a meeting, or Cordanis prepares a meeting brief, the Gmail or Calendar content that work needs is sent to the AI model doing it, on Amazon Bedrock or through Vercel AI Gateway. Every request through Vercel asks it to use only providers that do not train on prompts. Section 05 names each company.
• When you press “Look it up” on a meeting guest the brief could not place, Cordanis searches the web for that person's name and company with the web search in our AWS environment. Nothing else from your calendar goes with it, and it is never sent to Parallel, the research search company named in section 06.
• Access and refresh tokens for your Google account are held in an encrypted credential vault inside our AWS environment (Amazon Bedrock AgentCore Identity), scoped to your user. They are never written to logs, never sent to the browser, and never exposed to the language model.
• Cordanis may read on your behalf while you are away, for example to prepare your daily plan before you sign in. Those runs use the same grant you gave when you connected, act only as you, and are logged as runs you can inspect.
• You can revoke access at any time from your Google Account security settings or by disconnecting Google in Cordanis. Revocation takes effect on the next read.

Cordanis' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

04Other connected sources

• Microsoft Outlook is read with your own Microsoft login to find replies and show your meetings, the same way as Gmail and Google Calendar. Cordanis sends a message or changes an invite only after you approve it.
• Salesforce, HubSpot, and Zoho CRM are read with your own login and permissions. Cordanis writes to your CRM only with your approval: a specific change you approve, or, when your administrator allows it, your own switch to log your email to the CRM. Each logged email waits ten minutes with an Undo before it is written.
• Slack is searched and read with your own Slack login when you ask about a conversation. Cordanis sees only the channels and messages you can already see.
• Granola is connected at the organization level by an administrator. Meeting notes and transcripts are read into the accounts they belong to.
• Apollo. Connected at the organization level by an administrator; used to find and enrich contacts and accounts. Actions that spend your organization's Apollo credits require an approval.
• Web search. Public web results used for account research, through the search companies named in section 06. No personal data from your workspace is sent as a query without your instruction.

Each connected source uses least-privilege scopes and can be disconnected in Cordanis or revoked at the provider at any time. The providers you connect process your data under their own terms when Cordanis calls them on your behalf.

05How AI processing works

• Cordanis does not train models on your data, and it sends AI requests only to providers whose published terms say they do not train on them either. Its AI features run on models from Anthropic and OpenAI, reached in one of two ways: through Amazon Bedrock inside our AWS environment, or through Vercel AI Gateway, which passes each request to a company that serves that model. Through Vercel, a Claude request is served by Anthropic, Amazon Bedrock, Google Vertex AI, or Claude Platform on AWS, and a GPT request by OpenAI, Microsoft Azure, or Amazon Bedrock. Every request through Vercel asks it to use only providers that do not train on prompts, and fails rather than go to one that might.
• Which model does which work, by default: the Assistant, and the background work it does for you (routines, account summaries, and your organization's profile), runs on Claude Sonnet 5.5 through Vercel. Meeting briefs and reading facts out of transcripts, documents, and records use Claude through Vercel.
• When an account is added, OpenAI's GPT reads the company's own website and public job postings and writes its profile, through Vercel. When that read leaves your organization's questions about the account unanswered, it also searches the web through Parallel. If a profile cannot be written that way, a shorter one is written by Claude Haiku 4.5 on Amazon Bedrock. Once for each organization, Claude Opus 5.5 plans what research should look for, from your organization's profile, through Vercel. A full research brief, when you ask for one, uses GPT to gather public sources and Claude to write it, through Vercel. Finding a company's website from its name, and a person's title from web results, use Claude through Vercel.
• Voice dictation and meeting recordings are turned into text by OpenAI. Cordanis sends the audio, and for a meeting the names of the account and its people so the transcript spells them correctly. The audio is not kept by Cordanis.
• What these companies' published terms say: Vercel says AI Gateway does not use prompts or responses for training and deletes them once a request is completed; it keeps each request's metadata, such as the model, the provider, and the tokens used, for 30 days. Anthropic's commercial terms say it may not train models on customer content. OpenAI says data sent to its API is not used to train its models unless the customer opts in, and that it keeps abuse monitoring logs of API requests for up to 30 days; audio sent for transcription is not kept in those logs. Amazon says content sent to Amazon Bedrock is not used to train models and is not shared with model providers. Vercel's list of providers that do not train on prompts includes Anthropic, Amazon Bedrock, Google Vertex AI, Claude Platform on AWS, OpenAI, and Microsoft Azure.
• An administrator can turn on more models for their organization, and each one is off until an administrator turns it on. They include other Claude and GPT models and models from Z.ai (GLM), Meta (Muse Spark), and Alibaba (Qwen). They run on Amazon Bedrock or through Vercel under the same rule: only providers that do not train on prompts.
• The Assistant's general toolbelt is read-only. Sending email, changing CRM records, enrolling contacts in outreach, and other actions with outside effects are separate server operations that run only after a person confirms them, or under a standing switch that person turned on, such as logging their email to the CRM.
• Every tool call the Assistant makes produces a run event you can inspect: which tool, which target, and the result.

06Storage, security, and subprocessors

• Customer data is stored in private, tenant-scoped storage on Amazon Web Services in the United States, encrypted in transit and at rest.
• Access to production systems is limited to Cordanis engineers who need it to operate the service, under individual credentials and audit logging.
• Subprocessors are the companies Cordanis itself chooses to help run the service. Each one receives only what its job needs. They are listed in the table below. The providers you connect (section 04) are not on this list; they process your data under their own terms when Cordanis calls them on your behalf.

• Cordanis also reads public web pages, such as an account's own website, the public job board it links to, and pages a web search found. Those requests carry only the page's web address.
• Website analytics: on our public pages and the sign-up and sign-in pages, we count visits with PostHog, without cookies and without storing anything in your browser. We see which pages are read and which site or post a visit came from. Of a page's web address we send only the page and a post's campaign tags, so no email address, invitation link or ad click id reaches it, and no names are sent. It does not run on invitation pages.
• Product analytics: inside the Cordanis application we use PostHog to see where the product works and where it gets in the way: which steps of the first run are finished, which screens are used, where clicks do nothing, and which errors appear. You are known to PostHog by a code made from your user id, never by your name or email address, and nothing is stored in your browser. Session replays show the layout of a screen and where you clicked; every piece of text and everything you type is masked, and images are left out, so no account, contact, email or note can be seen in one. Named events carry kinds and counts, such as “a mailbox was connected” or “12 accounts were added”, never their content. This is used only to improve Cordanis, and it is never shown to your employer or your organization.
• For the full description of our security controls, see Trust & controls.

07Retention and deletion

• Workspace data is kept for as long as your organization's account is active. When an organization closes its account, its data is deleted within 30 days, except where law requires a longer hold.
• Cordanis does not copy your mailbox or calendar into its own storage. It keeps message details and derived signals for the daily plan and meeting details for briefs. Message content is kept only where a feature used it: in an Assistant conversation and its record when you asked about a message, in a meeting brief, or in an account's notes.
• Assistant conversations and their records (section 02) are kept while your organization's account is active. Archiving a conversation hides it but does not delete it or its record. To have them deleted sooner, write to us at the email address below. The shorter list of each request's steps is deleted after 90 days.
• Disconnecting a source stops all further reads immediately. Revoking at the provider does the same. On request, Cordanis deletes data previously read from that source.
• Operational logs are retained for 90 days.

08Your choices

• Disconnect any source from Settings in Cordanis.
• Revoke Google access from your Google Account at myaccount.google.com/permissions.
• Ask us to export or delete your personal data, or your organization's data, at the email address below. We answer within 30 days.

09Changes to this policy

When this policy changes, the effective date at the top changes with it and the previous version is available on request. Material changes to how connected source data is used are announced to organization administrators before they take effect.

October 31, 2026: This version names each company Cordanis uses that receives customer data, and what each one receives. The version effective September 20, 2026 said AI ran only through Amazon Bedrock and named only Amazon Web Services and PostHog as subprocessors. That was incomplete: some AI features already ran through Vercel AI Gateway on Anthropic and OpenAI models, dictation and meeting audio already went to OpenAI, and web search, contact data, payments, and emails already used Parallel, treg, Stripe, and Resend. It also said operational data never held prompts or message content, and Cordanis keeps the Assistant records described in sections 02 and 07. With this version, Cordanis also stopped sending a meeting guest's name and company to Parallel, made every request through Vercel ask for providers that do not train on prompts, and removed an optional model, Meta's Muse Spark 1.3 Contributor, whose terms let Meta train on what it is sent.

10Contact

Questions, requests, and complaints about privacy: support@cordanis.com.