Privacy Policy

The short version. For the data your company puts into Coding Cords, your company decides and we are its processor. For your account, our website and billing, we decide and we are the controller. We collect what we need to run the service, we do not sell personal data, we use no advertising or tracking cookies, and we do not train AI on your data. Our servers are in the EU, but our team works from Pakistan and some providers (AI, phone, payments) work from the US, so your data does not stay only in the EU; we protect those transfers with standard contracts. Write to privacy@codingcords.com about anything to do with your data.

1. Who we are

Coding Cords, Bahria Enclave, Islamabad, Pakistan ("Coding Cords", "we"). Privacy contact: privacy@codingcords.com.

We have not appointed a data protection officer; privacy@ reaches the people responsible. Because we are based outside the EU and the UK, the GDPR and UK GDPR ask us to name a representative in each. We are appointing them now; until they are named on this page, privacy@codingcords.com handles every request from the EU and the UK.

2. Two roles

• Processor. Everything your company and its people put into the workspace: files, mail, chat, meetings, recordings and transcripts, CRM contacts and leads, invoices, payroll, signed documents, Vault items and portal content. Your company is the controller and decides why and how it is used, and our Data Processing Addendum governs what we may do with it. If you are a contact, lead, guest, client or employee of one of our customers, please ask that company first; we will help them answer you.
• Controller. The information in the next section, which we use to run our own business.

3. What we collect as controller, and why

Data	Examples	Purpose	Lawful basis (GDPR)
Account	name, work email, recovery email, password hash (argon2id), passkeys, company	create and secure your account	contract
Sign-in and security	IP address, device and browser, session times, failed sign-ins, audit history	keep accounts safe, investigate abuse	legitimate interests
Legal acceptance	which version of the Terms and this policy you accepted, when, and from which IP address	show what was agreed	legal obligation, legitimate interests
Billing	plan, company name, billing contact, order numbers from Lemon Squeezy (never card details)	charge and account for subscriptions	contract, legal obligation
Support and messages	what you write to us, the website contact form (name, email, company, message)	answer you	legitimate interests, or steps before a contract
Service usage	feature use counts, errors, mail, phone and AI usage for billing and limits	run, bill, fix and improve the service	contract, legitimate interests
Product email	your email, if you choose to hear about Coding Cords	tell you about the product	consent, or legitimate interests for customers (with an opt-out in every email)

We do not use advertising trackers, we do not sell personal data, and we do not "share" it for cross-context behavioural advertising as the CCPA defines it.

4. Who we share it with

Only the providers that help us run the service, listed with their purpose and location on the Subprocessors page: Hetzner (hosting), Cloudflare (DNS), Lemon Squeezy (payments, as merchant of record and an independent controller of your payment), OpenRouter and the model providers it routes to (AI), and Telnyx (phone). We also disclose data when the law requires it, to protect people or the service, or in a merger or sale of our business (with notice to you).

Company logos in the CRM are fetched by our own servers, so the people you keep in your CRM and your own IP address are not sent to a third-party icon service by your browser.

5. International transfers

Our servers are at Hetzner in the EU. Our team works from Pakistan and can reach data from there to run and support the service. Some providers process data in the US. Pakistan has no adequacy decision from the European Commission, and neither does every US provider, so we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US Data Privacy Framework where the provider is certified, together with access controls and encryption in transit.

6. How long we keep it

• Account data: while your account exists. When an account is closed we delete its data within 30 days, and it is gone from backups within 35 days after that.
• Security logs: up to 12 months.
• Legal acceptance records: for as long as the agreement lasts and 6 years after, to show what was agreed.
• Billing records: as long as tax law requires (Lemon Squeezy keeps its own).
• Support messages: up to 3 years.

7. Your rights

Wherever you are, you can ask to see, correct, export or delete your personal data, and to object to or restrict how we use it. Under the GDPR and UK GDPR you can also withdraw consent at any time and complain to your data protection authority (in the UK, the ICO). Under the CCPA/CPRA and similar US state laws you have the right to know, delete, correct and opt out of sale or sharing (we do neither), and we will not treat you differently for using these rights.

Write to privacy@codingcords.com. We answer within one month (45 days under the CCPA). We may need to confirm who you are first. Someone you authorise may ask on your behalf.

8. Security

See the Security page.

9. Cookies

We use only the cookies needed to sign you in and to remember choices you make. See the Cookie Policy.

10. Children

Coding Cords is for businesses and is not meant for anyone under 16.

11. Automated decisions

We make no decisions with legal or similarly significant effects about you by automated means alone. How AI features inside a workspace work is in the AI Terms.

12. Changes

We post changes here and keep every earlier version with its date. We email account owners about material changes at least 30 days before they take effect.