What we collect, and what we never touch.

01

What we never collect

Ticket and conversation subjects. Descriptions and customer messages. Comments and internal notes. Attachments. Customer or requester names, emails, phone numbers, or organizations. Any free text custom field.

Freshdesk and Intercom send subjects and message text with every ticket anyway. Our connector drops that text the moment it arrives, before anything is stored, logged, or analyzed.

02

What we collect, and why

Your account. Your email address and the name your sign-in provider shares with us. We use them to sign you in and to know whose Record is whose.

What you file. Rulings, rules, class descriptions, sign-offs, and the prompts you run through the Check. This is your Record. It's yours.

Queue structure. From intake: the names in the field that carries your taxonomy (forms, groups, types, tags, components, or labels), contact counts, handoff counts, priority where your tool records it, created and resolved times, and channel. We use it to find your classes of contact and rank them.

Policy documents you upload. The text of the document, so we can pull out candidate rules for you to approve. That text is sent to Google's Gemini model to do the extraction.

Connection credentials. The API tokens or webhook addresses for your helpdesk, Notion, or Slack. They're encrypted at rest and used only to make the reads and writes you ask for. Nobody sees them again, including you.

Contact and invite requests. Your name, work email, company, which helpdesk you use, and your message. We use them to reply.

Ask Copious, the chat on our site. Your questions go to Google's Gemini model so it can write an answer. We don't store the conversation. If you choose to send it to a person, we keep it with your name, email, and company so we can reply. The chat refuses messages that look like customer details.

Site visits. The page you visited, the page that sent you, your browser's user agent, and a random ID that lasts for one browser tab. Our host, Lovable, also counts visits by page, country, and device. We don't run ads or ad trackers.

Abuse limits. A keyed, one-way hash of your IP address that changes daily, kept for up to a day. It stops anyone from flooding the chat or the contact form.

03

Who else handles it

• ◇Lovable hosts the site, the app, and the database. Lovable Cloud is built on Supabase.
• ◇Google runs the Gemini model behind Ask Copious and policy rule extraction, through Lovable's AI gateway. Google also handles sign-in if you use it.
• ◇Microsoft handles sign-in if you use it.
• ◇Resend sends our email.
• ◇Your helpdesk, Notion, and Slack, only when you connect them, and only for the reads and writes you ask for.

We don't sell your data. We don't share it for advertising.

04

How long we keep it

Your Record stays until you delete it or close your account. You can delete rules and rulings yourself at any time. We keep contact requests so we can follow up; ask and we'll delete yours. Abuse-limit hashes are gone within a day.

05

Deletion and export

To close your account and delete everything in it, or to get a full export of your Record, write to hello@copious.app from your account email. A person handles it within 30 days. Self-serve deletion and export are on the way, and this page will say so when they're live.

06

Security

How we protect what you give us, and what we haven't built yet, is on the Security page.

07

Changes

When this page changes, the date at the top changes. A material change also gets a Release Brief.