CocoSpace

Privacy Policy

Last updated: 8 July 2026

This policy explains what we do with personal data in CocoSpace and Cocopilot (the “Service”), operated by Maddy International FZ-LLC, Ras Al Khaimah, UAE (“CocoSpark”, “we”). Contact: contact@cocospark.com.

1. The data we handle

Your account: your name, email and login credentials.
Your content: everything you enter — strategy answers, brand book, notes, and in Cocopilot your contacts, projects, quotes, invoices, contracts and the details of your own clients.
Technical data: basic logs needed to run and secure the Service (e.g. sign-in events).

2. Why we use it

Only to provide the Service to you: to store and display your work, generate your documents, send the emails you ask for, and keep your account secure. We do not sell your data and we do not use it for advertising.

3. Your clients’ data

For the data you put about your own clients, you are the controller and we are your processor: we only act on your instructions (storing it, showing it back to you, producing your documents, sending the client portal and emails you trigger). You are responsible for having the right to store that data and for informing your clients.

4. Who processes data for us (sub-processors)

We use trusted providers strictly to run the Service:

Supabase — database & file storage.
Vercel — hosting of the application.
Brevo — sending transactional emails on your behalf.
Stripe — payment processing (your own Stripe account, if you connect one).
Fathom — call summaries, only if you paste a Fathom link.

Some providers may store data outside your country. We only use providers that offer appropriate safeguards.

5. Cookies

Today we use only the essential cookies needed to keep you signed in, and no advertising or third-party tracking cookies. We may, in the future, add privacy-respecting analytics to understand how the Service is used; if we do, we will update this policy and, where required, ask for your consent.

6. How long we keep it

We keep your data for as long as your account is active. If your access ends, you have a grace period of at least 30 days to export it (Settings → Export all my data) before it is removed. We never delete your data without that window. Limited backups may persist for a short time for security and legal reasons.

7. Your rights

You can access, correct, export or ask us to delete your personal data. Export is built in; for anything else write to contact@cocospark.com and we will act within a reasonable time.

8. Security

Access is protected by authentication and row-level security so each account only sees its own data. No system is perfectly secure, but we take reasonable measures to protect your information.

9. Changes

We may update this policy; we’ll flag important changes in the app or by email.