Privacy notice

Effective 3 November 2026

This notice explains how Corresso (“we”) handles the personal data we are responsible for — as the controller, in the words of the General Data Protection Regulation (GDPR). It covers people who have a Corresso account, anyone who visits our sign-in and other public pages, and anyone who writes to us.

It does not cover the email that businesses read and answer with Corresso. That mail is the business’s, and we handle it only on the business’s behalf. If you wrote to a business that uses Corresso, the last section is for you.

Who is responsible

• Controller: Corresso
• Address: Grønholtvej 10, 8581 Nimtofte, Denmark
• Privacy questions and requests: privacy@corresso.com
• Data protection officer: None appointed

What we process, why, and on what legal basis

Your account

• What: your name, email address and time zone; which organisations you belong to and your role in each (owner, admin or agent); and your password, which we store only as a one-way bcrypt hash that cannot be turned back into the password.
• Where it comes from: your organisation, which decides who gets an account and gives us your name and email address for it.
• Why: so you can sign in and use Corresso for your organisation.
• Legal basis: our and your organisation’s legitimate interest in providing the service your organisation has agreed with us (GDPR art. 6(1)(f)). If you accepted that agreement yourself, it is also necessary for the contract (art. 6(1)(b)).
• How long: for as long as your account exists. When your organisation’s agreement with us ends, we delete it within 30 days, and from backups within one further backup cycle.

The conversations, notes, draft replies and assignments you work on in Corresso are your organisation’s data, not ours. We process them on your organisation’s behalf under our data processing agreement, and your organisation decides what happens to them: its owners and admins can delete a conversation, or every conversation with one customer, for good, and an owner can close the account, after which everything is deleted 30 days later.

Signing in

• What: each time you sign in, we record a session: your user id, the IP address and browser (user agent) you signed in from, when you signed in, and when the sign-in ends. Your browser keeps a cookie that points to it.
• Why: to keep you signed in, and to be able to trace misuse of your account.
• Legal basis: our legitimate interest in keeping accounts and the service secure (art. 6(1)(f)).
• How long: a sign-in ends 30 days after you signed in, and a daily clean-up then deletes its record. Signing out deletes it at once, and resetting your password deletes all your sign-ins.

Access log

• What: each time you open a conversation, and each time the Shopify panel beside it shows you a customer or an order from your organisation’s store, we record your user id, the conversation’s id, Shopify’s id for that customer or order, and the time. No names, email addresses, postal addresses or message text.
• Why: so your organisation’s owners and admins can see who has looked at its customers’ data, and to trace misuse.
• Legal basis: our legitimate interest, and your organisation’s, in keeping its customers’ data secure and being able to show who accessed it (art. 6(1)(f)).
• How long: 12 months, then deleted by a daily clean-up. Owners and admins of your organisation see the last 90 days under Settings → Access log.

Notifications by email and in your browser

• What: what you choose in Settings → Notifications. When a colleague mentions you in a note or assigns you conversations, and you chose email, we email you their name, the subject of the conversation and, for a mention, their note, cut short. If you turn on browser notifications in a browser, we keep the address its push service gave it, two keys the browser made for encrypting messages to it, and a name such as “Chrome on macOS” read from your browser’s user agent (not the user agent itself).
• Who carries it: the email goes through Resend, like all our email. A browser notification goes through the push service of the browser you use, which your browser chooses, not us: Google (Firebase Cloud Messaging) for Chrome and most browsers built on it, Mozilla for Firefox, Apple for Safari, and Microsoft (Windows Push Notification Services) for Edge on Windows. Each message is encrypted for your browser alone, so the push service cannot read it; it sees the push address, that Corresso sent something, when, and how big. The notification shows only your colleague’s first name and the subject of the conversation — never the customer’s mail.
• Why: so you know when a colleague needs you.
• Legal basis: our and your organisation’s legitimate interest in letting colleagues reach each other (art. 6(1)(f)). Browser notifications reach you only after you turned them on and your browser asked you.
• How long: your choices for as long as your account. A browser until you remove it, its push service tells us it no longer exists, or you leave the organisation — then we delete it at once.

Resetting your password

• What: your email address, and the email we send to it with a link to set a new password.
• Why: to let you back into your account when you have forgotten your password.
• Legal basis: our legitimate interest in giving account holders a secure way back in (art. 6(1)(f)).
• How long: the link works for 15 minutes. We send the email through Resend (see who receives the data), which keeps a copy of each sent message for 30 days.

Security logs

• What: every request to Corresso is logged with the IP address it came from, the time and the address of the page. In the lines the application itself writes, a request’s parameters — what is typed into a form, and what follows the “?” in an address — are filtered first: passwords, email addresses, message text and search terms are replaced with “[FILTERED]”. The rest of a page’s address is written as it is. So the address of a password-reset page appears in full, with the one-off token from its link; that token stops working after 15 minutes, or as soon as the password is changed. Two web servers pass each request on to the application, and neither filters anything: each writes a line of its own that records your browser (user agent) and the full address of each page — including a search typed into the inbox, or a customer’s email address carried in a link. The inner one writes into Corresso’s own log, next to the application’s lines; the outer one, in front of Corresso, keeps a log of its own. To slow down password guessing, we also count sign-in and password-reset attempts per IP address, and to stop a mistake or a misused account from sending mail in bulk, we count how often each person sends.
• Why: to keep Corresso running and secure, and to find and fix faults and attacks.
• Legal basis: our legitimate interest in the security and operation of the service (art. 6(1)(f)).
• How long: a counter counts for at most 3 minutes. It stays in our cache database, under the IP address or account it counts, until the cache’s routine clean-up deletes it; that clean-up runs as new entries are written and removes those more than two weeks old. Corresso’s own log is written to the server’s standard output, where Docker keeps it in files rotated by size: three files of at most 50 MB each, the oldest deleted first. When we release a new version, the old version’s log stays on the server with it until our deployment tool removes that version, which it does once it is no longer among the five most recently retired versions. The outer web server’s log is a single file of at most 10 MB, started afresh whenever it fills up. So how long a line survives depends on how busy the service is and how often we release, not on a date. Records of background tasks that failed, which can contain error messages, are deleted after 30 days.

Product pictures from Shopify

• What: in an organisation that has connected its Shopify store, opening a conversation with a customer who has orders there shows pictures of the products ordered. Your browser fetches those pictures directly from Shopify’s servers (cdn.shopify.com), not from ours, so Shopify receives what any website receives when a browser asks it for a file: your IP address, your browser’s details (user agent), the address of the picture, and the address of Corresso’s site — but not of the page you are on. We store none of this.
• Why: so the person answering can see at a glance what the customer bought.
• Legal basis: our legitimate interest, and your organisation’s, in showing the order next to the conversation, as your organisation asked when it connected its store (art. 6(1)(f)).
• Who receives it: Shopify, which decides for itself what it does with it, under its own privacy policy. For people in the EEA, that policy names its Irish company, Shopify International Ltd., as the recipient, and says Shopify sends the data on to other Shopify companies — including in Canada, where it is headquartered, and the USA — under its binding corporate rules, and to its own service providers under standard contractual clauses.
• How long: we keep nothing. Shopify keeps it for as long as its privacy policy says.

This happens only in organisations that have connected a Shopify store. Everywhere else, no page of Corresso loads anything from another company’s servers.

Measuring our public pages, if you allow it

• What: which of our public pages — the front page, How it works and the sign-up page — you open, what you click there, the page that sent you, your browser, device and screen size, and a random id for your browser kept in a cookie, so one visit can be told from the next. Not what you type into a form, and not the rest of a page’s address beyond any campaign tags (utm_). Nobody is identified by name or email address.
• When: only after you choose Allow in the box those pages show. Before that, nothing is measured and nothing is loaded. No page inside Corresso — the inbox, settings, the sign-in page — loads PostHog or sets its cookie, whatever you chose. What happens inside the app is counted only as the next section describes.
• Why: to see which pages and explanations help people decide, and to compare versions of a page.
• Legal basis: your consent (art. 6(1)(a)), which you can take back at any time with Cookie settings at the bottom of those pages; the consent to store the cookie is required by Cookiebekendtgørelsen (BEK nr. 1148 af 9. december 2011, § 3).
• Who does it: PostHog, Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA, on our instructions, in its EU cloud in Frankfurt, Germany. Your browser sends the measurements to it directly, so it also receives your IP address.
• How long: the cookie for one year, or until you choose No thanks; PostHog keeps the measurements for one year.

How you use Corresso

• What: each time you do something in Corresso that changes something — sign in, assign a conversation, send a reply, add a note, change a setting — we record which action it was (for example “threads#assign”), whether it went through, the time, your user id and your organisation’s id and name. Not what you wrote, not which conversation or customer it concerned, and nothing from anyone’s email. Opening and reading pages is not recorded.
• Why: to see which parts of Corresso are used, where people get stuck, and what to improve.
• Legal basis: our legitimate interest in improving the service your organisation pays for (art. 6(1)(f)). You can object (art. 21); write to us, and we stop counting your actions.
• Who does it: PostHog, Inc. (see above), on our instructions, in its EU cloud in Frankfurt, Germany. Our server sends it the records; your browser does not, and no cookie is involved.
• How long: PostHog keeps them for one year.

When you write to us

• What: your name and email address, what you write, and our replies.
• Why: to answer you.
• Legal basis: our legitimate interest in answering the people who contact us (art. 6(1)(f)); when you write about an agreement between us and your organisation, also art. 6(1)(b).
• How long: while the matter is open, and afterwards only for as long as we need it to show what was agreed with your organisation.

Google account data

• What: when an owner or admin connects a mailbox to Google, we store the address of the Google account that was connected and the OAuth tokens Google gave Corresso, which are kept encrypted. Corresso asks for permission to send email on that account’s behalf, and for nothing else: it cannot read, list or delete anyone’s email.
• Why: only to send what a person in your organisation pressed Send on, from your own address, through your own Google account.
• Legal basis: our legitimate interest, and your organisation’s, in sending its replies as it asked when it connected the mailbox (art. 6(1)(f)).
• Where: encrypted, on our servers in Germany.
• How long: until the connection is disconnected, which deletes it. If Google revokes it, the tokens are erased at once and only the account’s address stays, to tell you which account to connect again, until you reconnect or disconnect.
• Who sees it: nobody reads it, and it is never used to train a model.
• How to revoke it: press Disconnect on the mailbox in Corresso, or remove Corresso on your Google account’s page for third-party access, myaccount.google.com/connections.

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

AI and Google user data

Corresso writes draft replies with an AI model, Claude, made by Anthropic. A person always reads, edits and presses Send on every reply; nothing is sent by the AI.

• No Google user data reaches an AI model. No data Corresso receives from Google APIs is ever given to Claude or any other AI model, whether raw, aggregated, anonymised or derived. Google gives Corresso only the connected account’s address and the tokens that let it send; neither is ever part of what a draft is written from.
• Where drafts come from. A draft is written from the mail a customer sent to your organisation, which reaches Corresso by forwarding, not through Google APIs, and from the knowledge your organisation has approved in Corresso. If your organisation chooses to give Corresso its past replies, as an export or over IMAP with a password it gives us, they are used only as examples of tone, and not through any Google permission.
• No training. Corresso does not train, fine-tune or improve any AI model, foundational, generalised or otherwise, with any data. We use Anthropic under its Commercial Terms of Service, under which Anthropic may not train models on what Corresso sends it or the drafts it returns.
• No other AI services. Corresso calls Anthropic directly, not through an aggregator, gateway or model hub, and uses no other AI provider.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Shopify store data

• What: when an owner or admin connects a Shopify store, we store the store’s domain and name, the access and refresh tokens Shopify gave Corresso, which are kept encrypted, and a reference to the customer or order that a person linked to a conversation, and, in the access log, Shopify’s id for each customer or order the panel showed someone. Corresso asks for permission to read customers and orders and nothing else: it cannot change, create or delete anything in the store. The customers and orders themselves are read live from Shopify and are not stored.
• Why: to show the customer and orders beside the conversation they wrote to, so the person answering sees what was bought without leaving the inbox.
• Legal basis: our legitimate interest, and your organisation’s, in answering its customers with their order in front of it (art. 6(1)(f)).
• Where: encrypted, on our servers in Germany.
• How long: until the store is disconnected or the app is uninstalled, which deletes the tokens. Shopify then tells Corresso to erase the rest: its shop/redact request deletes the connection and every reference and erases Shopify’s ids from the access log, and its customers/redact request deletes the references to that customer and their orders and erases their ids from the access log. If Shopify stops accepting the tokens, they are erased at once and only the store’s domain stays, to tell you which store to connect again, until you reconnect or disconnect.
• Who sees it: the people in your organisation who answer mail see the customer and orders beside a conversation. Nobody at Corresso reads it, and it is never used to train a model.
• How to take it away: press Disconnect under Settings → Shopify in Corresso, or remove Corresso under Settings → Apps in your Shopify admin.

Orders your Shopify store sends

• What: if your organisation connects its store without an app, we keep a copy of the orders your store sends Corresso through the webhooks you create in your Shopify admin, or in the order export you bring in: the order number, the customer’s name and email address, the shipping address, the items and prices, the payment and shipping status, and the carrier, tracking number and tracking link. Everything else in what Shopify sends is dropped when it arrives.
• Why: to show the customer and orders beside the conversation they wrote to.
• Legal basis: our legitimate interest, and your organisation’s, in answering its customers with their order in front of it (art. 6(1)(f)).
• Where: kept encrypted, on our servers in Germany.
• How long: each order is deleted by a daily clean-up two years after the order was placed, or sooner: Disconnect deletes them at once, and so does deleting your organisation.
• Who sees it: the people in your organisation who answer mail. Nobody at Corresso reads it; it is never shown to the AI that writes drafts, and never used to train a model.
• How to take it away: press Disconnect under Settings → Shopify in Corresso, and delete the webhooks under Settings → Notifications → Webhooks in your Shopify admin.

Cookies

Corresso’s own cookies keep you signed in, protect forms, and remember the organisation you work in and the order you chose for your inbox. They are strictly necessary for the service you have asked for, so under Danish law they need no consent (Cookiebekendtgørelsen, BEK nr. 1148 af 9. december 2011, § 4, stk. 1, nr. 2). One more cookie is set only if you allow it: PostHog’s, which measures our public pages (see above). We use no advertising or tracking across websites, and apart from the Shopify product pictures described above, no page loads anything from another company’s servers — not even fonts. Each cookie is described in our cookie declaration.

Who receives the data

Personal data about you reaches these companies:

• Hetzner Online GmbH, Germany, hosts our servers and database.
• Plus Five Five, Inc. (Resend), USA, delivers the email we send you, such as confirmations, password resets and the notifications you choose. It keeps sent messages and their delivery logs for 30 days.
• Our email provider stores the email you send us: Google, which stores our mailbox in the EU.
• Shopify receives your IP address and browser details directly from your browser when Corresso shows product pictures, in organisations that have connected a Shopify store (see above).
• PostHog, Inc., USA, measures our public pages in its EU cloud in Frankfurt, only for visitors who allow it, and counts the actions people take in Corresso (see above).
• The push service of your browser — Google, Mozilla, Apple or Microsoft — carries the browser notifications you turned on, encrypted so that it cannot read them (see above).

Hetzner, Resend and PostHog process the data on our instructions, under data processing agreements with us. Shopify does not work for us: it handles what it receives under its own privacy policy. Beyond those listed here, we disclose personal data only where the law requires it. We never sell it, and never use it for advertising.

Transfers outside the EU and EEA

Our servers are in Germany. Resend processes data in the USA. That transfer rests on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795): Plus Five Five, Inc. is certified under it. Should that decision fall away, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) in Resend’s data processing agreement apply instead. You can ask us for a copy of these safeguards at privacy@corresso.com.

PostHog keeps the measurements of our public pages and the actions counted in the app in Frankfurt, but PostHog, Inc. is a US company, which may reach them from the USA. That rests on the same adequacy decision: PostHog, Inc. is certified under the EU-U.S. Data Privacy Framework, and its data processing agreement adds the EU Standard Contractual Clauses.

Where our email provider stores mail outside the EU or EEA, the safeguard it relies on is named above.

If you turn on browser notifications, the push service your browser uses may carry them outside the EU and EEA. Each message is encrypted for your browser before it leaves our servers, so that service cannot read it.

What Shopify receives when your browser loads a product picture, Shopify sends on outside the EU and EEA itself, under the safeguards its own privacy policy names (see above).

How long we keep it

Your rights

Under the GDPR you have the right to:

• get a copy of the personal data we hold about you (art. 15);
• have it corrected if it is wrong (art. 16);
• have it erased (art. 17);
• have its processing restricted (art. 18);
• receive the data you gave us in a machine-readable form, or have it sent to someone else, where we process it to perform a contract with you (art. 20);
• object (art. 21). Because we rely on legitimate interests, you may object at any time on grounds relating to your particular situation, and we then stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the data for legal claims.

To use these rights, write to privacy@corresso.com. We answer without undue delay and within one month. If a request is complex, or we receive many, we may take up to two further months, and then tell you so within the first month (art. 12(3)). Your organisation can also ask us to correct or remove your account.

The one thing we rely on your consent for is measuring our public pages. You can take it back at any time, as easily as you gave it: choose Cookie settings at the bottom of the front page, then No thanks. That stops the measuring and deletes PostHog’s cookie from your browser; it does not undo what was measured before (art. 7(3)).

Complaints

You can complain to the Danish Data Protection Agency (Datatilsynet):

• Carl Jacobsens Vej 35, 2500 Valby, Denmark
• +45 33 19 32 00 · dt@datatilsynet.dk · www.datatilsynet.dk

Do you have to give us this data?

No law requires you to. Without an email address and a password there is no account, however, and without the sign-in and security records we cannot let anyone sign in safely.

Automated decisions

We make no decisions about you based solely on automated processing, and we do not profile you (GDPR art. 22).

If you emailed a business that uses Corresso

Businesses use Corresso to read and answer the email their customers send them. If you wrote to one, or were copied on an email to or from one, that business decides what happens to your message: it is the controller, and we process your message only on its behalf and on its instructions, under a data processing agreement. Its own privacy notice explains how it handles your data, and it is the one to ask to see, correct or delete it.

If you write to us instead, we pass your request on to that business, as our agreement with it requires.

If you used the chat on a business's website

Some businesses that use Corresso show a chat on their own website. Its answers are written by an AI assistant, from information that business approved, and are shown to you without a person reading them first; when the assistant is not sure, it says so and offers to have someone from the business get back to you; if you want that, you leave your email address in the chat, and the business writes to you from Corresso. The business is the controller of what you write in its chat, as with email: we keep your messages, the assistant's answers, the address of the page you wrote from, the time, and the email address you leave, if any, only on its behalf and on its instructions. Ask that business to see, correct or delete them. The chat keeps a random token for your conversation in your browser tab, as our cookie declaration describes.

Changes to this notice

When what we do with personal data changes, we update this notice and the date at the top. We tell account holders by email before a change that affects them takes effect.