Privacy Policy

Last updated: October 9, 2026  ·  Deutsche Fassung

1. Controller

FMST Solutions LLC
1242 SW Pine Island Road, Ste 42-348
Cape Coral, FL 33991, USA
Email: [email protected]

For privacy requests (access, deletion, objection), write to [email protected].

2. Data we process

2.1 Account and profile data

• Email address, first and last name, password (stored only as a secure hash)
• Language, time zone, display and notification settings
• Time of registration and sign-in, session data (browser identifier, expiry date)

2.2 Content you create

• Calendar events, tasks, reminders, habits, notes including attachments
• Chat messages and file attachments in chats
• Meeting recordings: audio is sent in segments to the AI provider you have set up for transcription and is not stored by us afterwards; only the resulting text is stored.

2.3 Technical data

• One necessary session cookie (cid) keeps you signed in. We do not set advertising or tracking cookies and do not use analytics services.
• In your browser (localStorage) we only store display settings such as language and view.
• Security and log data (e.g. rate limits, change logs) for troubleshooting and protection against abuse.

3. Google Calendar connection (optional)

If you click "Connect with Google" under Settings › Google Calendar and consent, Cooriva AI accesses your Google account with the following permissions:

• https://www.googleapis.com/auth/calendar.events – view, create, edit and delete events in your Google calendars.
• https://www.googleapis.com/auth/calendar.calendarlist.readonly – read the list of your calendars (name, color, time zone) to display them in Cooriva.

What we use this data for:

• Your Google events are displayed in Cooriva (read-only) and stay private to your account.
• Optional (can be switched off): events you create in Cooriva are written to your primary Google calendar; changes and deletions are synchronized in both directions.
• We use Google data solely to provide these user-facing features for you. We do not use it for advertising, do not use it to train AI models, do not share it with third parties and do not sell it. Our staff do not read your Google data unless you explicitly give permission (e.g. for a support request) or it is necessary to investigate abuse or required by law.
• The AI assistant can access your events when you use it (see section 6). This happens only on your request and with the AI provider you have chosen.

What we store: imported events (title, time, location, description, attendee email addresses), names/colors/time zones of the selected calendars, your Google email address for display, and an access token (refresh token). The token is stored encrypted (AES-GCM, bound to your account) and is never delivered to your browser.

Disconnecting and deletion: Under Settings › Google Calendar › Disconnect we revoke access at Google, delete the token and remove all imported Google calendars and events from Cooriva. Events already created in Google remain there. When you delete your Cooriva account, the same happens automatically. You can also revoke access at any time at myaccount.google.com/permissions.

Cooriva AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Storage, hosting and processors

Where providers process data outside the EU/EEA, we rely, where required, on standard contractual clauses or the providers' certification under the EU-US Data Privacy Framework. Shared content (e.g. in Spaces) is visible to the members of the respective Space; your calendar, however, is strictly private.

5. Retention

• Content and account are kept until you delete them or your account.
• Deleted events are permanently removed after 30 days at the latest; expired sessions and temporary data are cleaned up continuously.
• When you disconnect Google, imported Google data and the token are deleted immediately.

6. AI features

If you use the AI assistant, summaries or meeting transcription, the content needed for this (e.g. questions, relevant events, tasks or notes, audio segments) is sent to the AI provider you have set up. When you use your own API key, your contract is with that provider; the key is stored encrypted by us and never displayed. The assistant only sees data you yourself have access to. It carries out changes only after your confirmation. AI output may contain errors.

7. Legal bases

• Art. 6(1)(b) GDPR – performance of a contract (providing the app)
• Art. 6(1)(a) GDPR – consent (Google connection, AI use, optional notifications)
• Art. 6(1)(f) GDPR – legitimate interests (security, stability, abuse prevention)

8. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time with effect for the future. Contact [email protected]. You can also lodge a complaint with a data protection supervisory authority.

9. Deleting your account

You can delete your account yourself in the app under Settings (password confirmation required). This removes your profile, private content, files, chat data, the Google connection and the token; access at Google is revoked. If you still own Spaces, transfer or delete them first. Alternatively, write to [email protected].

10. Children

Cooriva AI is not directed at persons under 16 years of age.

11. Changes

We update this privacy policy when features change. The current version published here applies. For material changes to the Google permissions, we ask for your consent again.