Privacy Policy

1.1Account Information

When you register for CorpGPT, we collect your name and email address. You can also add a company name and phone number in your account settings. This information is used to authenticate you, contact you about your account, and provide customer support.

1.2Documents & Content

You may upload PDFs, documents, audio files, images, and other content ("Input") to your workspace, where it is stored encrypted on AWS. You retain ownership and control of all Input. We act as a processor for your uploaded documents — see Terms of Service §6.1 for the rights and warranties you provide when uploading.

1.3Usage Data

Queries and prompts submitted to the AI, feature-usage patterns and interactions, search history within your workspace, document-processing metrics, and session duration / frequency of use.

1.4Technical Data

Browser type and version, IP address and approximate location (country / city level), device information (type, operating system), session logs and timestamps, and cookies / similar tracking technologies (see Section 7).

1.5Payment Information

Payment-card details are processed by Stripe, our PCI-DSS Level 1 certified payment processor, and are not stored on our servers. We retain only transaction records and billing information necessary for account management.

2.1Legal Basis for Processing

We process your personal information based on (a) Contract Performance — to provide CorpGPT as agreed in our Terms of Service; (b) Legitimate Interest — to improve the Service, ensure security, and communicate with you about your account; (c) Legal Compliance — to meet regulatory requirements and respond to lawful requests; and (d) Consent — where you have explicitly consented to specific processing activities (e.g., non-essential cookies, marketing emails).

2.2Purposes of Use

We use the information we collect to: provide, operate, and maintain the platform; process your documents using AI and deliver intelligent insights; authenticate users and manage account access; improve and personalize your experience; develop new features; communicate with you about updates, security alerts, and support; comply with legal obligations; detect, prevent, and address fraud or unauthorized access; analyze usage patterns; and provide customer support.

2.3AI Processing — What We Do NOT Do

We do NOT use your documents, chats or AI-generated content in the Service to train our own AI models. We do NOT sell, rent, or trade your data. The files you store in CorpGPT are stored encrypted, and files you upload from the app or site travel encrypted (Section 3.2); what the providers in Section 4.2 receive is held under their own terms. Our AI providers (listed in Section 4.2) process your content to return results to you. Under their API terms, AWS Bedrock, Google’s image-generation API (which we use on its paid tier) and Anthropic’s API do not use API content to train their models; OpenAI’s handling is described in Section 4.2, and some providers keep request data for a limited period, as Section 4.2 explains — see also Terms of Service §6.6. These no-training statements cover your documents, chats and AI-generated content in the Service; they do not cover support email, which Section 4.2 describes separately.

3.1Infrastructure

We store your account data and files on Amazon Web Services (AWS), with the primary region being us-east-1 (Northern Virginia, USA). The parts of your content needed for a request are processed — and in some cases held for a limited period — by the providers listed in Section 4.2, and AI requests may be processed in other AWS regions when capacity requires.

3.2Security Measures

Your data is stored in AWS and encrypted at rest, and files you upload from the app or site travel encrypted (TLS). Sign-in is passwordless, with a one-time code sent to your email. To stop codes being requested in bulk, we count the sign-in and verification codes sent for each email address — emails and, in the app, text messages counted separately — under a hash of the address (SHA-256) rather than the address itself; each count expires after two hours (two days for an address not yet verified) and is then deleted automatically. Our website’s sign-up and sign-in pages also run a human check from Cloudflare (Section 4.2); when you pass it on the sign-in page, we note that against the same kind of hash for up to an hour, so that your code email can be sent. No system is perfectly secure, and we cannot guarantee absolute security.

3.3Data Backups

Where we keep backups for disaster recovery, they are encrypted like primary data.

4.1We Do NOT Sell Your Data

We do NOT sell, trade, or rent your personal information or documents to third parties for marketing or any other purposes. Google’s tag sends Google cookieless measurement signals on every visit, including sign-up conversion events (Section 7.4). If you allow Marketing cookies, our advertising partners (TikTok, LinkedIn and Google Ads) also receive cookie-based information about your visit to our website, which the California Consumer Privacy Act (CCPA / CPRA) may treat as “sharing” for cross-context behavioural advertising; you can opt out at any time (see Section 5.6).

4.2Service Providers (Subprocessors)

We share data with vetted service providers who help us operate the Service. To answer your questions and make what you ask for, the relevant parts of your content are sent to the AI providers below.

Amazon Web Services (AWS) — hosting, storage and databases (primary region us-east-1), sign-in (Amazon Cognito), email (Amazon SES, including open and click tracking in some emails about your account — see Section 7.5), and system logs (Amazon CloudWatch — see Section 7.7). In the CorpGPT app, if a phone number is on file for your account, a copy of your sign-in code may also be sent by SMS through Amazon SNS.

Cloudflare — the human check (Turnstile) on our website’s sign-up and sign-in pages, which keeps automated sign-ups and code requests out. It loads from Cloudflare (challenges.cloudflare.com) straight into your browser, so Cloudflare receives your IP address, standard browser details and the signals it uses to tell a person from a script, and keeps a small item in its own storage in your browser; our servers send Cloudflare the check’s result to confirm it, never your email address.

AI services on AWS — AWS Bedrock, running Anthropic’s Claude models, Amazon’s models (including Nova), and Cohere models, for chat, search and generated content; Amazon Textract and Bedrock Data Automation to read documents and images; Amazon Transcribe to transcribe audio; and Amazon Comprehend and Amazon Polly for some analysis and read-aloud features.

OpenAI — image generation, some infographic text, voice features (text-to-speech and speech-to-text, for example in Deep Dive and read-aloud), and My Research, including its web search when you switch web research on. When you ask CorpGPT to redraw a photo of yours (the Image tool’s photo ideas, a preset style, or your own words), OpenAI receives that photo and your instruction, and sends back the new picture. For My Research, OpenAI receives your research question together with excerpts from the documents you chose and a short reader profile drawn from your saved memory, in the same request that runs the web search. OpenAI may also receive the text of a chat answer when CorpGPT reformats or summarizes it. Where real-time voice is switched on, your browser connects directly to OpenAI, which receives your microphone audio and IP address. My Research runs in the background, so it asks OpenAI to store each research request and its response so they can be collected when the run finishes; CorpGPT does not delete them, so OpenAI keeps them for as long as its terms and our account’s settings allow.

Google (Gemini API) — image generation for Illustrated Posters and infographic artwork. Google Fonts — the CorpGPT app loads its fonts from Google Fonts, so your browser sends your IP address to Google when the app opens (Section 7.8).

Anthropic — where enabled, a backup route for text requests when AWS Bedrock is at capacity; Anthropic’s Claude is also the AI assistant that handles our support email (below).

Firecrawl — fetching the web pages and sitemaps you add as sources. YouTube (Google) — when you add a YouTube link, our servers fetch the video’s title and description from YouTube; and when a page on our website shows a video, its preview picture loads from YouTube when the page opens, before you press play (Section 7.9). Pexels — stock-photo searches, using short keywords drawn from your content, for cover images on generated documents, posters and slides; the photos then load from Pexels (images.pexels.com) straight into your browser in the app, so Pexels receives your IP address and standard browser details (Section 7.9).

Website chat assistant — when it is enabled, the chat assistant on our website sends your messages to Amazon Bedrock to answer them (Sections 6.3 and 7.6).

Microsoft — when you choose to preview a PowerPoint (.pptx, .ppt) or older Word (.doc) file, a temporary link to that file is sent to Microsoft’s Office Online viewer so it can display it.

Stripe (payments), Zendesk (support tickets), and our website’s analytics / advertising vendors, as described in Section 7.

Internal alerts — when a document fails to process, an automatic alert that includes the email address of the account involved is emailed to members of our team. When you create an account or change your plan, your name, email address, company name and plan are included in an activity summary that is emailed to members of our team.

Support email — email you send to support@corpgptai.com arrives in our Google Workspace inbox and is copied to Amazon Web Services (Amazon SES stores each message, with its attachments, in Amazon S3). An AI assistant (Anthropic’s Claude) reads these emails, drafts the replies and can send them to you on our behalf. Copies of your email and its attachments are downloaded to the computer of the team member handling your request, and a record of each request — your name, email address and the text of your email, with our notes — is kept in our engineering records on GitHub. The same inbox also receives reports our systems generate — for example, when you report a problem with an answer, a notice with your email address and your note — and automated checks read it.

Each provider processes your information under its own terms of service and data-processing terms. We will update this list as the Service changes.

4.3Legal Requirements

We may disclose information when required by law, regulation, legal process, or governmental request, including compliance with court orders or subpoenas, protection of our legal rights, investigation of fraud or security issues, and protection of user or public safety.

4.4Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred. We will notify you via email and/or prominent notice on our platform before your data becomes subject to a different privacy policy.

4.5With Your Consent

We may share information for purposes not described in this policy with your explicit consent, which you may withdraw at any time.

5.1Access & Portability

You have the right to access your personal information and uploaded documents and to request a copy of all personal data we hold about you, including in a structured, machine-readable format. You can download any document you uploaded from My Documents in the app; for a copy of everything else, email support@corpgptai.com.

5.2Correction & Updates

You may update or correct your name, company name and phone number at any time in your account settings; to correct your email address, contact support@corpgptai.com.

5.3Deletion

You may request deletion of your personal data at any time by contacting support@corpgptai.com. Accounts on the free plan can also close themselves in Account Settings → Delete account, which removes the customer account record straight away. The documents and other content in your workspace may be deleted with it and cannot be recovered. Download anything you want to keep first — in the app while your plan is active, or by emailing support@corpgptai.com if it has ended (Section 6). Some information may be retained longer where required by law (e.g. tax / billing records), as part of the trial-eligibility ledger described in Terms of Service §8.9, or in our account activity log, which is kept after your account is deleted (Section 6.3(h)).

5.4Restriction & Objection

You may restrict processing of your personal information in certain circumstances, object to processing based on legitimate interests, and opt out of marketing communications using the unsubscribe link in any marketing email.

5.5Withdraw Consent

Where processing is based on consent (including non-essential cookies and marketing), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

5.6California Residents — Your Privacy Choices

California residents have additional rights under the CCPA / CPRA, including the right to opt out of any “sharing” of personal information for cross-context behavioural advertising. If your browser sends the Global Privacy Control (GPC) signal on your first visit, we automatically treat it as a valid opt-out request. If you made cookie choices before turning GPC on, change them with the “Your Privacy Choices” link in our website footer, which you can use at any time to manage your preferences directly.

5.7How to Submit a Privacy Request

Email support@corpgptai.com with the subject line “Privacy Rights Request” and include your name, the email address associated with your account, and a description of the right you wish to exercise. We aim to respond within 5 business days and to resolve requests within the timeframes required by applicable law (typically 45 days for CCPA, 30 days for GDPR).

6.1Active Accounts

While your account is active, we retain your personal information, uploaded documents, AI-generated content, and transcriptions for as long as necessary to provide the Service.

6.2Terminated Accounts — 180-Day Window

When a paid subscription or Trial ends, your customer account record is kept for one hundred and eighty (180) days and then removed automatically (a free account you delete yourself is removed at once). Your uploaded documents, AI-generated content, transcriptions and chat history may be deleted with the account record and cannot be recovered. Download anything you want to keep first — in the app while your plan is active, or by emailing support@corpgptai.com if it has ended — and you can ask us to delete them sooner (Section 6.4).

6.3Exceptions

We retain certain information longer where: (a) we are legally required to keep it (e.g. tax and billing records — typically 7 years); (b) it is needed to resolve a dispute or enforce our agreements; (c) it is part of the trial-eligibility ledger described in Terms of Service §8.9, which keeps the email address, account ID and start date of accounts that have used a free Trial or subscribed to a paid plan (plus the Trial’s end date or the paid plan’s name), indefinitely, as an anti-abuse control; (d) it is held by one of the providers in Section 4.2 under its own retention terms — for example, Google handles the Google Fonts requests the CorpGPT app makes under Google’s own terms; (e) it is in our system logs (Amazon CloudWatch), which have no set expiry: log entries can include identifiers such as your email address or account ID and are kept until we delete them; (f) it is the record of whether our emails to you were delivered, opened or clicked (open and click tracking, Section 7.5), which stays on your customer account record for as long as that record exists; (g) it is a conversation with the website chat assistant, when it is enabled: each conversation is kept for 15 days after your last message, together with a hashed (not raw) IP address and your browser’s user agent, and if you create an account through the chat’s sign-up link, your account also records that conversation’s reference; (h) it is in our account activity log, which records your account’s creation (with your name and email address), your acceptance of these documents (with your browser’s user agent), sign-ins (with the email address used), sign-outs, profile changes (with the names entered), plan, billing and authenticator-app changes, and the deletion of your account itself — the log is kept after your account is deleted and has no set expiry; or (i) it is a support email: the copies in Amazon Web Services are deleted automatically about a year after they are stored there, and our Google Workspace inbox, the handling team member’s computer and our engineering records keep theirs until we delete them.

6.4Deletion on Request

You may ask us to delete your data — including your documents, AI-generated content, transcriptions and chat history — at any time by contacting support@corpgptai.com. We will honour such requests to the extent permitted by applicable law.

7.1Categories We Use

Strictly Necessary — required for sign-in, security, and remembering your cookie choice (cannot be disabled). Analytics — usage statistics so we can improve the product. Marketing — measures the effectiveness of our advertising on third-party platforms and lets Google use your visit to personalize ads (remarketing). Analytics and Marketing cookies are off by default until you opt in via the consent banner. Before that, Google’s tag (Analytics and Google Ads measurement) still loads, in a cookie-free mode (Google Consent Mode v2, with consent denied), and sends Google cookieless signals such as page views and, when you create an account, sign-up conversion events. In the CorpGPT app, your browser tab also keeps what you were working on — unsent drafts, the chats you have open and your place in a chat — so they are there when you come back; it holds no copy of your documents and is gone when you close the tab.

7.2Your Controls

You can change your cookie choices at any time using the Your Privacy Choices link in our website footer, the detailed inventory on our Cookie Policy page, or through your browser settings. Disabling Strictly Necessary cookies may prevent you from using authenticated features.

7.3Global Privacy Control (GPC)

If your browser sends the Global Privacy Control signal (e.g. Brave, Firefox with Sec-GPC enabled, DuckDuckGo browser), we automatically treat it as an opt-out from Analytics and Marketing categories on your first visit. You do not need to take any further action.

7.4Third-Party Services

Our website uses Google’s tag for Google Analytics 4 and for Google Ads conversion measurement and remarketing, and, only when you accept Marketing, the TikTok Pixel and the LinkedIn Insight Tag. Google’s tag loads on every visit under Google Consent Mode v2: until you opt in, it sets no cookies but still sends Google cookieless signals — page views and, when you create an account, sign-up conversion events — which Google may use for aggregated, modelled measurement. Only with your permission does it set cookies: accepting Analytics grants Google’s analytics_storage signal, so it may set the Analytics cookies; accepting Marketing grants ad_storage, ad_user_data and ad_personalization, so it may set the Google Ads cookies and use your visit to personalize ads (remarketing). See our Cookie Policy for the complete inventory of cookies and providers.

7.5Email Open and Click Tracking

Some emails we send about your account — product tips, trial-expiry reminders and plan reminders — use Amazon SES open and click tracking: we record whether each email was delivered, opened or clicked, and we stop marketing emails to an address that bounces or reports spam. Your cookie choices don't control this; blocking images in your email program stops the open tracking.

7.6Website Chat Assistant

When it is enabled, the chat assistant on our website answers with Amazon Bedrock and keeps each conversation for 15 days after your last message, with a hashed (not raw) IP address and your browser’s user agent (Section 6.3).

7.7System Logs

Our servers write system logs (Amazon CloudWatch) as they handle requests from the website and the app. Log entries can include identifiers such as your email address or account ID, and they have no set expiry (Section 6.3).

7.8Fonts in the App

The CorpGPT app loads its fonts from Google Fonts, so your browser sends your IP address and standard browser details to Google when the app opens. Our website serves its own fonts.

7.9Pictures From Other Sites

Some of our website’s pages load pictures straight from other companies’ servers, which then receive your IP address and standard browser details: a page that shows a video loads its preview picture from YouTube (Google, i.ytimg.com) when the page opens, before you press play — the YouTube player itself loads only when you press play. In the app, cover photos from Pexels load the same way, straight from images.pexels.com. Your cookie choices don’t control these requests.

8.1Data Location

Your data is primarily stored in AWS data centres in us-east-1 (Northern Virginia, USA). Data may be transferred to and processed in countries other than your country of residence as part of our normal operations.

8.2Transfer Safeguards

When we transfer personal data outside the European Economic Area (EEA), the United Kingdom, or Switzerland, we use one or more of the following safeguards: Standard Contractual Clauses (SCCs) — EU-approved model contracts; Adequacy Decisions — transfers to countries deemed adequate by the European Commission; and your explicit consent where required. CorpGPT itself is not certified under the EU-U.S. Data Privacy Framework (or its UK Extension or the Swiss-U.S. Data Privacy Framework); where one of our providers is certified, that provider relies on its own certification for its transfers.

8.3Data Processing Agreement

Enterprise customers may request a Data Processing Agreement (DPA) that includes Standard Contractual Clauses by emailing support@corpgptai.com.

9.1Our Commitment

If we discover a security incident, we will investigate it, work to contain it and recover from it, and notify affected users as described in 9.2.

9.2Breach Notification

If a personal-data breach affects your information, we will notify you by email to your registered address without undue delay, and within any deadline set by applicable law. The notification will describe the nature of the breach, the data affected, the steps we have taken in response, and any recommended actions you should take. We will also notify relevant supervisory authorities as required by law.

10.1Age Restrictions

You must be at least 13 years old to use CorpGPT. If you are under 18, you may use it only with the permission of your parent or legal guardian (see Terms of Service §2.1). CorpGPT is not directed at children under 13, and we do not knowingly collect personal information from children under 13.

10.2Reporting

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact support@corpgptai.com. We will delete such information from our systems within 30 days of verifying the request.

11.1AI-Powered Features

CorpGPT uses artificial intelligence to analyse and extract information from your documents, generate summaries and insights, provide search and retrieval, and suggest relevant content.

11.2Human Oversight

Our AI features are designed to assist you, not to make decisions on your behalf. You retain full control over which documents to upload, how to interpret AI-generated insights, and any business decisions based on platform outputs.

11.3No Profiling for Significant Decisions

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you without human intervention.

11.4Your Rights

Under the GDPR and certain other privacy laws, you have the right not to be subject to decisions based solely on automated processing, to request human review of automated decisions, and to express your point of view and contest an automated decision. You can exercise these rights by emailing support@corpgptai.com.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• General inquiries: support@corpgptai.com
• Privacy rights requests: support@corpgptai.com with subject line “Privacy Rights Request”
• Company: Vizio Consulting Inc., a corporation incorporated in Ontario, Canada

We aim to respond to privacy inquiries within 5 business days and to resolve formal requests within the timeframes required by applicable law (typically 45 days under the CCPA and 30 days under the GDPR).

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The updated policy is posted on this page, and each update is posted with a new Last-updated date; for significant changes we may also email you.

Your continued use of CorpGPT after changes become effective constitutes your acceptance of the updated policy. If you do not agree to the changes, you should discontinue use and may delete your account at any time. Prior versions of this policy are retained for your review on request.