1. Who we are
Coset ("we", "us") is a company in formation. It operates trycoset.com and the Coset app at app.trycoset.com. This policy explains what we collect when you visit trycoset.com, ask for a demo, or use the Coset app at app.trycoset.com, what we do with it, and what choices you have. Questions: hello@trycoset.com.
2. What Coset is
Coset helps a small business ask questions about its own financial documents and books, and shows the sources each answer rests on. Coset only reads. It never writes to, edits or deletes anything in your Google Drive, SharePoint, QuickBooks or any other connected account.
3. What we collect
a. If you visit the website or ask for a demo
When you ask for a demo we collect what you type into the form: your work email, your company, your company size, and, if you choose to give them, what you would like Coset to check and how you heard about us. We use them to reply to you and to arrange the demo. We do not sell them and we do not use them for advertising. The form is handled by Netlify, which hosts this website, and the submissions are stored there and sent to us by email. The website does not use advertising cookies or analytics.
b. If you have a Coset account
- Your account: name, email address, a password hash (never the password itself), and sign-in records.
- Documents you upload or choose: the files, and the text, pages and search data we create from them so they can be searched.
- Books you connect: if you connect QuickBooks, the accounting data we read from it (read-only), and the connection's access tokens, which we store encrypted with a key held in Azure Key Vault.
- Your use of Coset: your questions, the answers, the record of what each answer rested on, and an audit trail of who did what in your business.
- Technical logs: timings, route names, status codes, ids and counts. Some operational log lines may currently include fragments of content, such as part of an error message. We are changing this so that logs hold no customer content, and we will update this page when that is done.
Each business's data is separated from every other business's data inside the database itself.
4. Google user data
- What we ask for: only the Google Drive
drive.filepermission, plus your name and email address to identify the connection.drive.filelets Coset reach only the files you pick with Google's file picker. It does not let us see the rest of your Drive. - What we do with a file you pick: we read it, keep a copy, and process it as if you had uploaded it (section 3b). Coset does not write to Drive. Coset does not watch folders: picking a folder does not bring its other files. To have a changed file read again, pick it again.
- Limited Use: Coset's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the user-facing document-reading features you asked for. We do not sell it. We do not use it for advertising. We do not allow people to read it, except with your permission, for security, or to comply with law. We do not use it to develop, improve or train generalised AI or machine-learning models.
- Your control: you can remove the connection in Coset, and revoke Coset's access any time at myaccount.google.com/permissions.
6. Who processes your data
We use these companies to run Coset. We add a company to this list before it receives your data.
| Company | What it sees | Status |
|---|---|---|
| Microsoft Azure | everything we store: hosting, database, file storage, keys | in use |
| Anthropic | your question and the passages, figures and tool results needed to answer it | in use |
| Voyage AI | document text, to index it, and your question, to search | in use |
| Intuit | the QuickBooks connection | in use if you connect QuickBooks |
| Cloudflare | a bot check at sign-up | in use |
| Netlify | this website, and what you type into the demo form | in use |
| Other model providers | the same passages as above | only if someone in your business chooses one of their models |
| Scanned-page reading, text classification, and app-connection services | page images or short text | not used for customers today |
We do not sell your data. We do not train models on your data. Each provider's own terms govern what they do with what we send them, and we will tell you what we hold on that on request.
7. Where your data lives
Our application and data are hosted on Microsoft Azure in the United States. Our model and search providers process data on their own infrastructure. Their regions are not yet confirmed in writing. Ask us if this matters to you.
8. How long we keep it, and deletion
- We keep your data until you ask us to delete your business. Financial history and the audit trail are append-only, so they are removed only when the whole business is deleted.
- After deletion, database backups hold older copies for up to 35 days. Log retention, and each provider's own retention, are not yet confirmed in writing. Ask us what we hold.
- Today, deleting is a request. Email hello@trycoset.com from the address on your account. We delete your business by a written procedure, then check the result and tell you what we did and what we could not check. Self-serve export and deletion are being built and are not available yet. We will update this section the day they are.
9. Security
Data is encrypted in transit (HTTPS) and at rest by Azure's platform encryption. Connection credentials are additionally encrypted with a key held in Azure Key Vault, per business. We do not yet have a SOC 2 or ISO 27001 report, and we have not yet had an independent penetration test. To report a security concern, email hello@trycoset.com with "Security" in the subject.
10. Your choices
You can disconnect any connection in Coset, ask what we hold about you, and ask us to delete your business. Coset is built for businesses. It is not directed to anyone under 18.
11. Changes
When we change this policy we will post the new version here and change the effective date. For a material change we will tell business owners by email.