Privacy Policy

Updated August 8, 2026

Core Principles

Coywolf operates on several fundamental commitments: thoughtful collection of personal information, retention only when necessary, non‑sale of personal data, use of privacy‑compliant analytics, and transparency regarding information handling.

Scope

This policy covers Coywolf’s publishing, media, productivity, and support services across multiple domains, including coywolf.llc, coywolf.com, coywolf.io, contact.garden, glossary.io, recollect.fyi, essential.support, and others. It applies to Recollect and to Essential Support. Services with separate privacy policies are excluded.

Our two roles: controller and processor

We handle personal information in two different capacities, and it matters which applies:

• When we act as a controller. For our own websites and for people who hold accounts with us directly — including Recollect users, and Essential Support Workspace Owners and their Agents — Coywolf decides how and why personal information is processed and acts as the controller (or “business”).
• When we act as a processor for Essential Support. Essential Support is a multi‑tenant help desk. When an End User contacts a Workspace Owner through Essential Support, the personal information in those interactions (for example, ticket content, messages, attachments, and customer profiles) is processed by Coywolf on behalf of, and under the instructions of, the Workspace Owner. For that data, the Workspace Owner is the controller (or “business”) and Coywolf is a processor (or “service provider”). The Workspace Owner’s own privacy policy governs its collection and use of that data. If you are an End User and want to exercise privacy rights or ask how your data is used, please contact the Workspace Owner that operates the support portal you used. The processing of this data is governed by our Essential Support Data Processing Addendum, which each Workspace Owner accepts on a self‑serve basis when creating or operating a Workspace.

Information We Collect

Information you provide:

• Account registration details (such as name and email) and, for organizations and Workspaces, organization/Workspace details and Agent details;
• Payment and transaction information (processed by our payment processor; we do not store full card numbers);
• Content you create or upload — including Recollect notes, documents, comments, tags, images, and files; and Essential Support tickets, messages, attachments, knowledge‑base content, templates, and configuration;
• Support communications, feedback, and survey responses.

Information collected automatically:

• Log data such as browser type, IP address, unique device identifiers, and language preference;
• Usage patterns and page views; product analytics and activity signals (for example, event beacons);
• Approximate location derived from IP address;
• Cookies and similar technologies, including authentication/session cookies, security tokens (such as CSRF tokens), and preference storage (see “Cookies and Similar Technologies”);
• Web beacons in email communications;
• Privatized session recordings and error diagnostics via Sentry;
• Security and anti‑abuse signals, including IP addresses used for rate limiting and audit logs, and bot‑mitigation checks (Cloudflare Turnstile).

Information from third parties:

• Identity information passed to us to sign you in, including single sign‑on (SSO) handoff from an Essential Support Workspace Owner’s application and connected social‑media accounts;
• Avatar images from Gravatar based on a hash of your email address;
• Community‑maintained lists used to screen disposable email domains.

Cookies and Similar Technologies

We use strictly necessary cookies and similar technologies to keep you signed in (including host‑only session cookies), to protect against cross‑site request forgery and abuse, and to remember preferences. We do not use third‑party advertising cookies and do not sell personal information. We do not use analytics or tracking cookies that require consent. You can control cookies through your browser settings, though disabling necessary cookies may prevent sign‑in or break features.

How We Use Information

Coywolf uses data to provide, secure, and operate the Services; to authenticate users and prevent fraud and abuse; to process payments; to provide customer support; to analyze usage and improve and develop features; to communicate with users, including sending service and transactional messages; to personalize experiences; and to comply with legal obligations and enforce our terms.

For users in the EU/UK, our processing relies, depending on the context, on: performance of a contract; compliance with a legal obligation; our legitimate business interests (such as securing and improving the Services); consent (which you may withdraw); or protection of vital interests. For Essential Support End User data that we process on a Workspace Owner’s behalf, the Workspace Owner is responsible for establishing the legal basis.

AI processing

Some features of the Services use artificial intelligence to provide functionality such as summaries, suggested replies, automated answers, ticket classification and routing, and translation. To provide these features, relevant content may be sent to third‑party AI providers (for example, Anthropic, OpenAI, and Google) acting as our sub‑processors, or, where an Essential Support Workspace configures its own AI key, to the provider associated with that key under that provider’s terms. We do not sell your content. When a feature uses Coywolf’s own AI provider keys, we have opted out of AI‑model training, and our AI sub‑processors do not use your content to train their foundation models except as necessary to provide the feature you use. When an Essential Support Workspace Owner configures its own AI provider keys, that processing is governed by the Workspace Owner’s configuration and the applicable AI provider’s terms, which may permit the provider to use content for model training; in that case the Workspace Owner is responsible for that configuration, and End Users with questions or concerns should contact the Workspace Owner rather than Coywolf.

Encryption

Recollect note content is encrypted at rest on our servers. It is not end‑to‑end encrypted — that is, it is not encrypted solely with keys that only you hold (as with a service like Signal). Images and certain attachments are not encrypted (see the Terms of Use regarding image storage and CSAM scanning). For Essential Support, per‑workspace signing secrets and provider API keys are encrypted at rest.

How We Share Information

We do not sell our users’ personal information, and we do not “share” it for cross‑context behavioral advertising. We disclose information in the following ways:

• Service providers / sub‑processors. We share information with vendors that help us operate the Services, by category: hosting and infrastructure (for example, Render, MongoDB Atlas, Rocket.net, and GitHub); storage, content delivery, and security (for example, Cloudflare — including Cloudflare Images, Cloudflare R2 storage, and Cloudflare Turnstile — and Backblaze B2 and Amazon S3 for object storage); email delivery and intake (for example, SendGrid and Campaign Monitor); payment processing (Stripe); error monitoring and session diagnostics (Sentry); malware scanning (Sieve Nexus using ClamAV); and AI providers (for example, Anthropic, OpenAI, and Google), subject to Workspace configuration.
• Within Coywolf. With our subsidiaries, members, and employees who need the information to operate the Services.
• Legal and safety. With authorities or others when required by law, to comply with legal process, or to protect the rights, property, or safety of Coywolf, our users, or the public. This includes reporting apparent child sexual abuse material to the National Center for Missing and Exploited Children (NCMEC), as described in the Terms of Use.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to this policy.
• Aggregated or de‑identified information. We may share information that does not identify you.

International Data Transfers

We are based in the United States, and we store data in the United States. Content may be cached and delivered from global edge locations by our content‑delivery provider (Cloudflare) in order to serve pages and assets, but durable data storage occurs in the United States. If you access the Services from outside the United States, you understand and agree that your information will be transferred to, stored, and processed in the United States, where data‑protection laws may differ from those in your country. By using the Services, you consent to this transfer.

Retention

We retain information only as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Web server logs are kept for a minimum of 30 days. When you delete content or cancel your Account, we delete the associated data, and residual copies in routine backups are purged in the ordinary course. For Essential Support End User data, we retain and delete data in accordance with the Workspace Owner’s instructions and configuration.

Security

We implement reasonable technical and organizational measures designed to protect information against unauthorized access, alteration, disclosure, or destruction, including encryption in transit, encryption of sensitive secrets at rest, access controls, malware scanning, and multi‑factor authentication options. No service is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting personal information, we will respond as required by applicable law.

Your Rights and Choices

You may limit the information you provide, opt out of marketing communications, control cookies through your browser, and close your Account. Depending on where you live, you may have additional rights:

• EU/UK/Switzerland (GDPR/UK GDPR). Rights to access, correct, delete, restrict or object to processing, data portability, and to lodge a complaint with your supervisory authority; and to withdraw consent where processing is based on consent.
• California and other U.S. states (including CCPA/CPRA). Rights to know/access, delete, and correct personal information; to opt out of “sale” or “sharing” (note: we do not sell or share personal information for cross‑context behavioral advertising); and to non‑discrimination for exercising your rights. You may use an authorized agent where permitted.

To exercise rights with respect to data for which Coywolf is the controller, contact us using the details below. If your request concerns data processed through an Essential Support Workspace (for which the Workspace Owner is the controller), please contact that Workspace Owner; we will assist the Workspace Owner as its processor.

Children

The Services are intended for adults eighteen (18) years or older. We do not knowingly collect personal information from anyone under eighteen; if we learn we have, we will delete it. Contact us if you believe a minor has provided us information.

Changes to This Policy

We may update this policy from time to time. When we make material changes, we will provide notice through the Services or by email and update the “Updated” date and change log below.

Contact

Coywolf, LLC
2020 Fieldstone Parkway, Suite 900‑122
Franklin, TN 37069

privacy@coywolf.llc

Change log

1. October 7, 2018: Privacy Policy created and published.
2. July 31, 2026: Prior published version (core principles; scope across Coywolf publishing/media domains; collection, use, sharing, retention, security, and user‑rights sections).
3. August 8, 2026: Comprehensive revision. Added the controller/processor distinction and Essential Support processor role; added Recollect and essential.support to scope; expanded the categories of information collected (Workspace/Agent data, content, cookies/security signals, SSO and third‑party sources); added a Cookies and Similar Technologies section; added an AI processing section (third‑party AI sub‑processors and no‑training commitment); added an Encryption section; expanded the sharing section with categorized sub‑processors and a no‑sale/no‑share statement; added International Data Transfers; expanded Retention and Security; added California/U.S. state privacy rights alongside GDPR; aligned the children’s age with the Terms of Use (eighteen); and added a Changes to This Policy section and this change log.