Privacy Policy

Effective Date: May 14, 2026 Last Updated: October 9, 2026

Introduction

CellCog AI Inc. ("CellCog", "we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered chat service at cellcog.ai (the "Service").

By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with the terms of this policy, please do not access or use the Service.

Information We Collect

Information You Provide

• Account Information: When you create an account, we collect your email address, name, and authentication credentials through Firebase Authentication.
• Profile Information: You may optionally provide additional profile information such as a profile picture or description.
• Chat Content: We store the messages and content you create within our Service to provide you with chat history and continuity.
• Uploaded Files: Any documents, images, or files you upload to the Service for processing or analysis.
• Project Information: If you create or join a project workspace, we collect project name and your role within that organization.
• Google Drive Integration: If you connect your Google Drive, we access only the files you explicitly select for import, using read-only permissions.
• AI Employee Data: If you create an AI Employee, we collect and store its configuration (name, role, routines, tool selection, and the business name shown in its signature), its mailbox (sent and received email and attachments, including the personal data of the people it corresponds with), its memory and work artifacts (see "AI Employee Memory" below), its browser profile (see "Cloud Browsers" below), and records of actions it takes on your connected accounts.
• Organization Information: Every account has a personal organization and may belong to other organizations it creates, is invited to, or joins through its email domain where that organization's administrators allow it. We store your organization's name and postal address, your role and team within it, and the reporting line your administrators define. Your name, email address, role, and team are visible to the other members of your organization.

Browse my Chrome (Chrome Extension)

If you install the CellCog Browse Chrome extension and connect it to the CellCog Desktop app, your CellCog AI agent can drive a designated tab group inside your Chrome browser. While Browse my Chrome is enabled for a chat:

• What the agent can access: The contents of pages inside the "CellCog" tab group only — this includes page text, the accessibility tree, form values, and the URL of each tab. The agent acts on tabs you have explicitly brought into the workspace.
• What the agent never accesses on its own: Tabs outside the CellCog tab group, browsing history, bookmarks, saved passwords, or any tab the user has not adopted into the workspace.
• Sensitive data redaction: Password fields and credit-card fields are automatically redacted before any page content is read by the agent.
• Cookies, localStorage, and session data: These are NOT auto-redacted. If the agent's script explicitly reads them (e.g., to authenticate an API call on your behalf), the data is included in the chat session and visible to the AI.
• Screenshots: When the agent captures a page screenshot, the image is saved to a temporary directory on your machine and made available to the chat. Screenshots may include any content visible in your browser, including private surfaces like email or banking pages.
• Where the data flows: Locally between Chrome and CellCog Desktop (the extension itself sends nothing to our servers). Once the agent reads page content as part of completing your task, that content becomes part of your chat session and is transmitted to the LLM provider serving that chat (see "Data Sharing and Disclosure" below).
• User control: Chrome shows a yellow "CellCog Browse started debugging this browser" banner on every controlled tab. You can revoke control at any time by clicking "Cancel" on that banner. You can set an auto-approval threshold to require explicit approval for actions above a chosen risk level.
• What the extension stores: Nothing of its own.

CellCog Desktop (Cowork)

If you install the CellCog Desktop app and grant it access to a working directory on your machine (Cowork), your CellCog AI agent can read files, write files, and run terminal commands inside that directory:

• What the agent can access: Files and directories inside the working directory you explicitly chose. The agent classifies each file operation or command as safe, moderate, or dangerous and either runs it or requests your approval, based on your approval level, which also covers Browse my Chrome, your AI Employees' browsers and your connected tools.
• What the agent does NOT access on its own: Files outside your chosen working directory, system credentials (e.g., SSH keys, browser cookie stores), or any blocked path. Certain sensitive paths are blocked, and credentials in command output are redacted.
• Where the data flows: Locally between the Desktop app and CellCog's servers over your authenticated session. File contents and command outputs that the agent reads as part of completing your task become part of your chat session and are transmitted to the LLM provider serving that chat (see "Data Sharing and Disclosure" below).
• User control: You see every command and file change in an approval card before it runs (unless it falls within the approval level you chose). You can revoke working-directory access at any time from the CellCog Desktop app.

AI Employees

An AI Employee is a standing AI agent you create that works on demand and on the routines you define, has its own email address, its own memory, its own browser, and can take actions on your behalf. Two points matter most up front: (1) every email your AI Employee sends names you, the human supervisor, with your email address, so recipients always know who is accountable; and (2) because your AI Employee corresponds with other people, we process the personal data of those people (most of whom are not CellCog users) on your behalf. When you create and run an AI Employee, the following additional data practices apply.

• Its own email address. Each AI Employee is assigned an address at @cellcog.com and can send and receive email there. We store the email it sends and receives — including message content, headers, recipients, timestamps, and attachments — to provide threading, history, and continuity across its work sessions, in the same way we store your chat history.
• Email from and to other people. Because your AI Employee sends and receives email, we necessarily process the personal data of the people it corresponds with (their email address, name, message content, and anything they choose to include). Most of these people are not CellCog users. You direct who your AI Employee contacts and you are the party with the relationship to those recipients (see "Your Responsibilities for People Your AI Employee Contacts" below). We process this correspondence solely to operate your AI Employee's mailbox on your behalf; we do not use it to build independent profiles of those individuals or for our own marketing.
• Your identity is shown on every email (by design). Every email your AI Employee sends carries a signature identifying it as an AI Employee and naming you, the human supervisor, with your account email address. This is intentional and cannot be removed: a recipient must always be able to see that there is an accountable human behind the AI and to reach that human directly. By running an AI Employee, you consent to your name and account email being disclosed to the recipients (and repliers) of its email. If this is not appropriate for your use case, do not use the AI Employee email feature.
• Actions on your connected accounts. If you enable Personal Tools or other integrations for an AI Employee, it can take actions on the third-party accounts you connect (for example posting, messaging, or reading data) on your behalf, autonomously, within the permissions you granted. Those actions and their data are governed by this Policy and by the third party's own terms. You can disconnect any integration at any time.
• Autonomous, routine-driven processing. An AI Employee may process data and take actions while you are not present: on the routines defined for it (by you, by the employee itself in conversation with you, or by another AI Employee in your organization), or when woken by a message from you, a mention in a channel or direct message, an inbound email, a task or comment, or a trigger you configured (for example a new message in a connected app). Content it reads to do its work (emails, files, channel and task content, web pages, connected-app data) becomes part of its session and is transmitted to the LLM provider serving it, as described in "Data Sharing and Disclosure."
• Retention & deletion. An AI Employee's mailbox, memory, and workspace are retained until you delete the AI Employee or your account. Deleting an AI Employee deletes its associated data on the same basis as deleting a chat (see "Data Retention").
• Sharing within your organization. If you share an AI Employee with other members of your organization, they see everything you see about it (its conversations, mailbox, tasks, files, memory, and settings) and their messages reach the employee as if they came from you.

AI Employee Memory

An AI Employee keeps memory so that it can carry your context from one work session to the next. That memory is about you and your work and may include personal data you or your colleagues share with it.

• What it keeps. Semantic memory (facts it has learned about you, your business, your preferences, and your decisions), skills (methods it has developed for recurring work), episodes (narratives of notable events it lived through with you, kept because you or it judged them significant), work notes and handovers between sessions, and the files it produces.
• Where it lives. In the employee's own workspace on CellCog infrastructure, together with the rest of its files (see "Data Storage and Security"). Skills and canon placed in your Organization Drive are shared with your organization instead (see "Organization Surfaces" below). Memory content is provided to the AI models that serve the employee as context for its work, as described in "Data Sharing and Disclosure."
• Your control. You can browse the employee's workspace, including its memory files, from the Files app of its Employee Computer, and you can instruct the employee to correct, update, or forget what it remembers. Memory is not used to build profiles of you for our own purposes or for advertising.
• Retention. Memory is retained for as long as the employee exists and is deleted with the employee or your account.

Cloud Browsers (Your AI Employee's Own Browser)

Separately from Browse my Chrome (which drives your own Chrome on your own machine), each AI Employee can browse the web through a persistent browser hosted on CellCog infrastructure, managed on the Cloud Browsers page. When you use Cloud Browsers:

• Browser profile data. Each cloud browser is a separate browser profile that keeps the cookies, local storage, cached site data, browsing state, and logins entered into it, so that the employee stays signed in to the sites you gave it access to between work sessions. This profile data is stored on CellCog infrastructure per profile. By default each employee gets its own browser with separate identities and logins; if you assign several employees or chats to one browser, they share its profile data and logins.
• Logins you enter. You can open a live view of a cloud browser to log the employee into a site yourself. Anything you type in the live view, including usernames and passwords, is entered into that browser's profile exactly as if you had typed it into any browser, and is stored there for the employee's later use. While the live view is open, images of the browser page are streamed to your screen.
• What the employee reads. Page content the employee reads through a cloud browser (page text, form values, screenshots it captures) becomes part of its session and is transmitted to the AI model serving it, as described in "Data Sharing and Disclosure." Websites the employee visits see a connection from CellCog's servers, not from your network.
• Where the data flows. Between CellCog's browser infrastructure and the websites the employee visits, and between that infrastructure and your screen while a live view is open. Profile data is not sent to your machine.
• Deletion and retention. Deleting a cloud browser deletes its stored profile, including its logins, and the employees assigned to it start with a fresh browser on next use. Deleting your account deletes all of your cloud browsers and their stored profiles. Cloud browser profiles are otherwise retained for as long as they exist in your account.

Purchases With Link (Spend)

If you connect your Link wallet and let an AI Employee buy things for you:

• What we keep. Your Link connection, stored encrypted so we can send purchase requests for your approval, and a record of each purchase: the merchant, the items, the amount, what the employee wrote about it, every status change, the confirmation, and the card's brand and last four digits.
• The one-time card. For each purchase you approve, Link issues a one-time card that works once, only at that merchant, for that amount. We place it into the checkout form in the employee's browser. Screenshots the employee takes at checkout can show this one-time card; they stay with the chat like any other screenshot and are sent to the AI model serving the employee. When you ask the employee to pay in your own Chrome, it receives the one-time card as text and types it into the checkout; the card is then part of the chat and is sent to the AI model serving the employee. Your real card never reaches CellCog.
• Your control. You approve every purchase in Link and can disconnect Link at any time in the Spend app; purchase records stay with the employee as history.

Organization Surfaces (Data Shared Within Your Company)

Every CellCog account has a personal organization with a single member and may also belong to other organizations; the members of an organization are the people its administrators invited or allowed to join. Inside an organization, several surfaces are shared by every active member and by all of their AI agents and AI Employees:

• The task board. Every task in your organization, including its title, description, comments, assignees, and history, can be read, commented on, and edited by every member of the organization and by every AI Employee in it.
• Channels and direct messages. Channels are readable by every member of the organization, whether or not they have joined. Direct messages are visible to their participants; a direct message that includes a human is visible only to its participants, and a direct message between AI Employees only is additionally visible to a human whose reporting line covers every participant. Administrators have no extra right to read direct messages. Emoji reactions are shown to everyone who can read the message.
• The Organization Drive. Files placed in the Organization Drive, including the organization's shared skills (methods) and canon (facts), are readable and writable by every member and their agents, and the skills and canon are automatically provided to every agent working for a member of the organization.
• Shared documents, members, and teams. Documents on the Organization page, the member list (names, email addresses, roles, join dates), and the team tree are visible to every member.
• The lead database. Leads found or imported by any AI Employee in the organization, together with their enrichment and research, are shared across the organization (see "Cold Outreach: Lead Records and Suppression" below).

Content you or your AI Employees place on these surfaces is visible to every current and future member of your organization, and remains with the organization if you leave it or your membership is deactivated. An administrator of your organization can invite people at the organization's domain, change roles, and deactivate and reactivate members; deactivation locks the member's account without deleting their data. Do not place personal data on shared surfaces unless every member of your organization may see it. For the personal data of third parties (for example customers or leads) that your organization places on these surfaces, your organization determines the purposes of processing and CellCog processes it on your organization's behalf.

Your Own MCP Servers and Keys

• MCP servers. You can add your own remote MCP servers on the MCP servers page, with no authentication, with an API key you supply, or by signing in to the server with OAuth where it supports that. We store the server's address, its authentication mode, and a snapshot of the tools it exposes. When an agent calls one of those tools, the request (the arguments the agent composes, which may include your content) is sent to that server through our integration provider (Composio), and the server's response is returned to the agent's session. The server is operated by a third party under its own privacy policy; CellCog does not control what it does with the data it receives. API keys and OAuth tokens for MCP servers are held by our integration provider to authenticate those calls. Removing a server stops further calls and removes its stored configuration.
• Keys. The Keys page stores raw credentials (API keys, tokens, and similar secrets) by name, either captured automatically when you connect a tool or added by you. Key values are encrypted at rest, are never displayed again after you save them, and are decrypted only to make them available in the isolated workspace environment of an agent for which you enabled the corresponding tools (a chat, or an AI Employee, according to its tool selection). Keys are never sent to your own computer. Agents can read the value of any key made available to them and may send it to the third-party service the key belongs to. You can delete a key at any time; deletion removes it from future agent runs.

Apps You Publish and Their Data Store

Agents can build web applications for you and host them at cellcog.ai/app URLs. An app is private to you (and to the people an AI Employee is shared with) until you make it public through the Share control, which publishes it as a Post. Apps may store data through CellCog's app data store:

• Visitor data. Data submitted to your app by its visitors (for example form entries or RSVPs) is stored in the app data store on CellCog infrastructure, tied to the chat that built the app. Anyone who can open the app, including anonymous visitors of a public app, can read and write that app's data. To limit abuse, we apply per-app quotas and rate limits; for anonymous visitors those rate limits use the visitor's IP address.
• Your responsibility. You determine what your app collects and why; CellCog stores that data on your behalf. You must have a lawful basis for any personal data your app collects from its visitors and must tell them how you use it.
• Retention. App data is retained until you delete it through the app or the agent, or until the chat that built the app or your account is deleted. Public apps may also be taken down by CellCog if they violate our Terms.

Voice Calls on Our Blog

On some posts on our blog you can talk with the AI employee credited on the post in a short voice call (up to 5 minutes), without an account. Before the call starts we tell you that you are talking with an AI and that we keep the transcript for 30 days, and the call starts only when you tap to talk and allow your browser to use your microphone.

• What we collect. Your voice during the call, a written transcript of the conversation, the post you called from, how long the call lasted and how it ended, and the role and first tasks the employee suggests for you. We don't record the audio.
• Where your voice goes. Your voice streams from your browser to OpenAI's realtime voice model in the United States, which hears and answers you as our service provider. OpenAI does not use it to train its models and may keep it for up to 30 days to monitor for abuse.
• Abuse protection. Google reCAPTCHA Enterprise checks each call start. To limit how many calls a visitor can make each day, we keep a salted one-way hash of your IP address, never the address itself, and delete it after 3 days.
• Retention. We delete the transcript and the suggested tasks after 30 days. We keep the rest of the call record (the post, the call's length and the suggested role) to measure and improve these calls.
• If you sign up. "Start this" carries the suggested role and tasks to our sign-up and hiring pages, and we link the call to your new account so we can see which calls lead to sign-ups.

Meetings and Phone Calls With AI Employees

You can talk with your AI Employee by voice in its chat, invite it to Google Meet or Zoom, and give it a phone number it answers and calls from.

• Where the voice goes. What is said in a meeting or call streams to OpenAI's realtime voice model in the United States, which hears and answers as our service provider. We send it with storage turned off. OpenAI does not use it to train its models and may keep it for up to 30 days to monitor for abuse.
• Google Meet and Zoom. Your AI Employee joins through Recall.ai (United States), which captures the meeting's audio to transcribe it. With recording on, Recall.ai also captures the video, and the recording is saved in your AI Employee's workspace. Recall.ai deletes its copy of the meeting's media shortly after the meeting, and in any case within 72 hours.
• Phone calls. Calls are carried by Twilio, which connects the call to OpenAI's voice model. Calls are never recorded as audio.
• Meetings in the chat are never recorded as audio.
• Transcripts. Every meeting and call is transcribed with speaker names and kept with your AI Employee's records (the Meetings and Phone apps).
• Recording. Recording is off by default and applies only to Google Meet and Zoom. If you turn it on, your AI Employee announces it at the start of each meeting. Where the law requires every participant's consent to recording, obtaining it is your responsibility.
• Other people. Meeting participants and callers are often not CellCog users. We process their voice and words on your behalf, as described in "Your Responsibilities for People Your AI Employee Contacts".

Cold Outreach: Lead Records and Suppression

If your AI Employees run cold outreach, the following additional data practices apply, in addition to the "AI Employees" and "Google User Data (Gmail)" sections:

• Lead records. Leads your employees find through connected data providers or import are stored in your organization's lead database, together with contact and company details, the enrichment data returned by the providers you connect, the employee's saved research notes about the lead, and the history of contact with that lead (sends, replies, holds, transfers between employees). Lead records are organization assets: they persist when the employee that found them is deleted and remain until your account or organization is deleted. You are the controller of this data (see "Your Responsibilities for People Your AI Employee Contacts").
• Compliance identity. Your organization's (or, for a personal organization, your own) name and postal address are included in the footer of every cold email your employees send, as required by anti-spam law. You enter them in your settings; they are visible to every recipient.
• Platform-wide suppression list. When a recipient unsubscribes, an address hard-bounces, or a recipient reports a message as spam, we record that address and the reason in a suppression registry shared across all CellCog sending domains, so that no CellCog user's AI Employee contacts that address again. We also record address-verification results obtained from our email verification provider. This registry contains the email address and its deliverability state; it is not tied to your account, is used solely to honor opt-outs and protect deliverability, and is retained as a compliance record independently of your account.
• Test sends. A test lead sends the outreach sequence to your own email address to let you verify it before it reaches anyone else.

Google User Data (Gmail)

CellCog connects to Google's Gmail API using OAuth, with your explicit authorization, in two situations. Both use the Gmail mail scope (https://mail.google.com/); what we actually do under it in each situation is described below.

1. Dedicated outreach mailboxes. If you use CellCog's cold-outreach feature, your AI Employee sends and receives email through dedicated outreach mailboxes — Google Workspace mailboxes on separate sending domains provisioned specifically for your outreach (never the Gmail account of any recipient). For these mailboxes:

• Read: We read messages arriving at your outreach mailboxes so your AI Employee can see and respond to replies from the people you contacted. We poll each connected mailbox for new messages and store the correspondence in your AI Employee's mailbox history, exactly as described in the "AI Employees" section above.
• Send: We send email from your outreach mailboxes on your behalf — the outreach messages and replies your AI Employee composes under your direction and within the sending limits and approvals you configured.

2. Your own Gmail account (optional). If you choose to connect your own Gmail account to your AI assistant, it can manage that mailbox at your direction: reading and triaging mail, sending and replying, organizing messages with labels and filters, managing drafts, deleting messages you ask it to remove, and looking up your own contacts (read-only, via Google People API scopes you approve at connection time) to resolve recipients. Automated actions are governed by the permissions and approval settings you configure; deletion only ever occurs at your explicit direction. You can disconnect your Gmail account at any time from CellCog or from your Google account's security settings, which revokes our access.

What we do with this Gmail data — and what we don't:

• We use Gmail message data solely to provide these features to you: reading and triaging mail, threading conversations, sending mail you directed, and managing your mailbox at your direction. Message content your AI assistant reads to do its work is transmitted to the LLM provider serving it, which does not use it to train its models, as described in "Data Sharing and Disclosure."
• We do not use Gmail data for advertising. We do not sell it. We do not use it to train machine-learning or AI models. Humans do not read it, except with your explicit permission, where necessary for security or abuse investigation, to comply with applicable law, or where the data has been aggregated and anonymized for internal operations.
• OAuth access tokens for connected mailboxes are encrypted at rest, and access is limited to the systems that operate the mailbox on your behalf.
• You can disconnect any connected mailbox at any time (or delete your outreach domains), which revokes our access; you can also revoke access directly from your Google account security settings or Google Workspace admin console. Stored correspondence follows the retention rules above.

Limited Use disclosure: CellCog's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google User Data (Google Analytics — your connected account)

Separately from the analytics cookies on our own website (described under "Cookies" below), you can optionally connect your own Google Analytics account to your AI assistant using OAuth, with your explicit authorization. When you do:

• Read (analytics.readonly): Your AI assistant reads reports and metrics from your connected Google Analytics properties to answer the questions you ask about your website traffic and marketing performance.
• Manage (analytics, analytics.edit): At your explicit direction, your AI assistant can manage your Google Analytics configuration — for example creating or updating properties, data streams, custom dimensions, and conversion events as part of analytics setup you requested. Every configuration change is initiated by your instruction and governed by the permissions and approval settings you configure.

We use your Google Analytics data solely to provide these features to you. Report data your AI assistant reads to do its work is transmitted to the LLM provider serving it, which does not use it to train its models, as described in "Data Sharing and Disclosure." We do not use your Google Analytics data for advertising, do not sell it, and do not use it to train machine-learning or AI models; humans do not read it except with your explicit permission, where necessary for security or abuse investigation, or to comply with applicable law. OAuth tokens are encrypted at rest. You can disconnect your Google Analytics account at any time from CellCog or from your Google account's security settings, which revokes our access.

The Limited Use disclosure above applies equally to Google Analytics data received through Google APIs.

Your Responsibilities for People Your AI Employee Contacts

When you direct an AI Employee to contact people (for example, outreach emails), you are responsible for having a lawful basis to contact them and for complying with applicable anti-spam and data-protection laws — such as the U.S. CAN-SPAM Act, Canada's CASL, and the EU/UK GDPR and e-Privacy rules — including honoring opt-out and unsubscribe requests. For this correspondence, you determine the purpose and means of contacting your recipients (you act as the data controller for your outreach), and CellCog processes the correspondence on your behalf to operate the mailbox. A recipient who wishes to stop hearing from your AI Employee, or to exercise data-protection rights, can reply to the email or contact the human supervisor named in the signature; such requests are directed to you as the responsible party, and we will reasonably assist and, where we act as a processor, act on your documented instructions. See the Acceptable Use and AI Employees sections of our Terms of Service.

Information Collected Automatically

• Usage Data: We collect information about how you interact with our Service, including features used, time spent, and actions taken.
• Device Information: We may collect information about your device, including browser type, operating system, and device identifiers.
• Log Data: Our servers automatically record information including IP address, browser type, referring/exit pages, and timestamps.

Cookies and Tracking Technologies

What Are Cookies?

Cookies are small text files stored on your device when you visit our website. They help us provide you with a better experience and understand how you use our service.

Types of Cookies We Use

1. Essential Cookies (No Consent Required)

These cookies are necessary for the website to function and cannot be switched off.

• Cookie Name: session
• Purpose: Authentication and session management
• Provider: Firebase (Google)
• Duration: Session-based (deleted when you close your browser)
• Legal Basis: Strictly necessary for service provision (GDPR Article 6(1)(b))

2. Analytics Cookies

These cookies help us understand how visitors interact with our website. Whether we ask for consent before setting them depends on where you are (see "Managing Your Cookie Preferences" below): in regions whose law requires opt-in consent — the EU/EEA, United Kingdom, Switzerland, China, Canada, and South Korea — these cookies are set only after you accept; elsewhere they are used by default and you can turn them off at any time.

• Cookie Names: _ga, _ga_* (Google Analytics 4)
• Purpose: Measure website traffic, user behavior, and feature usage
• Data Collected:
  • Pages visited and time spent
  • Click patterns and navigation paths
  • Device type, browser, and operating system
  • Geographic location (country/city level)
  • Referral source (how you found us)
  • User interactions (signups, logins, feature usage)
• Provider: Google LLC
• Duration: Up to 2 years
• Data Transfers: To Google servers in the United States
• Legal Basis: Your explicit consent (e.g., GDPR Article 6(1)(a)) in opt-in regions; our legitimate interest in understanding and improving our service (with a working opt-out at all times) elsewhere

Google Analytics 4 Details

• Data Processing Agreement: We have a Data Processing Agreement with Google LLC
• IP Anonymization: Enabled by default to protect your privacy
• Data Retention: 2 months for event-level data, 14 months for user-level data (automatically deleted after)
• Google Signals: Disabled (no cross-device tracking)
• Google Ads link: Our Google Analytics property is linked to our Google Ads account so that signups on our site can be counted as conversions for our own ads (see "Advertising Measurement (Google Ads)" below).

Advertising Measurement (Google Ads)

We advertise CellCog on Google Search and YouTube. To learn which ads bring people to CellCog, we measure ad performance in two ways:

• Signup conversions in Google Ads. When a visitor who came from one of our ads signs up, that signup can be counted as a conversion for the ad in our Google Ads account, as described in the next point. Our site does not load a separate Google Ads tag. In regions whose law requires opt-in consent, Google's advertising storage and advertising user data signals stay "denied". Elsewhere they are on by default so Google can count signups from our own ads, and they turn off if you reject analytics under "Cookie preferences" or your browser sends Global Privacy Control. Ad personalization is set to "denied" for every visitor.
• Our own attribution record. A link from one of our ads carries a Google Ads click identifier (such as gclid, gbraid or wbraid) and campaign details (such as utm_term and utm_content). We keep these in our first-party record of how you first arrived (cellcog_first_touch) and attach it to your account at signup, so we can see which ads bring people who go on to use and pay for CellCog. In regions whose law requires opt-in consent, we keep the click identifier only after you accept analytics cookies. If you reject analytics cookies or your browser sends Global Privacy Control, we delete it. For signups in the United States who have not opted out, we send Google Ads only the click identifier and the time of signup, so Google can count the signup as a conversion for our own ad. Google receives this as our service provider, under restricted data processing: we do not send your name, email address or other contact details, and it is not used to build advertising profiles or for remarketing. We send nothing from this record to Google for anyone outside the United States or anyone who has opted out.
• How we have configured it. Our advertising is currently configured without remarketing (we don't show you ads based on your visits) and without sending your email address or other contact details to Google for advertising. If we change this configuration, we will update this Policy first. We don't sell your personal information.
• Your choices. You can opt out of advertising measurement at any time: turn off analytics under "Cookie preferences" in the page footer or under Privacy & Data in your account, or use Global Privacy Control, which we honor automatically. You can also manage Google's ad settings at adssettings.google.com. Some U.S. state privacy laws may treat disclosing information to an advertising platform as "sharing" or "targeted advertising"; these choices are how you opt out, and we apply your opt-out to advertising measurement.

Product Analytics and Session Replay (PostHog)

In addition to Google Analytics, we use PostHog (PostHog Inc., a US provider) for product analytics and session replay on our website, to understand how visitors and new users interact with CellCog and to improve the product experience.

• What is collected: page views, clicks, and interaction events; and for some sessions, a session replay — a reconstruction of how the page was used (mouse movement, scrolling, elements clicked).
• What is NOT collected: anything you type into input fields is masked at the source and never leaves your browser (passwords, form fields).
• Logged-in usage: for signed-in users, we collect product interaction events (pages viewed and product controls clicked, such as navigation items), associated with your account, to understand feature usage and improve the product. What you type into the product (messages, documents, form fields) is never collected as analytics. We do not record session replays of signed-in usage. Recordings from an earlier limited study period were made with input masking, are used only to improve the product, and are deleted automatically within 30 days.
• Account deletion: when you delete your CellCog account, the analytics person record associated with your account is deleted as well.
• Retention: session recordings are retained for up to 30 days by default, then deleted automatically.
• Your rights: you can request deletion of your analytics data or recordings by contacting us at the address in the Contact section.

Your Rights Regarding Analytics

• Access your analytics data via Google's privacy dashboard
• Request deletion of your analytics data by contacting us
• Opt-out using the Google Analytics Opt-out Browser Add-on
• Opt out or withdraw consent at any time via "Cookie preferences" in the page footer, or in your account under Privacy & Data (any region)
• Global Privacy Control (GPC): if your browser sends the GPC signal, we treat it as an opt-out of analytics cookies and advertising measurement automatically, everywhere, with no banner interaction needed

Managing Your Cookie Preferences

In regions whose law requires opt-in consent (EU/EEA, United Kingdom, Switzerland, China, Canada, South Korea): When you first visit our site, you'll see a cookie consent banner. You can:

• Accept all cookies
• Reject all non-essential cookies
• Customize your preferences

Analytics cookies are not set until you accept. If you don't interact with the banner, analytics stays off and we won't show the banner again for a while rather than asking on every visit.

Everywhere else (including the United States): We don't interrupt your visit with a banner. Analytics cookies are used by default to improve our service, and you can opt out at any time through:

• "Cookie preferences" (page footer), which opens the full consent panel
• Your account settings, under Privacy & Data (for signed-in users)
• The Global Privacy Control (GPC) browser signal, honored automatically as an opt-out of analytics and advertising measurement
• Your browser settings, or the Google Analytics Opt-out Add-on

Signed-in users: your cookie-consent choice is saved to your CellCog account, so it applies across all your browsers and devices and you won't be asked again.

List of Cookies and Local Storage

Some entries below are browser localStorage or sessionStorage values rather than cookies; we apply the same rules to all of them. Values marked "until cleared" stay on your device until you clear your browser storage or sign out; sessionStorage values are removed when the browser tab is closed.

We do not set remarketing or cross-site tracking cookies, and ad personalization is off for every visitor. Outside regions whose law requires opt-in consent, Google may set its advertising measurement cookies (_gcl_*) to count signups from our own ads, unless you opt out. How we measure our own ads is described in "Advertising Measurement (Google Ads)" above.

Browser Controls

Most browsers allow you to control cookies through settings:

• Chrome: Settings → Privacy and Security → Cookies
• Safari: Preferences → Privacy → Manage Website Data
• Firefox: Options → Privacy & Security → Cookies and Site Data

Learn more at: www.allaboutcookies.org

Note: Disabling cookies may affect your ability to use certain features of our Service.

How We Use Your Information

We use the collected information for the following purposes:

• To provide, maintain, and improve our Service
• To process and respond to your chat queries using AI technology
• To manage your account and provide customer support
• To send you notices about your account and the work it is doing and, where you have agreed or the law permits, product emails (see Emails We Send You below)
• To analyze usage patterns and improve user experience
• To detect, prevent, and address technical issues or abuse
• To comply with legal obligations and enforce our Terms of Service
• To facilitate collaboration features within project workspaces
• Showing where CellCog is used. We may display the name or logo of an organization whose people use CellCog (based on business email domains and what users tell us) on our website and marketing pages. We never display an individual's name, email address, or content this way. To opt your organization out, write to contact@cellcog.ai.

Emails We Send You

We send email in three categories:

• Account notices. Messages about the account you created and the work it is doing: a welcome when you sign up, a note when your company workspace is ready, a notice when work stops because your credits ran out, and a reminder when a report from your AI employee is waiting. These are part of providing the Service and are sent on the basis of our agreement with you. They continue while you hold an account.
• Product emails. News about new features, tips on getting more out of the Service, the roles people hire AI employees for, and a reminder if you signed up but have not started. These are promotional. Outside the United States, the separate box at signup is this choice; you can change it at any time under Settings, Notifications.
• Emails from the AI employee you hired. An AI employee you hire writes to you from its own @cellcog.com inbox about the work you gave it. Every such email is signed as an AI employee and names its human supervisor by email. An email that reports on your work is an account notice; an email in which the employee offers to take on new work is promotional and follows the rules below.

Whether we may send you promotional email depends on where you are:

• United States: we may send them until you opt out.
• EU/EEA, United Kingdom, Switzerland, Japan, Canada: we send them only if you chose to receive them with the separate, unticked box at signup. Leaving the box unticked never limits your use of the Service.
• Brazil: we rely on legitimate interest, with our assessment on file; you may object at any time.
• Other countries: we follow the local rule. Where we have not reviewed a country's rules, we send account notices only.

Every promotional email carries an unsubscribe link in its footer and a one-click unsubscribe header your email client can use; you can also reply to the unsubscribe address shown in the email. We honor your choice immediately and keep a record of it so that we do not email you again. Account notices continue while you hold an account; deleting your account stops them.

Signing in with Google shares only your name, email address and profile picture with us. It is not consent to promotional email.

Data Storage and Security

• Storage Location: Your data is stored on Google Cloud Platform servers located in the United States.
• Encryption: We use industry-standard encryption for data in transit (HTTPS/TLS) and at rest.
• Access Controls: We implement strict access controls and authentication mechanisms to protect your data.
• Third-Party Services: We use Firebase for authentication, Google Cloud Storage for file storage, MongoDB for database services, and Google Analytics for usage analytics.

Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• With Your Consent: We may share information when you give us explicit permission.
• Within Your Organization: Content within project workspaces may be visible to other authorized members. Content on your organization's shared surfaces (the task board, channels, the Organization Drive with its skills and canon, shared documents, the member list, and the lead database) is visible to every active member of your organization and their AI agents, and an AI Employee you share is visible in full to the members you share it with (see "Organization Surfaces" above).
• Service Providers: We share information with trusted third-party service providers who help us operate the Service. These include Google Cloud Platform (hosting and storage), Firebase (authentication), MongoDB Atlas (database), and Google Analytics (usage analytics).
• Payments (Stripe): Stripe processes payments for plans and credits. Your card details go to Stripe; we keep your plan, the payments you make and a Stripe customer reference.
• Bot Protection (Google reCAPTCHA Enterprise): Google reCAPTCHA Enterprise checks sign-ups and blog voice call starts to tell people from bots. Google receives information about your browser and how you interact with the page, under Google's Privacy Policy and Terms.
• Region Detection (IPinfo): When you open our website, your browser asks IPinfo for your country, based on your IP address, so we know whether to show a cookie consent banner.
• Email Delivery (AI Employees): We use SendGrid (Twilio) to send and receive your AI Employee's email. SendGrid processes the message content, recipients, and attachments of that email as necessary to deliver and receive it on your behalf.
• Outreach Mailboxes (InboxKit): For cold outreach, InboxKit registers the sending domains and creates the Google Workspace mailboxes your AI Employees send from. It receives the domain, mailbox addresses and display names.
• Meetings and Phone Calls (AI Employees): Recall.ai joins Google Meet and Zoom meetings for your AI Employee and transcribes them, and deletes the meeting's media within 72 hours. Twilio carries your AI Employee's phone calls. Each processes that audio as necessary to provide the service.
• Integration Provider (Composio): For connected tools and connected-app triggers (the wake conditions that can start an AI Employee), we use Composio to broker authorized access to the third-party services you connect. Composio processes the connection and the data passed to and from those tools to execute the actions you authorize. Calls to the MCP servers you add, and the API keys or OAuth tokens that authenticate them, are brokered by Composio in the same way. If you connect Linear, we connect to it directly with your authorization.
• Your Own MCP Servers: When an agent calls a tool exposed by an MCP server you added, the request and its arguments are sent to that server and its response is returned to the agent. The server's operator receives that data under its own privacy policy (see "Your Own MCP Servers and Keys" above).
• LLM Providers: To respond to your chat queries and complete agent tasks, we transmit your chat content — including messages, uploaded files, page content the agent reads (via Browse my Chrome), file/command output the agent reads (via Cowork), and the email content and connected-app data an AI Employee reads to do its work — to large language model providers. Current providers include Anthropic (Claude), OpenAI (GPT), and Google (Gemini). These providers do not use your content to train their models. They may keep it for a limited period to detect and prevent abuse, typically up to 30 days (including voice conversations in meetings, phone calls and blog voice calls) and up to 55 days for some Google models, and longer if it is flagged for abuse or the law requires it. The specific provider used for a given chat depends on the model selected for that chat.
• Media and Research Providers: To generate video, images, speech, music and 3D models, transcribe audio, analyze large files and run web research, we send the prompts, files and text the agent composes for that task to the provider performing it: Google (video, music, speech and file analysis models); OpenAI (images, speech and transcription); Recraft (icons and vector graphics); fal.ai (Features & Labels, Inc., United States), which runs some models through its partner providers, including ByteDance (video), MiniMax (speech and voice cloning) and Tencent (3D models); ElevenLabs (speech and dialogue); Perplexity (web research); and Supermeme (memes). The provider used depends on the task.
• Analytics Provider (Google): When you consent to analytics cookies, anonymized usage data is shared with Google LLC for analytics purposes.
• Advertising Measurement (Google): Google receives signup conversions for our own ads (for U.S. signups who have not opted out, only the ad click identifier and signup time) so we can measure which ads work, as described in "Advertising Measurement (Google Ads)". You can opt out at any time.
• Legal Requirements: We may disclose information if required by law or in response to valid legal requests.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred.

Your Rights and Choices

You have the following rights regarding your personal information:

• Access: You can request access to the personal information we hold about you.
• Correction: You can update or correct your account information at any time.
• Deletion: You can request deletion of your account and associated data.
• Portability: You can request a copy of your data in a portable format.
• Opt-out: You can stop promotional email at any time with the unsubscribe link or one-click header in any such email. Account notices continue while you hold an account.
• Cookie Preferences: You can manage your cookie preferences at any time.
• Advertising Measurement: You can opt out of advertising measurement through "Cookie preferences", your account's Privacy & Data settings, or Global Privacy Control (see "Advertising Measurement (Google Ads)").
• Google Drive: You can disconnect Google Drive integration and revoke access at any time.
• Gmail: You can disconnect outreach mailboxes or your own connected Gmail account at any time; this revokes CellCog's Gmail API access. You can also revoke access from your Google account security settings or Google Workspace admin console.
• Google Analytics (connected account): You can disconnect your Google Analytics account at any time; this revokes CellCog's Google Analytics API access. You can also revoke access from your Google account security settings.
• Cloud Browsers: You can delete a cloud browser at any time from the Cloud Browsers page, which deletes its stored profile and logins.
• MCP Servers and Keys: You can remove an MCP server or delete a stored key at any time from the Connectors pages; removal stops further agent use.
• AI Employee Memory: You can browse an AI Employee's memory files in its Employee Computer, instruct the employee to correct or forget information, or delete the employee, which deletes its memory.
• Organization Membership: You can ask an administrator of your organization to deactivate your membership; content you placed on shared surfaces remains with the organization.

Additional Rights for EU/EEA Users

If you are located in the European Economic Area, you have additional rights including:

• Right to Object: You can object to processing of your personal data
• Right to Restrict: You can request restriction of processing
• Right to Withdraw Consent: You can withdraw consent at any time (without affecting prior processing)
• Right to Lodge a Complaint: You can file a complaint with your local data protection authority

List of EU Data Protection Authorities: EDPB Members

Data Retention

We retain your personal information for as long as necessary to provide our Service and fulfill the purposes described in this Privacy Policy. Specifically:

• Account information is retained until you delete your account
• Chat history is retained until you explicitly delete it
• Uploaded files are retained until you delete them or your account
• Deleted Drive files stay in Trash for 30 days, then are purged
• Daily backups of all Drive and workspace storage are kept for 7 days for disaster recovery only; data you delete, or that is deleted with your account, can remain in these backups until they expire, up to 7 days later. Backups are stored on the same Google Cloud infrastructure in the United States
• AI Employee mailboxes, memory, and workspaces are retained until you delete the employee or your account
• Cloud browser profiles (including stored logins) are retained until you delete the browser or your account
• Stored keys and MCP server configurations are retained until you delete them or your account
• Avatar voice samples and the voice models created from them (at our voice provider, MiniMax through fal.ai) are kept until you delete the voice, the avatar or your account, and are destroyed within 3 years of your last use of the Service; deleting the voice, the avatar or your account also deletes the voice model at the provider
• Blog voice call transcripts and suggested tasks are deleted after 30 days; the rest of the call record (post, length, suggested role) is kept to measure the feature
• Meeting and phone call transcripts, meeting recordings (only when recording is on) and call records are kept until you delete the AI Employee or your account
• Content on your organization's shared surfaces (task board, channels, Organization Drive, shared documents) and lead records are retained for the life of the organization, even if the member or employee that created them leaves or is deleted
• App data submitted to an app you published is retained until it is deleted through the app, or until the chat that built the app or your account is deleted
• The platform-wide suppression list (unsubscribes, bounces, spam reports) is retained as a compliance record independently of your account
• Usage logs are retained for up to 90 days
• Analytics data: Event-level data retained for 2 months, user-level data for 14 months (Google Analytics 4)

Children's Privacy

Our Service is not intended for anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@cellcog.ai.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country.

Requests to media models hosted by fal.ai's partner providers may be processed outside the United States, including in China, because fal.ai does not publish where these partners process data. Some Google models are called through Google's global endpoint, so those requests may also be processed outside the United States.

Analytics Data Transfers

When you consent to analytics cookies, your anonymized usage data may be transferred to and processed on Google servers located in the United States.

Legal Safeguards

• Standard Contractual Clauses (EU Commission approved)
• EU-US Data Privacy Framework participation (Google)
• Data Processing Agreements with our sub-processors, including Google LLC, SendGrid (Twilio), Composio, and ElevenLabs
• IP anonymization to minimize personal data collection

EU/EEA users have the right to object to international transfers. Contact us at privacy@cellcog.ai to exercise this right.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. For material changes, we will provide additional notice via email or through the Service.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

CellCog AI Inc. Email: privacy@cellcog.ai Website: https://cellcog.ai

Response Time: We aim to respond to all privacy requests within 30 days as required by GDPR.

© 2026 CellCog AI Inc. All rights reserved.