Privacy Policy

Effective October 2, 2026

Cosella helps sales teams prepare for calls, get coaching during them, and follow up afterwards. This policy covers our website (mycosella.com), the Cosella web app, the Cosella desktop app, and our API. It explains what we collect, why, who we share it with, and the choices you have.

Two kinds of people appear in Cosella: our customers (the businesses and the reps and managers who use Cosella) and the people our customers sell to (their leads and prospects). For our customers' own account details, we decide how the data is used. For the leads, calls and CRM records a customer brings into Cosella, we process that data on the customer's behalf and under their instructions, and the customer is responsible for having the right to use it.

Information we collect

• Account details: your name, work email, password (stored only as a one-way hash), your workspace, your role, and your settings.
• Workspace content: what your team adds, such as sales playbooks, knowledge-base documents and FAQs, offers and prices, case studies, call plans, scripts, and notes.
• Calls: when a rep uses Cosella on a call, the call audio, a transcript, the coaching shown during the call, and the analysis afterwards (outcome, objections, summary). Whether audio is stored is set by the workspace; see below.
• Leads and contacts: names, contact details, form answers, bookings, deals and payment status for the people your team sells to, whether you enter them or they arrive from a connected CRM, calendar or booking tool.
• Connected accounts: when you connect a service such as Google, HubSpot or GoHighLevel, we receive access tokens for it and the data its permissions allow (described below). Tokens are encrypted at rest.
• Payments: plan and billing details. Card numbers are handled by our payment processors (Stripe and PayPal); we never see or store them.
• Technical data: IP address, browser and device type, and error reports, used to keep the service working and secure. We do not use advertising or cross-site tracking cookies.
• Messages to us: what you send when you contact support or book a call with us.

How we use it

• To provide Cosella: research leads before calls, write call plans and follow-ups, coach reps live, analyse calls, sync bookings and contacts, and run the features your workspace turns on.
• To keep accounts secure, prevent abuse, and fix problems.
• To bill for subscriptions and send service emails (sign-in, invites, receipts, training reminders you opt into).
• To answer support requests.
• To meet legal obligations.

We do not sell personal information, and we do not use it for advertising. We do not use your workspace content, calls or lead data to train AI models.

Calls and recordings

Each workspace chooses how calls are recorded: record every call, record only after the rep confirms they have given the recording notice (the wording is the workspace's own), or never store audio. When audio is stored it is kept in our cloud storage and is visible only to the workspace. Live coaching sends the conversation to our AI provider in real time to transcribe it and suggest responses.

Recording and notice laws differ by place. Customers are responsible for telling the people on their calls and getting consent where the law requires it.

Research on the people our customers sell to

Cosella's Intelligence feature prepares a rep for a booked call by combining what the customer already holds about the lead (the CRM record, form answers, past calls and emails) with public, professional information such as a company website or a public professional profile. It follows these rules:

• Public information only. No logged-in scraping, no private profiles, nothing behind access controls.
• A name alone is not enough: a public profile is only used when something else, such as the company, role or a supplied profile link, confirms it is the same person. Unconfirmed matches are shown as links for the rep to check, never as facts.
• No sensitive traits. Cosella does not record or infer health, religion, ethnicity, sexuality, family status, wealth, politics, or similar characteristics.
• Credit and pre-qualification data is never collected by Cosella. Where a customer's CRM already holds it from a provider such as LeadFi, Cosella reads those fields and shows them only to the lead's rep and the customer's managers.
• Every fact shown names its source. Deleting a contact deletes the research about them.

If you believe a Cosella customer holds information about you, please contact that business directly. If you write to us instead, we will pass your request to them and help them respond.

Google user data

Connecting a Google account is optional and is done by each user for their own account. When you connect, Cosella asks for these permissions and uses them only as described:

• Google Calendar events (calendar.events): to create the follow-up call a rep books from Cosella on that rep's own calendar, with a meeting link and the lead invited; and to read upcoming events on that calendar so booked sales calls appear in Cosella and the lead can be researched before the call. Cosella does not change or delete events it did not create.
• Send email on your behalf (gmail.send): to send a follow-up email that you wrote or approved in Cosella, from your own Gmail address, to the lead it is addressed to. Cosella cannot read, search or delete your email, and never sends anything without your approval.
• Your name and email address, to show which Google account is connected.

Cosella's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is used only to provide the features described above, which you can see and turn off.
• It is never sold, never used for advertising, and never used to train AI models.
• It is not transferred to others except as needed to provide those features (for example, our hosting provider), to comply with law, or as part of a merger or acquisition with notice to you.
• No person at Cosella reads it unless you ask us to for support, it is needed to investigate abuse or a security issue, or the law requires it.

You can disconnect Google at any time from Workspace → Integrations in Cosella, or from your Google Account permissions. Disconnecting deletes the stored access tokens.

Who we share it with

We share information only with service providers that help us run Cosella, with the services you choose to connect, and when the law requires it. Our providers process it on our instructions and may not use it for their own purposes.

Services you connect (for example Google, Microsoft, HubSpot, GoHighLevel, Salesforce, ClickFunnels, Calendly and Slack) receive what Cosella sends them to do what you asked, such as creating a calendar event or posting a report to Slack. Their own privacy policies apply to the data they hold.

If Cosella is involved in a merger, acquisition or sale of assets, information may transfer as part of it; we will tell you before it becomes subject to a different policy.

Retention and deletion

We keep your information while your account is active. A workspace admin can delete contacts, calls and content at any time; deleting a contact also deletes the research about them. Research is refreshed rather than accumulated. When a workspace is closed, we delete its data within 30 days, apart from what we must keep by law (for example billing records) and backups, which are overwritten on their normal cycle.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your information, to object to or restrict how it is used, and to withdraw consent. Email us and we will respond within 30 days. If you are a lead or prospect of a Cosella customer, the customer decides how your information is used; we will forward your request to them. You can also complain to your local data protection authority.

International transfers

Our providers may process information outside your country, including in the United States. Where the law requires it, we rely on safeguards such as standard contractual clauses.

Security

Data is encrypted in transit, and connection tokens are encrypted at rest. Each workspace's data is kept separate from every other's, access inside a workspace follows roles (reps see their own leads; managers see their team), two-factor sign-in is available, and sensitive actions are logged. No system is perfectly secure; if we learn of a breach affecting your information we will tell you as the law requires.

Children

Cosella is a business product and is not meant for anyone under 18. We do not knowingly collect information from children.

Changes to this policy

When we change this policy we will update the date at the top, and for significant changes we will tell account holders by email or in the app before they take effect.

Contact

Questions or requests about your information: [email protected].