Privacy Policy

The two roles we play

For your account and your use of Cook, we decide how data is handled — we are the data controller. For the business records your workspace holds (your clients, your leads, form submissions on your funnel pages), you are the controller and Cook processes that data on your instructions as a processor.

What we collect

• Account data: name, email address, password (stored hashed), and sign-in identifiers from Slack or Discord if you use social sign-in.
• Workspace content: chats with your AI departments, files you upload, documents, and generated media.
• CRM records you or your integrations add: client and lead names, email addresses, phone numbers, notes, and pipeline status.
• Funnel form submissions from your pages: the fields a visitor types, plus a consent record (what they agreed to, when, from which page).
• Billing data: subscription and credit usage. Card details go directly to Stripe and never touch our servers.
• Connected integration credentials, stored encrypted (AES-GCM).
• Usage data: on this website, page analytics without cookies; in the app, product analytics (pages viewed, clicks, performance, error reports, and recordings of on-screen sessions in which typed passwords are hidden); and server logs for security and debugging.
• Messages you send us, such as support requests, and your choices about our emails.

Why we use it

• To run the service you signed up for — your account, workspace, and AI agents (performance of a contract).
• To bill you (performance of a contract, legal obligations).
• To keep the service secure and debug problems (legitimate interest).
• To measure and improve the product with analytics (legitimate interest; consent where the law requires it for cookies).
• To send you service notices, and emails about Cook that you can unsubscribe from at any time (legitimate interest, or consent where the law requires it).
• To create aggregated or de-identified statistics that do not identify you or your business (legitimate interest).
• To send marketing on behalf of our customers to their contacts — done on the customer's instructions; the customer is responsible for having a lawful basis. Data obtained from Google APIs is never used for this.

AI processing

Cook does its work by sending workspace content to AI model providers (Anthropic, OpenAI, Google) and media generators. These providers process the content to produce the requested output. We do not use your content to train models of our own. Data obtained from Google APIs is never used to train AI or machine-learning models, ours or a provider’s; see “Google user data” below.

Google user data

Cook connects to Google only when you choose to connect it: on a booking page (through Nylas, our calendar provider) or in the app (through Composio). Cook accesses only the data covered by the permissions you approve on Google’s consent screen.

• What we access: your Google account name and email address, the list of your calendars, and the events on the calendar you choose.
• Why: to let you pick which calendar a booking page writes to, to offer visitors only the times you are free, to create, move and cancel the events for meetings booked through your page, and, if you connect a calendar in the app, to show your upcoming meetings in your workspace. Google data is used to provide these features and for nothing else.
• What we never do with it: use it for advertising of any kind, sell it, transfer it to data brokers or advertising platforms, use it to determine credit-worthiness, or use it, raw, aggregated or derived, to create, train or improve AI or machine-learning models, our own or anyone else’s.
• Who receives it: Nylas or Composio, which hold the Google connection, and Convex, which hosts the database. An AI model provider listed below receives meeting details only when you ask an agent to work with your meetings, only to produce that answer, and under terms that forbid training on it. Cook staff do not look at your Google data unless you ask us to for support, or a security incident or the law requires it.
• How it is protected: encrypted in transit and at rest; connection credentials are encrypted with AES-GCM.
• How long we keep it: until you disconnect Google in Cook, remove Cook’s access at myaccount.google.com/permissions, or delete your account. Disconnecting deletes the connection and stops all access; meeting and booking records already in your workspace stay until you delete them or your account.

Limited Use compliance statement. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Cook’s use and transfer to any other app of information received from Google APIs will adhere to that policy. Google user data, whether raw, aggregated or derived, is not used to create, train or improve any foundational or generalized machine-learning or AI model.

Text messages

Businesses that use Cook can send text messages to their own contacts through it. Mobile phone numbers and text-messaging consent are not shared with third parties or affiliates for their marketing or promotional purposes. We share them only with the providers that deliver the messages (see the table below). Reply STOP to any message to stop receiving texts from that sender, and HELP for help. Message and data rates may apply.

Zoom on booking pages

If you connect Zoom to a booking page, Cook creates a Zoom meeting for each booking, moves it when the booking moves, and deletes it when the booking is cancelled. Through this connection Cook reads only your Zoom name and email address; it does not read your recordings, chats, contacts or other meetings. We keep your Zoom email address and a connection reference; the Zoom sign-in itself is held by Nylas, our calendar provider. When you disconnect Zoom in Cook, or remove the Cook app in Zoom, we delete that connection.

Who we share data with

We use the following service providers (subprocessors) to run Cook:

We do not sell personal data. Beyond these providers, we disclose data: to the third-party services you connect, as you instruct; to professional advisors under a duty of confidentiality; when the law requires it or to protect the service, our users, or the public from fraud or abuse; and to a company that acquires our business or the part of it that provides Cook, which must keep honoring this policy for the data it receives.

International transfers

Our providers process data primarily in the United States. Where data about people in the EU, EEA, or UK is transferred, we rely on the providers’ data processing agreements and standard contractual clauses.

How we protect data

Data is encrypted in transit and at rest. Integration credentials are encrypted with AES-GCM. Access to production systems is limited to staff who need it. If a security incident puts your personal data at risk, we notify you and the authorities as the law requires, and we notify affected customers without undue delay.

Automated processing

Cook’s AI agents do work on instructions from the business that uses them. Cook does not make decisions about individuals that have legal or similarly significant effects on them by automated means alone.

How long we keep data

• Account and workspace data: for as long as your account exists.
• Backups: rolling snapshots kept for 14 days.
• Billing records: as long as tax and accounting law requires.
• Deleted data: removed from the live database when you delete it, and from backups when they expire (within 14 days). Files you upload for an agent task are deleted with the workspace.
• Files (uploads, media Cook generates for you, a workspace’s drive files, and course videos): when you delete a workspace or your account, its files are removed from storage within minutes and held in a private archive for 30 days, then deleted permanently. Course videos are deleted 30 days after the workspace or lesson is deleted.
• A file that no record in your workspace uses any more is removed 30 days after it stops being used and deleted permanently 30 days after that. Older versions of a drive file are removed 30 days after a newer version replaces them, and all versions of a deleted drive file 30 days after you delete it.
• Each file belongs to exactly one workspace. Another workspace cannot use or read it.

Your rights

You can access, correct, export, or delete your data. In the app: Settings lets you export your workspace’s data and delete your account or organization. By email: send requests to [email protected] and we will respond within 30 days. If you are in the EU, EEA, or UK, you also have the rights to restrict or object to processing and to complain to your supervisory authority. In Canada, you may complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d’accès à l’information du Québec. Residents of U.S. states with privacy laws (for example California, Colorado, Connecticut, Virginia, and Texas) have the rights those laws give, including to know, access, correct, delete, and port their data, to opt out of targeted advertising, and not to be treated differently for using these rights; to opt out of advertising cookies on this website, use “Cookie choices”. You or an authorized agent can make a request by email; we verify the request before we act on it, and you can appeal a refusal by replying to our answer. If your data is in a customer’s workspace (for example, you are their client or a lead), contact that business — they control it — and we will help them honor your request.

Cookies

On this website, the only cookie set before you choose is the one that remembers your choice. Analytics and advertising cookies are set only after you press Accept in the cookie banner, and never if you press Reject. You can change your answer at any time with the “Cookie choices” link in the footer.

The Cook app sets cookies the service needs to work (your sign-in session, your theme, and your active workspace) and uses browser storage for its product analytics (PostHog). The page analytics on this website does not use cookies. Funnel pages our customers publish are the customers’ own websites and may use advertising cookies with the visitor’s consent where consent is required — each funnel carries its own privacy policy.

Children

Cook is a business tool and is not directed at children under 16. We do not knowingly collect their data.

Changes

When this policy changes, we update this page and the date at the top. Material changes are announced in the app.

Person responsible for privacy

Our Privacy Officer is responsible for the protection of personal information at ClientAcquisition.io. Contact: [email protected], subject line “Privacy Officer”.

Contact us

Questions, requests and data-deletion requests (subject line “Data Deletion Request”) go to [email protected]. Postal address: ClientAcquisition.io, 6740 Rue Briand, Montreal QC, H4E 3L5, Canada.

See also our Terms of Service and Data Processing Addendum.