Privacy Policy

Last updated: July 10, 2026

This Privacy Policy describes how Cognitory ("Cognitory", "we", "us") collects, uses, and protects information in connection with our websites (including cognitory.ai) and our applications and services, including our retirement-plan compliance platform (together, the "Services"). It also describes how we handle data we receive from Google APIs when you connect a Google account to the Services.

Information we collect

• Account information. When you sign in to the Services, we collect your name, email address, and profile picture from your identity provider.
• Content you provide. Information you or your organization submit to the Services in the course of using them.
• Usage and device information. Log data such as IP address, browser type, and pages visited, collected to operate and secure the Services.

Google user data

Parts of the Services integrate with Google APIs. We access Google user data only after you (or your organization's administrator) explicitly grant access through Google's OAuth consent flow, and only as follows:

• Google Sign-In.We use your Google account's basic profile information (name, email address, profile picture) to authenticate you and create your user account.
• Gmail.If you connect a Gmail mailbox, we access email messages, threads, and labels in that mailbox, and send email on your behalf, solely to provide the Services' email features: organizing, tracking, and responding to plan-administration correspondence between your organization and its clients. We only connect mailboxes that you explicitly authorize.

How we use Google user data

• We use Google user data only to provide and improve user-facing features of the Services that are prominent to you.
• We do not use Google user data for advertising.
• We do not sell Google user data.
• We do not use Google Workspace data (including Gmail content) to develop, improve, or train generalized artificial intelligence or machine learning models.
• Humans do not read Google user data except (a) with your explicit permission, (b) as necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) when the data has been aggregated and anonymized for internal operations.

Cognitory's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we share information

We do not sell personal information. We share information only with service providers that help us operate the Services (such as cloud hosting and infrastructure providers), under contracts that restrict their use of the data; within your organization's workspace as directed by your organization; or when required by law.

Data retention and deletion

We retain Google user data only for as long as needed to provide the Services. You can revoke our access to your Google account at any time from your Google account security settings, after which we no longer receive data from your account. You or your organization may also request deletion of stored data by contacting us at the address below; we will delete it within 30 days, except where retention is required by law.

Children

The Services are intended for business use and are not directed to children under 16. We do not knowingly collect personal information from children.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and revise the "Last updated" date above.

Contact us

If you have questions about this Privacy Policy or how we handle your data, contact us at privacy@cognitory.ai.