Privacy Policy
Last updated October 7, 2026
The short version.
- We collect what we need to run your account and bill for it: your email address, your name if you give it, what your organization buys, and a record of what members change.
- We don't sell personal data or share it for advertising, and we use no analytics or advertising trackers.
- Our only cookies are the ones that make signing in and your settings work.
- Card details go straight to Stripe and never reach our servers.
- Wherever you live, you can ask to see, correct, export or delete your data by emailing privacy@coho-cms.com.
1. Who we are and what this covers
[Company legal name] ("Coho", "we", "us") provides Coho, a managed content platform for businesses. This policy explains how we handle personal data when you sign up for, sign in to and use Coho (its sign-in pages, web app, APIs, command-line tool and SDKs) and when you contact us. For that data we are the "controller" under European data protection law and the "business" under California law.
It doesn't cover the content our customers store in Coho, such as staff profiles on a customer's website, or the sites and apps customers build with it. We process that content for our customers under our Data Processing Addendum, and the customer's own privacy notice applies to it. If you send us a request about it, we will pass it to the customer.
2. What we collect and why
| What | Where it comes from | What we use it for | Legal basis |
|---|---|---|---|
| Account details: email address, name (optional), password, the organizations you belong to and your role in each | You, or an admin who invites you | Creating your login, signing you in, sending sign-in and confirmation codes, and letting your organization manage its members | Contract |
| Billing details: organization name, plan, billing contact, billing address, tax ID, invoices and payments; card brand, last four digits and expiry date | You and Stripe | Billing, accounting and tax records, and preventing payment fraud | Contract; legal obligation |
| Activity: an audit trail of changes (who changed what, and when), the content you are recorded as changing, and your sessions | Your use of Coho | Running the service, showing change history, keeping accounts secure and investigating misuse | Contract; legitimate interests |
| Usage: requests and data delivered, content size and editors, for each project | Our service | Metering usage for billing, enforcing plan limits and planning capacity | Contract |
| Device and connection data: IP address, browser type, and service logs that record which page or API path was requested and the result | Your browser or tools | Delivering the service, protecting it from abuse and fixing faults | Legitimate interests |
| Bot protection: on the sign-up, password reset and new-code forms, a Google reCAPTCHA response, your IP address and browser type, and what reCAPTCHA collects | Your browser and Google | Stopping automated sign-ups and the abuse of our emails | Legitimate interests |
| Invitations: the email address an admin invites and the role offered | The admin | Letting the person invited join the organization | Legitimate interests |
| Support: what you send us and our replies | You | Answering you and improving Coho | Contract; legitimate interests |
| Preferences: whether you chose the light or dark theme | You | Showing pages the way you chose | Legitimate interests |
Your password goes from our sign-in page to Amazon Cognito, which stores it in hashed form. Coho never stores it. The audit trail identifies people by an internal ID, not by name or email address.
Legal bases. "Contract" means the processing is necessary to provide the service you signed up for, or to take steps you asked for before signing up (GDPR Article 6(1)(b)). "Legal obligation" means a law requires it, such as tax law (Article 6(1)(c)). "Legitimate interests" means it is necessary for our legitimate interests, or our customers', in running a secure and reliable service and in letting organizations manage who has access, and those interests aren't overridden by yours (Article 6(1)(f)). You can object to processing based on legitimate interests (section 9).
What's required. You need an email address and a password to have a login, and paid plans need billing details. Your name is optional.
Automated decisions. We don't make decisions about you by automated means that have legal or similarly significant effects. reCAPTCHA may block an attempt that looks automated. If that happens to you, try again or contact us.
3. Cookies
We use only cookies that the pages need to work, or that remember a choice you made. We use no analytics, advertising or cross-site tracking cookies, which is why you won't see a cookie banner.
| Cookie | Set by | Purpose | Lasts |
|---|---|---|---|
__Host-coho-login | Coho's sign-in pages | Links the steps of one sign-in together and protects its forms against forgery | An hour, or until the sign-in finishes |
coho_session | Coho's web app | Keeps you signed in. It holds a random ID, never your credentials | Until you sign out or close the browser; the session ends on our side after 8 idle hours |
coho-theme | Coho's sign-in pages | Remembers whether you chose the light or the dark theme | A year |
| reCAPTCHA cookies | Google, on forms with a captcha | Telling people apart from automated software | Set by Google, up to six months |
| Stripe cookies | Stripe, on its payment pages | Processing payments and preventing fraud | Set by Stripe |
Do Not Track and Global Privacy Control. We don't track you across other websites, and we don't sell or share personal data, so there is nothing for these signals to turn off. We treat every visit the same way whether or not your browser sends one.
4. Payments
Payments are handled by Stripe. When you add a payment method or pay an invoice, you enter your card or bank details on a page or form provided by Stripe, and they go straight to Stripe without passing through our servers. Stripe tells us the card brand, the last four digits, the expiry date, the billing address and whether each payment succeeded.
Stripe uses payment data to provide its services to us, and for some purposes of its own, such as preventing fraud and meeting financial regulations, as described in the Stripe Privacy Policy. If you choose to save your payment details with Link, Stripe's service for faster checkout, Link's own terms and privacy policy apply to it.
5. Who we share it with
We don't sell personal data, and we don't share it for cross-context behavioral advertising. We disclose it only in these cases:
- To service providers that run parts of Coho for us, under contracts that allow them to use it only to provide their services to us:
- Amazon Web Services: hosting, databases, storage, sign-in (Amazon Cognito) and sending sign-in emails, in the United States;
- Google: reCAPTCHA bot protection on the sign-up and password reset forms. The Google Privacy Policy and Terms of Service apply to reCAPTCHA;
- Stripe: payments, invoicing and tax calculation (section 4).
- Within your organization. An organization's members and admins can see your name, email address and role there, and the changes you made to its projects.
- For legal reasons. When the law, a court order or other legal process requires it, or to protect the rights, property or safety of Coho, our customers or others. We push back on requests that are too broad and, where the law allows, tell you about them.
- In a business transfer. If we are involved in a merger, acquisition, financing or sale of assets, under confidentiality, and the recipient must honor this policy.
- With your consent or at your direction.
6. International transfers
Coho is run from the United States, and we store personal data with Amazon Web Services in the United States (Northern Virginia). Our service providers may process it in other countries. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum and Swiss amendments where they apply), or on the recipient's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. You can ask us for a copy of these safeguards.
7. How long we keep it
- Account details: for as long as your login exists. If you ask us to delete it, we do so within 30 days.
- Organizations: when an organization's account closes, we delete its content and its members' memberships 30 days later.
- Billing records: for as long as tax and accounting laws require, generally seven years.
- Audit trail: for as long as the organization's account exists. It holds internal IDs, not names or email addresses, so once your login is deleted its entries about you read "unknown user".
- Service logs: up to 30 days.
- A sign-in in progress: up to an hour.
- Invitations: until they are accepted or withdrawn, or expire after seven days.
- Support emails: up to two years after the conversation ends.
Deleted data can remain in encrypted backups for up to 35 days, until those backups expire.
8. Security
We protect personal data with measures suited to the risk, including encryption in transit on every connection and encryption at rest for our databases; passwords held only by Amazon Cognito, in hashed form; sign-in tokens kept on our servers rather than in your browser; services that hold data unreachable from the internet; bot protection on the forms that create accounts or send email; and an audit trail of changes that can't be edited. No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.
9. Your rights
Wherever you live, you can ask us to:
- tell you what personal data we hold about you and give you a copy (access), in a format you can reuse where that's practical (portability);
- correct it;
- delete it. We delete your login and the personal data tied to it, apart from what the law requires us to keep, such as invoices. Content you created belongs to your organization and stays in its projects, but is no longer linked to you;
- restrict or stop processing we base on legitimate interests (objection).
Email privacy@coho-cms.com from the address on your login, or tell us how else to reach you. We will confirm that we've received your request, check that it comes from you (usually by writing to the address on your login), and answer within one month, or within 45 days if California law applies. If we need longer, as the law sometimes allows, we will tell you why. We won't charge you or treat you differently for using these rights.
If you want something changed or removed in an organization's content, for example a profile on its website, ask that organization. If you write to us instead, we will pass your request on.
10. Europe, the UK and Switzerland
If the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies to you, the rights in section 9 are your rights under that law, and you can also withdraw consent wherever we rely on it (we generally don't). You have the right to complain to a data protection authority: in the EEA, the authority where you live or work (list of authorities); in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner. We would appreciate the chance to put things right first, at privacy@coho-cms.com.
11. California
This section is for California residents, and adds to the rest of this policy as the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA"), requires. In the past 12 months we have collected these categories of personal information:
| Category | Examples | Sources | Business purposes | Disclosed to |
|---|---|---|---|---|
| Identifiers | Name, email address, internal user ID, IP address | You; your device | Providing and securing the service; billing | Amazon Web Services; Google; Stripe |
| Customer records (Cal. Civ. Code § 1798.80(e)) | Billing name and address; payment card details, held by Stripe | You; Stripe | Billing | Stripe; Amazon Web Services |
| Commercial information | Plans, subscriptions, invoices and payments | You; Stripe; our service | Billing and record-keeping | Stripe; Amazon Web Services |
| Internet or other electronic network activity | Audit trail, service logs, usage meters, reCAPTCHA signals | Your use of Coho | Providing, securing and billing the service | Amazon Web Services; Google |
| Sensitive personal information | Your login: email address and password | You | Signing you in, and nothing else | Amazon Web Services (Amazon Cognito) |
We don't collect the other categories the CCPA lists, such as precise location, biometric information or characteristics of protected classifications.
- No sale or sharing. We have not sold personal information or shared it for cross-context behavioral advertising in the past 12 months, and we don't do so, including for anyone under 16. There is nothing to opt out of, so we don't show a "Do Not Sell or Share" link.
- Sensitive personal information is used only to sign you in, which the CCPA permits, so the right to limit its use doesn't arise.
- Retention for each category is in section 7.
- Your rights: to know what personal information we collect, use and disclose, and to get the specific pieces; to delete it; to correct it; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for using these rights.
- How to use them: email privacy@coho-cms.com. We check your identity by confirming that you control the email address on your login. An authorized agent may make a request for you with your signed permission; we may still ask you to confirm your identity with us directly.
- "Shine the Light" (Cal. Civ. Code § 1798.83): we don't disclose personal information to third parties for their own direct marketing.
12. Other US states
Residents of other states with privacy laws, such as Virginia, Colorado, Connecticut, Oregon and Texas, have rights similar to those above, and we honor the rights in section 9 for everyone. If we decline your request, you can appeal by replying to our decision, or by emailing privacy@coho-cms.com with "Appeal" in the subject line. We will answer within the time your state's law sets. If you're not satisfied with the outcome, you can contact your state's attorney general.
13. Children
Coho is for business use by adults. It isn't directed at children, and we don't knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it.
14. Changes to this policy
When we update this policy, we change the date at the top. If a change is significant, we will tell account admins by email or in Coho before it takes effect.
15. Contact
Privacy questions and requests: privacy@coho-cms.com. Anything else: support@coho-cms.com. By post: [Company legal name], [Mailing address].