Privacy Policy
Last updated: 5 August 2026
1. Who we are
Cogbird is operated by Everace AB (org. nr 559582-9663, VAT SE559582966301), Marieviksgatan 41, 117 60 Stockholm, Sweden.
2. We have two roles, and the difference matters
We are the controller for your account. Your name, email address, sessions and billing details are data we decide the purposes for, and you are the data subject.
We are a processor for your site. The pages we crawl, the content we store from them, and the search data we read using the grant you issued are held on your instructions and for your purposes. If your website contains personal data — an author name, a testimonial, a contact page — then you are the controller of it and we process it for you. Section 11 covers the agreement that governs that.
3. What we collect
Account data
- Name and email address.
- A hashed password, or an identifier from Google if you sign in that way.
- Session records, including approximate device information.
- Billing details held by Stripe. We never see or store card numbers.
- What you wrote in your access request, if you made one.
Data about your sites
- The domains you add, and the proof of ownership you provided.
- Search performance data from Google Search Console and Bing Webmaster Tools, using credentials you connect. This is aggregated query and page data, not information about individual visitors.
- The content of pages we crawl, including their text, stored in versions so that changes can be detected.
- Findings, recommendations, and the record of what was shipped and what it achieved.
What we do not collect
We place no script on your website and we see none of your visitors. Cogbird has no tracking pixel, no session recording and no advertising identifiers. We do not know who visits your site; we only know what the search engines report in aggregate.
4. Cookies
We set one kind of cookie: the ones that keep you signed in and remember which site you were looking at. They are strictly necessary for the service to function, so no consent banner is shown for them. We run no advertising or third-party analytics cookies.
We do measure which of our own screens get used, and we collect crash reports when something in Cogbird breaks, using PostHog in the EU. That measurement is deliberately built so the paragraph above stays true: it stores nothing on your device — no cookie and no local storage — which is why you are not asked to consent to it. It records the path of the page you were on, your browser and device type, and the text of any error. It does not record the query string, it does not capture what you clicked, and it makes no session recordings, so the contents of your screens are not sent anywhere. Because nothing is stored on your device, we cannot connect one visit to the next.
5. Why we process it
- To perform the contract — running the service you signed up for, and billing for it.
- Legitimate interests — keeping the service secure, preventing abuse, and improving how well it works.
- Legal obligation — Swedish bookkeeping law requires invoices and accounting records to be kept for seven years.
6. Where your data goes, including the part people miss
The full list is on the subprocessors page. Two entries deserve to be named here rather than only in a table.
We use large language models. When the engine surfaces a recommendation it sends the evidence behind it — page titles, URLs, headings and the numbers involved — to Anthropic, which writes the one explanatory paragraph you read. A separate provider, OpenAI, turns short text fragments into vectors so that comparisons can see past paraphrase. Neither receives your Search Console credentials. Both are in the United States, and transfers rely on Standard Contractual Clauses.
Everything else — the database, the crawled content, the ledger — is stored on servers in the EU.
7. How long we keep it
- While your account exists, we keep what the service needs to work.
- 30 days after deletion. Deleting a site, workspace or account marks it and stops all processing immediately; it can be restored during that window. After it, everything is destroyed permanently.
- Seven years for invoices and accounting records, because Swedish law requires it.
- Indefinitely, in anonymised form. See the next section.
8. Aggregate outcomes, and why they survive deletion
When a change is measured, we record the result against a description of the site’s shape — its size band, traffic band and page mix — so that the engine gets better at judging the next customer’s similar situation. That record contains no domain, no URL, no query, no content and no identifier. It is a count: how often a class of change succeeded on sites of a given shape.
Because it identifies nobody, it is not personal data and it is not deleted when you leave. Everything that does identify you or your site is.
9. Your rights
Under the GDPR you can ask for access, correction, erasure, restriction, portability, or object to processing. Two of those are self-service and need no request:
- Portability — download your data as JSON from your account page.
- Erasure — delete your account from the same page.
For anything else, write to hello@everace.co. We respond within 30 days. You can also complain to Integritetsskyddsmyndigheten (IMY), the Swedish supervisory authority.
10. Security
Connected credentials are encrypted at rest with a key held separately from the database, so a database copy without the key is inert. Access to the production system is limited to the operator. Our staff cannot browse your search data or your findings from the admin tools, which are deliberately restricted to operational state — whether a site is verified, connected, and running.
11. Data processing agreement
Where we process personal data on your behalf, this policy together with our terms forms the agreement required by Article 28 GDPR. A separate signed DPA is available on request at hello@everace.co.
12. Changes
We will notify you by email of material changes to this policy before they take effect.
13. Contact
Everace AB
Org. nr 559582-9663
Marieviksgatan 41, 117 60 Stockholm, Sweden
hello@everace.co