Privacy Policy

Two different roles

Covey handles personal information in two distinct ways, and the difference matters for your rights.

• Your account with us. When you sign up, subscribe, email support, or browse the marketing site, we are the controller of that information and this policy governs it.
• Your members' records. When your organization loads member data into Covey, you are the controller and we are the processor. We handle it on your instructions, for the purpose of running the platform, and nothing else. Your members should direct their privacy requests to your organization; if they come to us, we forward them to you.

What we collect

• Account information — name, work email, organization name, role, and password credentials (stored hashed by Amazon Cognito; we never see the password itself).
• Organization content — the member records, events, email templates, website pages, and files you put into the platform.
• Billing information — plan, invoices, and payment status. Card numbers go directly to Stripe and are never stored on our systems.
• Usage and technical data — request logs, IP address, browser and device type, pages and actions in the app, and error traces. Logs are scrubbed of personal fields such as email addresses, phone numbers, and postal addresses before they are written.
• Email engagement — whether a message we or you sent was delivered, opened, clicked, bounced, or marked as spam.
• Site analytics — aggregate traffic measurement on the marketing site via Google Analytics.

Why we use it

To provide and secure the platform, authenticate users, process your subscription, send transactional email (receipts, password resets, event confirmations), answer support requests, investigate abuse and fraud, understand aggregate product usage so we know what to improve, and meet our legal and accounting obligations.

We also send occasional product email to account owners. You can opt out of the marketing kind at any time from the message itself; operational email about your account and billing is not optional while the account is open.

Where GDPR applies, our lawful bases are contract (running the service you bought), legitimate interests (security, abuse prevention, product improvement), consent (marketing email and non-essential analytics), and legal obligation (tax and accounting records).

We do not sell your data

We have never sold personal information and we do not share it for cross-context behavioral advertising. We do not train machine-learning models on your members' records.

Who we share it with

Only the vendors it takes to run the product, each under contract and limited to what they need:

• Amazon Web Services — hosting, databases, storage, and authentication, in U.S. regions.
• Stripe — subscription billing, and the payments your members make to your organization.
• Amazon SES — delivery of transactional and campaign email.
• Google Analytics — aggregate marketing-site traffic measurement.

We also disclose information when the law requires it — a valid subpoena, court order, or legal process — and, if we are ever part of a merger or acquisition, to the acquirer under the same commitments described here. We will tell you before your data moves to a new owner.

How long we keep it

Organization content lives as long as your account does. Audit and activity records are retained for 365 days. Billing and tax records are kept as long as the law requires, typically seven years.

When an account is closed we hold the data for 30 days in case of a mistake, then delete it — including the per-tenant tables and the encryption key that protects them. Backups age out on their own schedule within 35 days. Aggregate, de-identified statistics may persist.

How we protect it

Data is encrypted in transit with TLS and at rest, with a separate encryption key per organization. Each tenant's records live in their own tables, and access is scoped per request so one organization cannot reach another's data. Staff access to production is role-based, logged, and limited to the people who need it for support and operations.

No system is perfect. If a breach affects your data, we will notify affected account owners without undue delay and tell you what we know and what we are doing about it.

Your rights

Depending on where you live, you may have the right to access, correct, export, delete, or restrict the personal information we hold about you, to object to certain processing, and to withdraw consent. Email hello@coveyhq.com and we will respond within 30 days. We will not charge you or degrade your service for exercising these rights.

If the request concerns a membership record held by an organization that uses Covey, we will point you to that organization, since they decide what happens to it.

Cookies

The app sets cookies and local storage that are strictly necessary: keeping you signed in, remembering your active organization, and protecting forms. The marketing site adds Google Analytics for aggregate traffic measurement. We run no advertising or retargeting pixels. Your browser's cookie controls and Do Not Track settings are respected where applicable.

Where your data lives

Covey is hosted in the United States. If you use the platform from outside the U.S., your information is transferred to and processed there, under Standard Contractual Clauses where required.

Children

Covey is a tool for organizations and is not directed at children. We do not knowingly collect personal information from anyone under 13 through our own signup. If your organization keeps records for youth members, you are the controller of that data and responsible for the consents behind it.

Changes and contact

We will post updates here with a new effective date, and email account owners if a change is material.

Privacy questions, requests, and complaints: hello@coveyhq.com. Covey HQ Inc., Chicago, Illinois, USA.