1. Who we are and what this policy covers
Cohesio (“Cohesio,” “we,” “us” or “our”) is the controller for the personal information described in this policy unless stated otherwise. This policy covers three distinct groups of people, because the information we hold about each is different: firm users (the bookkeeping firm staff who operate a Cohesio account), client recipients (the firm’s own clients, who interact with Cohesio only through a no-login checklist link), and website visitors (anyone browsing this marketing site at cohesio.ai). It applies to this marketing site and to the Cohesio application at https://app.cohesio.ai.
Postal address: Cohesio, 9th Floor, Tower D, Unitech Cyber Park, Sector 39, Gurugram, Haryana 122001, India.
2. Information we collect
Firm users. When a firm signs up, we collect account information such as name, work email, firm name, role and password (stored as a salted hash, never in plain text). As staff use the product, we collect the client, engagement, template and configuration data they create, plus ordinary operational logs (sign-in timestamps, IP address, device and browser information) needed to secure the account and diagnose problems.
Client recipients. A firm’s client interacts with Cohesio through a scoped checklist link that does not require an account. We collect what that client submits against the requirements the firm has configured — uploaded documents, typed answers, and any message sent in response to a correction request — plus a receipt timestamp for each submission. We do not ask client recipients for bank credentials, payment card security codes, medical records, government identity/KYC data, or payroll administration information, and firms are contractually restricted from requesting these categories through Cohesio.
Website visitors. If you start a trial, book a walkthrough, or contact us from this marketing site, we collect what you provide in that form — typically name, work email, firm name and message — to set up an account or respond. We also collect limited, privacy-conscious product analytics (see Section 6) from visitors who have not opted out.
3. How we use information
We use firm user and client recipient data to operate the service a firm has signed up for: authenticating staff and scoping client access to the right engagement, running the AI extraction and automations a firm has configured, sending reminders and notifications on the firm’s behalf, producing the exports and signed decision manifests the product is built around, and maintaining the audit trail every consequential action writes to. We use website visitor data to respond to inquiries, provision trial accounts, and understand aggregate usage of this marketing site so we can improve it. We do not use client document content to train models shared across other customers, and we do not use any of the categories above for advertising profiling.
4. Legal bases for processing
Where the GDPR or a similar framework applies, we process firm user and client recipient data primarily under contract (Article 6(1)(b)) — it is necessary to provide the service a firm subscribed to — and under legitimate interests (Article 6(1)(f)) for security logging, fraud prevention and product improvement, balanced against the individual’s interests. Website visitor analytics rely on consent where required by local law (see Section 6). Firms remain the controller of the client personal data they collect through Cohesio; our role and the applicable legal bases for that relationship are set out in the data processing addendum.
5. Cookies and analytics
This marketing site uses PostHog for product analytics, configured for aggregate usage patterns (page views, feature interest, conversion funnels) rather than individual profiling. Analytics run only where an analytics key is configured for the deployment, and are on by default; the cookie banner shown on first visit lets a visitor reject analytics cookies at any time, and rejecting disables analytics collection entirely for that visitor. We use a small number of strictly necessary cookies (session state, consent preference) that do not require consent under most cookie frameworks because the site cannot function correctly without them. We do not run advertising retargeting pixels on this site or in the application.
6. Data retention
Retention periods vary by data category, summarized below. In every case, retention ends earlier if you request deletion under Section 8, subject to any legal obligation to retain a record.
| Category | Retention period |
|---|---|
| Active account data (clients, engagements, documents, manifests) | Duration of the active subscription |
| Data after cancellation | 30-day export window, then deleted |
| Signed decision manifests | Retained with the account or exported before deletion; not shortened on request once signed, given their role as an audit record |
| Security and access logs | Up to 12 months |
| Marketing site inquiry data (trial signups, contact forms) | Up to 24 months if no account is created |
| Aggregate analytics data | Up to 14 months |
7. Subprocessors
Cohesio relies on a small set of infrastructure subprocessors to run the service: cloud hosting and storage on Microsoft Azure (US regions), transactional email delivery through Resend, and product analytics through PostHog. Each subprocessor is bound by a data processing agreement consistent with the obligations in this policy. The current list, including any additions, is published on the trust & security page.
8. International data transfers
Firm and client data is hosted in US regions with no cross-region replication outside that boundary. Where a firm or its client is located outside the United States, use of the service may involve a transfer of personal data to the United States. We rely on our subprocessors’ standard contractual safeguards for any such transfer; firms that require additional transfer documentation for their own regulatory purposes can request it through the data processing addendum.
9. Your rights
Depending on where you are located, you may have the right to request access to, correction of, deletion of, or a portable copy of personal information we hold about you, and to object to or restrict certain processing. Exercise any of these rights by emailing hello@cohesio.ai. We verify the request before acting on it and respond within a reasonable time consistent with applicable law. If your personal data was submitted to Cohesio by a bookkeeping firm as their client (a client recipient), the firm is the controller of that data and we recommend contacting them directly as well; we will support the firm in fulfilling a verified request either way.
10. Security
We apply encryption in transit and at rest, role-based access control, client and engagement data isolation, and quarantine plus malware scanning on every uploaded file. Our SOC 2 Type II audit is underway; see the trust & security page for current status and the full technical and organizational measures in place.
11. Children’s privacy
Cohesio is a business-to-business product intended for use by adults acting on behalf of a bookkeeping firm or its business clients. We do not knowingly collect personal information from children, and the service is not directed at them.
12. Changes to this policy
We may update this policy as the product, our subprocessors, or applicable law change. Material changes will be reflected here with an updated effective date, and where a change is significant we will notify account owners directly in addition to updating this page.
13. Contact
Questions about this policy, or requests under Section 9, can be sent to privacy@cohesio.ai. General support questions can go to hello@cohesio.ai.