Privacy Policy

1. Who we are

This policy explains how Cognera ("we", "us") collects and uses information when you use the Cognera platform and websites (the "Service"). Cognera is operated by Digital Brainwave Ltd, which is the data controller for account and billing information, and processes the content in your workspaces on your instructions as part of providing the Service. Contact: [email protected].

2. What we collect

• Account data: name, email, password (hashed), workspace and team details.
• Billing data: plan, invoices and payment status. Card details are collected and stored by Stripe, our payment processor; we never store full card numbers.
• Workspace content: content you add or connect: documents, brand assets, strategy inputs, research sources, drafts, goals, tasks and similar material.
• Connected platform data: when you connect an account such as X, we store the tokens you authorise and the profile, post and performance data needed to publish and to measure results.
• Usage and device data: log data, IP address, browser type, pages viewed and actions taken, used for security, debugging and product analytics.
• Support communications: messages you send us.

3. How we use it

• To provide, operate and secure the Service and your workspaces (performance of our contract with you).
• To generate strategies, research and content: your workspace content and instructions are sent to the third-party AI providers we use, solely so the Service can produce results for you.
• To bill you and manage subscriptions and credits.
• To improve and develop the Service, including analytics and testing, using aggregated or de-identified data wherever practicable (our legitimate interests).
• To communicate with you about the Service, including service, billing and product messages.
• To comply with law and enforce our Terms.

4. AI processing

Cognera is built on third-party large-language-model providers. Content you submit and the context in your workspace may be transmitted to those providers to generate outputs. We select providers that contractually commit not to use API data to train their generally available models. The providers we use, and how we orchestrate them, may change at any time without notice.

5. Who we share it with

• Processors: hosting and infrastructure providers, Stripe (payments), email delivery, error monitoring and analytics providers, and AI model providers, each bound by data-processing terms.
• Connected platforms: content you approve for publishing is sent to the platform you connected (for example X), which then processes it under its own terms.
• Legal and safety: where required by law, or to protect our rights, users or the public.
• Business transfers: as part of a merger, acquisition, financing or sale of assets, your information may be transferred to the successor.

We do not sell personal information.

Sub-processors we use

To run the Service we rely on the third-party sub-processors below. Each processes personal data only on our instructions under data-processing terms, for the purpose shown. Regions indicate where processing may take place; where that is outside the UK, the safeguards in section 6 apply.

• Anthropic - AI text and strategy generation (Claude models). Region: United States.
• Fireworks AI - AI text generation. Text requests are routed to whichever configured model provider can serve them, so the same prompts and workspace content sent to Anthropic may be sent here instead. Region: United States.
• Replicate - AI image, video, speech and transcription generation. Region: United States.
• OpenAI - AI image generation, reached through Replicate when you choose an OpenAI image model. Region: United States.
• fal.ai - AI image and video generation. Region: United States.
• Google (Gemini and Veo) - AI video generation. This is a separate service from Google Analytics below. Region: United States.
• Zernio - social publishing partner. When you connect an account other than X, Zernio holds that connection on your behalf and receives the post text and media we publish for you. Region: Spain / EU.
• X (Twitter) - social publishing and post metrics for a connected X account, published directly rather than through a partner; and advertising conversion measurement (X Ads pixel), only after you accept cookies in the cookie banner. Region: United States.
• Reddit - advertising conversion measurement (Reddit Pixel), only after you accept cookies in the cookie banner. Region: United States.
• Pexels, Coverr, Openverse and Shutterstock - stock photo and video libraries used to source media. Regions: United States / EU.
• Stripe - payment processing, subscriptions and credit purchases. Region: United States and EU.
• Resend - transactional and service email delivery. Region: United States.
• Laravel Forge and our hosting/infrastructure provider - application hosting, database and server management. Region: United Kingdom / EU.
• Our object-storage provider - storage and delivery of the images, video and documents in your workspace. Region: United Kingdom / EU.
• Cloudflare - bot and abuse protection on our public forms (Turnstile). Region: global.
• Google (Google Analytics, GA4, and Google sign-in) - website analytics: anonymous, cookieless page measurement for every visitor to our public website and sign-up pages, and analytics cookies only after you accept them in the cookie banner; and account sign-in if you choose "Continue with Google". Region: United States.
• tawk.to - live support chat: your chat messages, any details you share in a conversation, and basic visit data the chat widget collects so our team can help you. Region: United States.
• TikAPI and Apify - public TikTok data collection for our shared clip library. Used only where that pipeline is switched on, and it reads public platform content rather than your workspace. Regions: United States / EU.
• Error monitoring providers - diagnostics and uptime monitoring used to keep the Service secure and reliable. Region: United States / EU.

Not every provider above is used on every account: which AI model providers, stock libraries and publishing connections apply depends on the features you use and the accounts you connect.

We keep this list current and will give customers reasonable notice, by email or in-product notice, before a new sub-processor that materially affects the processing of your personal data takes effect, so you have the opportunity to object.

6. International transfers

Our providers may process data outside the UK, including in the United States. Where personal data is transferred internationally we rely on appropriate safeguards such as the UK Addendum to the EU Standard Contractual Clauses or adequacy regulations.

7. Retention

We keep account and workspace data while your account is active and for a reasonable period afterwards for backup, dispute and legal purposes, after which it is deleted or de-identified. Billing records are kept as required by tax law. Aggregated or de-identified data, which no longer identifies you, may be retained and used indefinitely.

8. Your rights

Under UK GDPR you may have rights to access, correct, delete, restrict or port your personal data, and to object to certain processing. To exercise them, email [email protected]. You can also complain to the Information Commissioner's Office (ico.org.uk). We may need to verify your identity and may retain data we are legally required or permitted to keep.

9. Cookies

We use cookies that are essential to run the Service: session, authentication and security cookies. These do not require consent.

We remember your cookie choice in browser storage and a first-party preference cookie named cognera_consent, for up to one year. It contains only “granted” or “denied”, not a visitor identifier. Our server also counts marketing sessions, visits to the signup form and completed signups using the existing session. These records include the landing path, campaign/source and cookie choice when known, but no IP address, device fingerprint or account identifier. Session-level visit records are removed after 90 days. A missing choice is recorded as unknown.

Anonymous page measurement, for every visitor. Our public website and sign-up pages load Google Analytics (GA4) in Google's consent mode. Before you make a choice, and if you decline, it runs without cookies: each page view sends Google an anonymous, cookieless measurement ping (the page, the page you came from, the time, and your browser and device type) so we can count visits. Nothing is stored on or read from your device for it. Like any web request, the ping reaches Google from your IP address; Google Analytics 4 does not log or store IP addresses.

Cookies, chat and ad pixels wait for you. Only if you accept cookies in the cookie banner does GA4 also set analytics cookies, so it can tell a returning browser from a new one and help us understand how people find and use Cognera. The advertising pixels and the live chat described below also wait for that choice. Declining has no effect on your ability to use the Service. To change your choice at any time, use Cookie settings at the foot of any page of our website, or on the Support page inside the product; a change applies straight away.

If you accept cookies in the cookie banner, our public website and sign-up pages also load the X Ads pixel, X's advertising conversion tag. It sets X's own cookies and tells X when a visit or a new sign-up came from our ads on X, so we can measure those ads. It is not loaded until you accept, it is not loaded inside the product once you are signed in (except on the one page that records your sign-up), and declining has no effect on your ability to use the Service. To withdraw your acceptance, open Cookie settings and choose Decline.

If you accept cookies in the cookie banner, our public website and sign-up pages also load the Reddit Pixel, Reddit's advertising conversion tag. It sets Reddit's own cookies and tells Reddit which pages of our public website you visit and when you create an account, so we can measure our ads on Reddit. It is not loaded until you accept, it is not loaded inside the product once you are signed in (except on the one page that records your sign-up), no email address or account details are passed to it, and declining has no effect on your ability to use the Service. To withdraw your acceptance, open Cookie settings and choose Decline.

Our live support chat (tawk.to) loads only after you accept cookies in the cookie banner or press "Chat with us". It then sets functional cookies so the chat widget can run: keeping your conversation connected as you move between pages and letting our team see when you need help. These cookies are used to provide the chat service, not for advertising.

10. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls and least-privilege practices. No system is perfectly secure, and you are responsible for keeping your credentials confidential.

11. Changes to this policy

We may update this policy at any time by posting the revised version here and updating the effective date. Material changes will be flagged by email or in-product notice where required. Continued use of the Service after changes take effect means the revised policy applies.