Privacy Policy

Effective November 8, 2026

1. Who we are and what this covers

This policy describes how Restoration Focused, LC ("we") handles personal information in the Chief of Staff sales platform at coscrm.io and app.coscrm.io, and on the marketing site. It is written for the people who use the Service and the people whose information our customers manage in it.

Our customers are businesses. For the prospect and contact records a customer keeps in its workspace, the customer decides what is collected and why; we process that information on the customer's behalf under our Terms of Service.

2. What we collect

Account information. Name, work email, password (stored only as a one-way hash), role, and workspace membership.

Workspace content. What users put into the CRM: company and contact records, voice memos and their transcripts, notes, schedules, uploads from a previous CRM, and the records our agents derive from these.

Connected Google account data. If a user connects Google: email messages relevant to the companies in the workspace, calendar events, and the address of the connected mailbox. Section 3 governs all of it.

Voice assistant calls. Audio is processed to run the conversation, and the transcript of each call is stored in the workspace so the assistant has memory between calls.

Enrichment data. When a user asks for research, we retrieve business information (company details, names, titles, work contact details) from the data providers in section 5 and store what the user accepts into the workspace.

Usage and device information. Sign-in events, feature usage, IP address, and browser type, plus server logs and an audit trail of agent actions. We do not run third-party advertising trackers in the app.

Billing information will be processed by a payment provider when paid plans launch; we will not store card numbers ourselves.

3. Google user data

Chief of Staff's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What that means in practice:

• We request four permissions: read Gmail, send Gmail, read Calendar, and create Calendar events. Each user grants them individually for their own account; no one else's connection touches their mailbox.
• Gmail data is used only to show the user their own correspondence in context, keep their account timelines current, and send messages that user has individually approved. Calendar data is used only to display the user's schedule, answer the user's questions about it, and create events on the user's instruction. We never edit or delete calendar events.
• We do not transfer Google user data to third parties except as needed to provide these features (our hosting and AI subprocessors under contract), to comply with law, or as part of a merger with notice. We do not sell it, do not use it for advertising, and do not use it to train generalized AI models.
• Humans do not read Google user data except with the user's explicit consent for a support issue, for security investigation or abuse prevention, or where the law requires.
• Stored Google OAuth tokens are encrypted at rest. Disconnecting Google in the app deletes the stored tokens.

4. How we use information

To run the Service: file what reps say into the right records, keep timelines current, prepare the daily plan, draft messages for approval, hold voice conversations with memory, research companies on request, and show teams their shared book. To operate responsibly: secure accounts, enforce rate limits and usage ceilings, keep the audit trail, measure costs, fix problems, and meet legal obligations. To communicate: transactional email such as invitations and password resets, and product updates customers can opt out of.

We do not sell personal information and do not use workspace content for advertising. AI providers process workspace content to produce requested output and are barred by our agreements from training on it.

5. Service providers

These companies process data for us, under their own contractual confidentiality and security obligations. We share only what each needs for its job.

6. Security

In effect as of this policy: TLS on every connection with the application behind Cloudflare's protections; passwords stored as salted scrypt hashes with a 10-character minimum; brute-force lockouts on sign-in, password reset, and signup; Google OAuth tokens encrypted at rest with a key held outside the database; per-workspace data isolation checked on every request; sessions as the only way in (no shared or master passwords); every agent action written to an audit log; daily, weekly, and monthly database backups plus continuous point-in-time recovery; uptime monitoring; and daily usage ceilings on AI voice actions. No system is perfectly secure, and we will notify affected customers of a breach as the law requires.

7. Retention and deletion

Workspace data is kept while the workspace is active. When a customer requests deletion, the workspace is disabled for a 30-day recovery window and then purged from live systems; backup copies age out on the backup retention schedule (currently up to 89 days for monthly backups). Disconnecting a Google account deletes its stored tokens immediately; email and calendar records already filed into timelines remain part of the workspace until the workspace is deleted. Server logs and audit records are kept 12 months for security and support.

8. Your choices, your rights, and the rest

Users can see and edit their profile, disconnect Google, and export workspace data (admins) from inside the app. A person whose information appears in a customer's workspace should direct requests to that customer; we will help the customer honor them. For anything else, write to [email protected] and we will respond within 30 days. Depending on where you live you may have rights to access, correct, delete, or receive a copy of your personal information. The Service is not directed at children and is not for anyone under 18.

We will post changes to this policy here and, for material changes, notify customers in the app or by email before they take effect.

Restoration Focused, LC, 24 Elizabeth St, Asheville, NC 28801. Email: [email protected].