Privacy Policy

Last Updated: October 9, 2025

We value privacy. That is why we have established and implemented policies and practices governing personal data.

This statement describes how Co Run Ltd ("CoRun," "us," or "we") collects, uses, shares, stores, and otherwise processes personal data about users of the CoRun AI Chatbot (the "Service") and personal data processed through our website (the "Website").

CoRun is powered by Botpress technology. This means that certain data processing activities are conducted through Botpress Inc.'s infrastructure and services, subject to Botpress's data processing agreements and security measures.

Depending on the context, the use of the second person ("you" or "your") refers to a User, Visitor, and/or End-User.

Definitions

In this Privacy Statement:

• "Conversation Data" means content inputted by an End-User into the CoRun chatbot and data generated by CoRun in conversation with an End-User.

• "End-User" means an individual interacting with the CoRun chatbot.

• "Personal data" refers to any information that identifies or could be reasonably associated with an individual.

• "Visitor" means an individual browsing our Website.

• "User" means an individual using our Service, such as employees or authorized representatives of our organization.

• "Usage Data" means data about the Users' use of the Service, which may contain personal data where identifying individual users is necessary but excluding any Conversation Data.

Contact for data processing matters: corunjack@proton.me

1. What Personal Data is Collected

End-Users

We collect analytics data when End-Users interact with the CoRun chatbot, including:

• The operating system and language of a device

• The IP address from which a device accesses the Service

• The country, state, city, and postal code where the device is located

• Navigation data, such as pages viewed, number of connections to the Service, duration of a session, and date of connections to the Service

This data is collected for the sole purpose of providing and improving the Service. This data is not personally linked to a specific End-User and is transmitted to us in aggregate form.

Important: We do not use Conversation Data or other End-User personal data for any purpose other than providing the Service, including analytics, algorithm improvements, model training, or any other secondary purposes.

Users

We collect the following personal data from subscribed Users:

• Full name, email, and password

• Content of communications transmitted to us by Users

• Analytics data including:

  • Operating system and language of a device

  • IP address from which a device accesses the Service

  • Country, city, and postal code

  • Navigation data, such as pages viewed, connections to the Service, session duration, and connection dates

Visitors

When a Visitor uses our service, we automatically collect analytics data using tools such as Google Analytics:

• Operating system and language of a device

• IP address from which a device accesses the Website

• Country, state, city, and postal code

• Navigation data, such as pages viewed, number of connections, duration of sessions, date of connections, and referring pages

• Demographic information (gender, age range, interests - where available and permitted)

This information is recorded each time a Visitor interacts with the Website. This data is not personally linked to a specific Visitor and is transmitted to us in aggregate form.

Google Analytics may be deactivated on a browser through an add-on available at: https://tools.google.com/dlpage/gaoptout

2. Why We Process Personal Data

We process personal data collected through the Service or Website for the following purposes:

Operation of the Service and Customer Support

We process personal data to provide the CoRun chatbot service, including customer service and technical support. Conversation Data is processed only for this purpose.

We will process the personal data of Users and Visitors to respond to their requests, including requests for assistance, payment processing, and other service-related activities.

Communication

We process personal data to communicate with Users and Visitors about their use of the Service or Website. We may also send marketing communications about our products and promotions, but only if users have agreed to receive such communications. We comply with all applicable regulations regarding unsolicited electronic messages.

If you no longer wish to receive electronic communications from us, you may unsubscribe at any time by writing to us at corunjack@proton.me.

Identification and Authentication

To provide the Service, we process personal data to identify and authenticate Users.

Product Improvement

We process aggregated Usage Data to improve our products and services, identify trends in product use, and develop new features and offerings.

We also use browser cookies and other tracking technologies to improve our Website.

Personalization

We process data collected through the Website to offer Visitors content that corresponds to their situation or interests. For example, the home page may be displayed according to language preferences, and content may vary based on geographic location.

We may also use personal data to customize Users' experience of the Service.

Maintenance and Security

We process data collected through the Website and Service to:

• Monitor use of the Website and Service

• Prevent misuse of the Website or Service

• Identify problems or bugs

• Determine what features need improvement

• Ensure the security of the Website, Service, and our computer systems

• Prevent, monitor, and deter fraud and unauthorized access

Marketing and Retargeting

We process data collected through the Website to provide marketing materials and customize our advertising campaigns based on data collected, such as newsletter subscriptions, interest in our products, and clickthrough data.

We use browser cookies and other tracking technologies to personalize Visitors' experience on the Website and deliver advertisements to targeted audiences (based on Website traffic only).

Data collected through the Service, including Conversation Data, is not used for marketing purposes.

Legal Compliance

Where applicable, we process personal data to comply with laws and regulations that apply to our activities, including for dispute resolution, responding to lawful requests, and cooperating with government entities or courts.

3. How We Store and Transfer Personal Data

We retain your personal data only as long as necessary for the intended processing purposes or until you request that we destroy it. The retention duration is determined by the reasons for collecting personal data and as mandated by relevant laws.

Personal data may be processed by our service providers through facilities that may be located in other jurisdictions. Therefore, your personal data may be accessed or transferred outside your country of residence.

CoRun uses Botpress technology, and as such:

• Conversation Data is stored electronically by Botpress and its service providers on servers located in the United States or other locations.

• We ensure that the transfer of personal data is made in a secure manner, with appropriate safeguards concerning the nature of the personal data being transferred.

• Botpress Inc. is certified under the EU-US, UK-US, and Swiss-US Data Privacy Framework programs.

Data generated from Google Analytics is stored on servers controlled by Google.

4. How We Protect Personal Data

We have implemented organisational, physical, and technical measures to secure the personal data entrusted to us. Through our use of Botpress technology, we benefit from their security infrastructure and protocols.

Your personal data is hosted on servers operated by Botpress and its service providers and is protected against unauthorized access or use by security measures proportionate to the sensitivity of the data.

Our employees and suppliers are informed of the confidential nature of personal data collected through the Website and Service. They are made aware of appropriate security measures to prevent unauthorized access through cybersecurity policies and training.

For a complete description of security measures, you may contact us at corunjack@proton.me.

5. How We Share Personal Data

We only share personal data in the manner described in this statement. Your personal data may be disclosed to the following categories of recipients:

Our Employees

Personal data is accessible to our officers and employees who must have access to it as part of their duties. Each employee is bound by a confidentiality agreement.

Service Providers

We share personal data with service providers that allow us to provide our services more efficiently, including Botpress Inc. (our chatbot technology provider). We only share personal data with service providers that agree in writing to keep personal data confidential and implement appropriate security and data protection measures.

Key Service Providers:

• Botpress Inc. - AI chatbot platform and infrastructure

• Amazon Web Services (AWS) - Cloud hosting services

• Google Analytics - Website and service analytics

• OpenAI - AI text generation (via Botpress)

• Microsoft Azure - AI services (via Botpress)

Other Third Parties

• If required by law: We may disclose personal data to third parties if expressly permitted or required by law or if compelled by a competent authority. We may disclose personal data in connection with legal proceedings if necessary to protect our rights or those of our Users or to meet national security or law enforcement requirements.

• Transfer of business: If the sale or restructuring of all or part of our business is contemplated, we may disclose personal data to the persons or organizations involved before and after the transaction. These parties commit to maintaining confidentiality and using the data exclusively to evaluate the transaction and in accordance with this statement if the transaction is completed.

6. Your Privacy Rights

We may verify the identity of individuals asking to exercise their rights with respect to their personal data. Any information collected to perform this verification will not be used for any other purpose.

Withdrawal of Consent

Your browser allows you to withdraw your consent to certain processing of your personal data, in particular by preventing the recording of browser cookies.

If you wish to withdraw your consent beyond what is permitted by your browser, please notify us at corunjack@proton.me. Using the Website or Service entails some processing of your personal data. The only way to stop all processing is to stop using the Website and Service.

Right of Access, Rectification, and Portability

If you would like to access personal data we hold about you or have inaccurate personal data modified, you may make a request at corunjack@proton.me. We will respond promptly and no later than required under applicable law. If required by law, we will provide personal data in a structured, commonly used, and machine-readable format.

Right to Deletion

You may, in certain circumstances, request the deletion of personal data that we hold about you. To make such a request, please write to us at corunjack@proton.me. We will respond promptly and no later than required under applicable law. If you continue to use the Website or Service, we will again collect certain personal data about you.

Restriction of Processing

You may request the restriction of the processing of your personal data where such processing is unlawful, if you contest the accuracy of such personal data, or where deletion of personal data is not permitted under applicable law. You may make a request at corunjack@proton.me.

Right to Limit Use and Disclosure

You may have the right to limit the use and disclosure of your personal data. Although CoRun currently does not share personal data with third parties for purposes materially different from those stated in this policy, we remain committed to ensuring you can exercise this right should that practice change in the future.

Complaint

If you wish to lodge a complaint in relation to the processing of your personal data by CoRun, you may do so by writing to corunjack@proton.me. You may also lodge a complaint with the supervisory authority of your place of residence.

7. Cookies and Tracking Technologies

We use browser cookies and other tracking technologies to:

• Improve the performance of the Website

• Personalize Visitors' experience on the Website

• Deliver advertisements to targeted audiences (based on Website traffic only)

Visitors can control the storage of browser cookies from their browser. Cookies and trackers that are not strictly necessary for the website's operation will not be used without the Visitor's consent.

8. Minors

The CoRun Service and Website do not knowingly collect personal data from children under the age of 16. Children under 16 years of age should not use our Service or Website or provide CoRun with any personal data without the consent of a parent or legal guardian.

Should we become aware of the collection of personal data from a minor under 16 years of age, we will promptly remove this information. If you suspect such an incident, please contact corunjack@proton.me.

9. Information for Individuals in the European Economic Area (EEA), the United Kingdom (UK), and Switzerland

CoRun processes personal data in compliance with GDPR requirements through our use of Botpress technology, which adheres to GDPR and participates in the EU-US, UK-US, and Swiss-US Data Privacy Framework programs.

Legal Basis for Processing

We process personal data based on the following legal bases:

• With your consent, where applicable

• To fulfill our obligations under our agreements with Users

• Where necessary, based on our legitimate interests, to:

  • Provide the Service

  • Manage our relationship with you

  • Operate our Website

  • Provide support to Users, End-Users, and Visitors

  • Improve our products based on aggregated data

  • Detect, prevent, or investigate misuse, fraud, security incidents, or other illegal activities

• To comply with our legal or regulatory obligations

Data Transfers

Your personal data might undergo processing, transfer, or disclosure in the United States and other countries where our service providers operate. We ensure that recipients of your personal data maintain an adequate level of protection through arrangements such as standard contractual clauses or other approved transfer mechanisms.

Botpress Inc., our technology provider, is certified under the EU-US, UK-US, and Swiss-US Data Privacy Framework programs operated by the US Department of Commerce.

Data Protection Officer

For any inquiries regarding data protection, you may contact us at corunjack@proton.me.

10. Modifications to This Privacy Statement

We may modify this Privacy Statement from time to time to reflect changes in our personal data processing practices or requirements under applicable law. If a modification is made, the new statement will be available through the Service and on the Website.

The date at the top of the statement will be updated to reflect the date of effectiveness. We recommend that you check this page periodically to inform yourself of any changes.

11. Contact Information

For any questions or concerns about this Privacy Statement or our data processing practices, please contact us at:

Co Run Ltd
98 St John's Hill
London, SW11 1SH
United Kingdom
Email: corunjack@proton.me

This privacy policy was last updated on October 9, 2025. CoRun is powered by Botpress technology. For information about Botpress's data processing practices, please visit https://botpress.com/privacy