Colle Privacy Policy
Last updated: October 13, 2026
Draft for the pilot. Company details marked [TO CONFIRM] and the text as a whole must be confirmed and reviewed before launch.
This Privacy Policy explains how Colle collects, uses, stores and protects personal data when you visit our website, sign up for the pilot or use the Colle Service. It is prepared in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Lithuanian law.
Colle is a business service. For the work your organisation hands off through Colle — summaries, facts, files and cases — your organisation decides what is processed and is the controller; Colle processes that content on its behalf under our Data Processing Agreement. For everything else described here (our website, accounts, billing, support), Colle is the controller.
01Who we are
- Company: [TO CONFIRM: legal name]
- Registration code: [TO CONFIRM]
- Address: [TO CONFIRM], Vilnius, Lithuania
- Email: hello@trycolle.com
02Our two roles
Colle as controller
We decide how personal data is processed for our website, pilot sign-ups, organisation and user accounts, billing, security and support. This policy describes that processing.
Colle as processor
Content your organisation's people put into Colle ("Customer Data") is processed only on your organisation's instructions, under the Data Processing Agreement (DPA) that forms part of our Terms of Service. If you want to exercise your rights over Customer Data — for example, a handoff that mentions you — please contact the organisation that uses Colle; we help them respond.
03Personal data we collect
| Category | Data |
|---|---|
| Pilot sign-up | Your work email address, its company domain and the time you signed up |
| Account data | Name, work email, role, and department or job title (from your company directory or sign-in provider); sign-in identifiers from Google Workspace, Microsoft Entra or the Colle sign-in |
| Customer Data (as processor) | Handoff summaries, facts, files, case titles, comments and the personal data they contain |
| Usage and security data | Audit log entries (who did what, and when), IP address for rate limiting and security, technical request logs without the content of handoffs |
| Notification data | Browser and extension push subscriptions (an endpoint address and keys), so notifications can reach your devices |
| Billing data | Billing contact, company details, invoices and payment history; card details are handled by our payment provider, not stored by us |
| Communication data | Support requests, feedback and correspondence |
| Website analytics | Only if you allow analytics: aggregate visit and click statistics through Plausible, without cookies or personal profiles |
04Purposes and legal basis
We process personal data for these purposes, on the legal bases of GDPR Article 6:
| Purpose | Legal basis |
|---|---|
| Creating and running accounts, signing in | Contract (Art. 6(1)(b)) |
| Providing the Service: handoffs, cases, files, notifications | Contract (Art. 6(1)(b)) |
| Billing and invoicing | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Responding to pilot sign-ups and demo requests | Legitimate interest (Art. 6(1)(f)) |
| Security, abuse prevention, rate limiting and the audit log | Legitimate interest (Art. 6(1)(f)) |
| Service notices and support | Legitimate interest (Art. 6(1)(f)) |
| Website analytics | Consent (Art. 6(1)(a)), which you can withdraw at any time |
| Accounting and other legal requirements | Legal obligation (Art. 6(1)(c)) |
We do not use personal data or Customer Data to train AI models, and we do not sell personal data.
05Recipients and sub-processors
| Recipient | Purpose | Location |
|---|---|---|
| Fly.io | Hosting of the application, database and file storage | EU (Frankfurt, Germany) |
| Push services (Google, Apple, Mozilla) | Delivering notifications to your browser or phone; the content is encrypted with your device's key and kept for at most one hour | May be outside the EU |
| Google Workspace or Microsoft Entra | Signing in, if your organisation uses them | Per your organisation's agreement |
| Plausible Analytics | Website statistics, only with your consent | EU |
| Payment provider [TO CONFIRM] | Processing payments once billing starts | [TO CONFIRM] |
| Authorities | Only when the law or a court order requires it | — |
AI assistants
Colle works inside AI assistants such as Claude (Anthropic) and ChatGPT (OpenAI). When you ask your assistant to hand off or read work, the assistant provider processes that conversation under your own or your organisation's agreement with that provider. These providers are not Colle's sub-processors, and Colle does not send them data on its own.
06International transfers
Colle stores personal data and Customer Data in the European Union (Frankfurt, Germany). Some providers are based outside the EU/EEA (Fly.io in the United States; push services may route messages globally). Where personal data may be transferred outside the EU/EEA, we rely on safeguards under GDPR Chapter V:
- European Commission adequacy decisions, including the EU–US Data Privacy Framework where the provider is certified
- Standard Contractual Clauses approved by the European Commission
- Data processing agreements with every processor
07How long we keep data
| Data | Retention |
|---|---|
| Customer Data | For the subscription; deleted within 30 days after it ends, and from backups within the following 14 days |
| Account data | While the account is active; removed when your organisation deactivates you or ends its subscription |
| Audit log | For the subscription, exportable by administrators; then deleted with Customer Data |
| Pilot sign-ups | 12 months, or earlier if you ask us; deleted automatically after that |
| Security and request logs | 30 days |
| Billing and accounting records | As long as Lithuanian accounting law requires (currently 10 years) |
| Support correspondence | 2 years after the request is closed |
08Your rights
Under the GDPR you have the right to:
- Access your personal data and information about how it is processed (Art. 15)
- Have inaccurate or incomplete data corrected (Art. 16)
- Have your data erased (Art. 17)
- Restrict processing (Art. 18)
- Receive your data in a structured, machine-readable format (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time, without affecting earlier processing
- Not be subject to decisions based solely on automated processing with legal or similarly significant effects (Art. 22)
To exercise these rights, email hello@trycolle.com. We answer within one month. For Customer Data, contact your organisation first; we help it respond, including erasure, which in Colle destroys the encryption key of a person's personal data in facts.
09Right to lodge a complaint
You may lodge a complaint with a supervisory authority, in particular in the EU country where you live, work or where the alleged infringement took place. In Lithuania:
- State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija)
- Address: L. Sapiegos g. 17, 10312 Vilnius, Lithuania
- Website: vdai.lrv.lt
- Email: ada@ada.lt
10Is providing data required?
Providing personal data is voluntary, but some of it is needed to use the Service: a work email address to sign up for the pilot or to have an account, and billing details for a paid subscription. Website analytics are always optional.
11Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The Service automatically flags text that looks like instructions to an AI assistant and applies rate limits; these protect users and do not decide anything about you. You can contact us if you think a flag or limit is wrong.
13Security
We protect personal data with technical and organisational measures, including:
- Encryption in transit (TLS) and encrypted disks at rest, with daily backups
- Database-level isolation of each organisation's data on every query
- A separate encryption key per person for personal data in facts
- Permissions by space, and least-privilege roles inside our systems
- A tamper-evident, hash-chained audit log
- Protection against prompt injection: colleague text is marked untrusted and scanned
If a personal data breach is likely to result in a risk to your rights and freedoms, we notify the supervisory authority within 72 hours and, where the risk is high, the people affected (GDPR Articles 33 and 34). For Customer Data, we notify the organisation without undue delay.
14Children
Colle is a service for businesses and is not directed to anyone under 18. We do not knowingly collect their personal data; if you believe we have, contact hello@trycolle.com and we will delete it.
15Changes to this policy
We may update this policy. We announce material changes at least 30 days in advance, by email to administrators and in the Service. The date at the top shows the latest version.
16Contact
- Company: [TO CONFIRM: legal name]
- Registration code: [TO CONFIRM]
- Address: [TO CONFIRM], Vilnius, Lithuania
- Email: hello@trycolle.com
This Privacy Policy is prepared in accordance with the GDPR and applicable EU and Lithuanian law. Questions: hello@trycolle.com.
Back to the home page