Privacy Policy

Pocodot Labs, Inc. is a Delaware corporation operating a cloud-based AI agent platform at pocodot.ai. We are the data controller for personal data we collect directly from you. For enterprise customers, we act as a data processor - see Section 6.

For questions about this policy or to exercise your rights, contact us at privacy@pocodot.ai.

We collect the following categories of personal data:

We do not sell your personal data. We do not share your personal data for cross-context behavioral advertising.

• Prompts and instructions you provide are processed to operate the service
• Third-party data your agents access (emails, files, contacts, etc.) is processed on your behalf - you are responsible for having a lawful basis to process that data
• Agent action logs are retained for 90 days to support debugging and audit
• We do not use your agent data or configurations to train AI models without your explicit opt-in consent

Site logins you store. If you add a login to your workspace Vault, we store the site, the username and the password. Passwords are encrypted with a key specific to your workspace; our staff cannot read them, and they are decrypted only at the moment Cole signs in to that site for you. We keep a log of when each stored login was used and on which site, which you can view in your workspace. When you delete a stored login it is removed immediately and is not retained in backups beyond our standard retention window.

Browser activity. When Cole visits websites for you, we process the pages it visits, the text it reads, and screenshots it takes to show you its work. Screenshots you receive are stored so the link keeps working; you can ask for them to be deleted. We do not record your own screen, keyboard, microphone, or device location in the background, and we do not use any of this content to train models.

Locations you share. If you send Cole a location pin in a chat, or tap its request to share your location, we store that pin (coordinates, and the place name or address if you included one) with the time you shared it so Cole can help with things nearby and remember where you were. We never read your device location in the background and Cole cannot track you. You can see and delete shared locations in your workspace under Account, Config, Locations, and deletion is immediate.

1Password vault sharing. If you connect 1Password, we store the service account token you provide, encrypted with a key specific to your workspace, and use it only to read the single vault you chose to share. Cole reads a login from that vault, including its one-time code, only at the moment it signs in to that site for you, and each use is recorded in your workspace activity. Disconnecting deletes the token immediately.

Payment cards you store. If you add a card, we store the card number and security code encrypted with a key specific to your workspace, together with the card brand, the last four digits, the expiry and the cardholder name. Cole enters the card only at the moment of a payment you approved in chat, and only once per approval. Each payment is recorded with the amount, currency and merchant so you can see it in your workspace, and your monthly spending cap is enforced before the card is used. Deleting a card removes it immediately.

Watches. When you ask Cole to watch a web page, we store the page address, what to look for, and the last value we saw, and we fetch that page on the interval you chose until the watch fires, expires or you cancel it. A trigger you set up (for example from a Shortcut on your phone) stores only its name; the address we give you contains a token specific to your workspace, so treat it like a password.

We use your data for the following purposes:

• To provide, operate, and maintain the Platform
• To authenticate and secure your account
• To improve platform features using aggregated, non-identifiable data only
• To comply with legal obligations
• To communicate service updates, security notices, and (where consented) marketing

Pocodot's platform uses automated decision-making technology (ADMT) as part of its AI agent infrastructure. Before deploying agents that use ADMT, you will receive a pre-use notice describing what decisions are being automated and their significance. You have the right to opt out of ADMT used for profiling purposes - see your Privacy Preference Center in account settings.

• Consumer users: Pocodot is the data controller for your account and usage data.
• Enterprise customers: Where you use Pocodot to process personal data on behalf of your organization, Pocodot acts as your data processor. A Data Processing Agreement (DPA) is available at legal@pocodot.ai.
• Your agents processing third-party data: You become the data controller for any personal data your agents collect or process about individuals outside your account.

Depending on your location, you have the following rights:

To exercise your rights: privacy@pocodot.ai. We will respond within 30 days (GDPR) / 45 days (CCPA) / 30 days (other applicable US state laws).

We retain your data according to the following schedule:

Pocodot Labs, Inc. is a US-based company. If you are located in the EU or UK, your personal data is transferred to the United States under one of the following safeguards:

• EU-US Data Privacy Framework (DPF) - Pocodot will self-certify under the DPF program
• Standard Contractual Clauses (SCCs) - available upon request for enterprise customers

We implement industry-standard security measures including:

• TLS encryption in transit
• AES-256 encryption at rest
• Role-based access controls
• Regular security audits

We will notify affected users of a data breach within 72 hours of discovery where required by law.

Pocodot uses essential cookies required to operate the platform (authentication, session management) and optional analytics cookies. You can manage cookie preferences at any time via the cookie banner or your browser settings. We do not use third-party advertising cookies. For full details, see our Cookie Policy.

We maintain an up-to-date sub-processor list and will notify enterprise customers of changes per their DPA. See our full Subprocessors page.

Pocodot integrates with third-party advertising platforms — including TikTok Business API, Meta Marketing API, and Google Ads API — in two ways:

• User-connected accounts: Users may connect their own advertising accounts via OAuth 2.0 so that Cole, our AI assistant, can read performance data and execute user-approved management actions (e.g., pausing campaigns, adjusting bids, adding keywords) on their behalf.
• Internal reporting: Pocodot also receives aggregated ad performance metrics for accounts it owns or is authorized to manage, used for internal analytics and cross-platform campaign performance reporting.

OAuth tokens for user-connected accounts are encrypted at rest, stored server-side only, and are never exposed to the AI model or any third party. Users can disconnect any integration at any time, which deletes the stored credentials.

Pocodot does not sell, share, or redistribute advertising data obtained from these platforms. Pocodot does not access individual user data from advertising platforms and does not use advertising platform data for profiling, cross-context behavioral advertising, or any purpose beyond providing the requested features to the account owner.

With whom we share, transfer, or disclose Google user data

Pocodot shares, transfers, or discloses Google user data (such as Google Ads account, campaign, and performance data accessed via the Google Ads API) only with the following limited categories of recipients, and only as necessary to provide the user-facing features you request:

• Cloud infrastructure provider (DigitalOcean): hosts Pocodot's servers and stores Google user data encrypted at rest on our behalf as a sub-processor.
• AI model provider (Anthropic): when you ask Cole to read, summarize, analyze, or act on your Google Ads data, the relevant data is transmitted to our AI model provider solely to generate your requested response. It is processed under terms that prohibit using it to train their models.
• Legal or corporate successors: where required to comply with applicable law or valid legal process, or as part of a merger, acquisition, or asset sale, in which case we will provide notice and honor prior user consent.

Pocodot does not share, sell, transfer, or disclose Google user data to advertising networks, data brokers, data aggregators, or any other third party, and does not use it for serving advertising, retargeting, or profiling. We do not allow humans to read Google user data except as described in the Limited Use disclosure below.

For details on our TikTok Business API integration specifically, see our TikTok Business API Integration Disclosure.

Pocodot is not intended for users under 18. We do not knowingly collect personal data from minors. If we become aware that a minor has created an account, we will delete the account and associated data promptly. Contact privacy@pocodot.ai if you believe a minor has accessed the platform.

In addition to CCPA/CPRA, residents of Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and other states with applicable privacy laws have rights substantially similar to those described in Section 7. Contact privacy@pocodot.ai to exercise any state privacy rights.

We will provide 30 days' notice of material changes to this Privacy Policy via email or platform notice before they take effect. Your continued use of the Platform after the notice period constitutes acceptance of the updated Policy.

• Data Controller: Pocodot Labs, Inc. · 765 Market St, San Francisco, CA 94103, USA
• Thailand operations: POCODOT Ltd. (บริษัท โพโคดอต จำกัด) · Bangkok, Thailand
• Privacy inquiries: privacy@pocodot.ai
• Legal inquiries: legal@pocodot.ai

EU residents may also lodge a complaint with your local data protection authority if you believe your rights have not been adequately addressed.