Privacy Policy
Last updated: June 7, 2026
This Privacy Policy explains how SACS Ecommerce Stores Inc., operating as "Cohvia" ("we," "us"), handles personal data. It covers two different situations, because Cohvia plays two different roles:
- As a controller, when we decide how and why to process personal data — for example, data about visitors to our website, people who sign up for or administer a Cohvia account, and recipients of our marketing. This Policy is our notice to those individuals.
- As a processor, when we process personal data contained in the data our customers connect or upload to the Service ("Customer Data") on their instructions. For that data, our customer is the controller, and our handling is governed by our Data Processing Agreement. If you are an individual whose data appears in a customer's account (for example, because you were named in a transcript or email), please contact that customer; we will assist them in responding to you.
If you are in the EEA, UK, Switzerland, the United States, or Canada (including Quebec), the regional sections below give you additional information and rights.
1. Who we are
The controller of personal data described in this Policy is:
SACS Ecommerce Stores Inc. (operating as Cohvia) 620 King Street North, Suite 1004 Waterloo, Ontario N2J 4G8, Canada Privacy contact: privacy@cohvia.com Designated Privacy Officer (Quebec Law 25): Sarah Cunningham-Scharf, Founder & CEO
EEA/UK representative. [If required under Article 27 GDPR / UK GDPR, our representative is: [NAME AND ADDRESS OF EU/UK REPRESENTATIVE].]
2. The personal data we collect (as controller)
Account and identity data: name, business email, organization, role, and authentication identifiers when you register or are added to an account.
Billing data: subscription tier, transaction records, and limited billing details. Full payment-card data is collected and processed by our payment provider, not stored by Cohvia (see Section 6).
Usage and device data: log data, IP address, browser/device type, pages viewed, feature usage, and similar analytics, including via cookies and similar technologies (see our cookie information at Section 9).
Communications: messages you send us (support requests, emails) and related metadata.
Marketing data: preferences and engagement with our communications.
We do not seek to collect special categories of personal data about website visitors or account users in our role as controller.
3. How and why we use personal data, and our legal bases
| Purpose | Examples | Legal basis (GDPR/UK GDPR) |
|---|---|---|
| Provide and administer accounts | Authentication, account management, support | Performance of a contract |
| Billing and payments | Processing subscriptions and invoices | Performance of a contract; legal obligation |
| Operate, secure, and improve our website and Service | Logging, analytics, fraud and abuse prevention | Legitimate interests |
| Communicate with you | Service messages, responses to enquiries | Performance of a contract; legitimate interests |
| Marketing | Sending updates and offers about Cohvia | Consent where required; otherwise legitimate interests |
| Comply with law | Tax, accounting, responding to lawful requests | Legal obligation |
Where we rely on legitimate interests, we have balanced those interests against your rights. You may object to that processing (see Section 7).
4. How we use AI
Cohvia is an AI-native platform. In providing the Service to customers, we process Customer Data through AI models to generate insights and narratives. We do not use Customer Data, or personal data about our account users, to train, fine-tune, or improve AI models. AI processing is routed to commercial model providers that are contractually committed not to train on the data submitted to them. AI-generated content within the Service is labelled as such, and where you interact with an AI feature, this is indicated.
5. Who we share personal data with
Service providers / subprocessors. We use trusted vendors to host and operate the Service (hosting, database, authentication, data integration, AI model routing, payments, and analytics). Our current subprocessors, their roles, and locations are listed at Subprocessors list. They are bound by contracts limiting their use of personal data to providing services to us.
Payment provider (independent controller). Our payment provider, Dodo Payments, acts as merchant of record and as an independent controller of the payment and buyer data it collects directly from you to process transactions. Its handling of that data is governed by its own privacy policy.
Corporate transactions. If we are involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy.
Legal and safety. We may disclose personal data to comply with law, enforce our agreements, or protect the rights, safety, and security of Cohvia, our users, or the public.
We do not sell personal data, and we do not "share" it for cross-context behavioral advertising as those terms are defined under US state privacy laws.
6. International data transfers
Cohvia is established in Canada, which the European Commission has determined provides an adequate level of protection for personal data subject to PIPEDA. Where we or our subprocessors transfer personal data out of the EEA, UK, or Switzerland to a country without an adequacy decision, we use appropriate safeguards, principally the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum / Swiss addendum where applicable). Where a recipient is certified under the EU-US Data Privacy Framework (and its UK and Swiss extensions), we may also rely on that certification. You can request a copy of the relevant safeguards by contacting privacy@cohvia.com.
7. Your data protection rights
Depending on where you live, you may have rights to: access your personal data; correct it; delete it; restrict or object to processing; data portability; withdraw consent (without affecting prior processing); and lodge a complaint with a supervisory authority. We do not subject account users to solely automated decisions producing legal or similarly significant effects.
To exercise any right, contact privacy@cohvia.com or use the privacy request form at the bottom of this page. We will respond within the timeframe required by applicable law (generally one month under GDPR/UK GDPR). We may need to verify your identity. These rights are free to exercise, subject to limited exceptions for manifestly unfounded or excessive requests.
To raise a data protection complaint about our processing when we act as a controller (including UK rights described in Section 12.1), email privacy@cohvia.com with subject line [Data protection complaint], use the privacy request form at the bottom of this page and select Data protection complaint, or read the overview at https://app.cohvia.com/legal/privacy-complaints.
If your personal data sits within a customer's Cohvia account (Customer Data), the customer is the controller; we will refer your request to them and assist them in responding.
8. Data retention
We keep personal data only as long as needed for the purposes described, then delete or anonymize it:
- Account data: for the life of the account, then deleted within a defined period after closure.
- Billing records: as required for tax and accounting (typically up to 7 years).
- Usage logs: for a limited period for security and analytics.
- Marketing data: until you unsubscribe or object.
- Customer Data (as processor): per the retention and deletion terms of the DPA, including any post-termination export window.
9. Cookies and similar technologies
We use cookies and similar technologies for essential functionality, security, and analytics. Where required by law (including in the EEA and, for non-essential cookies, the UK), we ask for your consent and provide controls to manage your preferences. You can also control cookies through your browser. Where supported by our consent management platform, we honour the Global Privacy Control (GPC) browser signal for US visitors as described in Section 12.2. See our full Cookie Policy.
10. Children
The Service is a business tool and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact privacy@cohvia.com.
11. Security
We maintain administrative, technical, and organizational measures designed to protect personal data appropriate to the risk, including encryption in transit and at rest, access controls, and tenant isolation. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Our security measures applicable to Customer Data are described in the DPA.
12. Regional disclosures
12.1 European Economic Area, United Kingdom, and Switzerland
The controller, legal bases, transfer mechanisms, retention, and rights are described above.
EEA and Switzerland: You have the right to lodge a complaint with your local supervisory authority (for example, in Ireland, the Data Protection Commission).
United Kingdom: You have the right to lodge a complaint with the Information Commissioner's Office (ICO). You may also make a complaint to us about our processing when we act as controller — for example, how we handle personal data about people who use our website or administer a Cohvia account (this does not replace complaints to your employer-customer when they are the controller of Customer Data about you). From 19 June 2026, the Data (Use and Access) Act 2025 includes an explicit statutory right for data subjects to complain to the controller in those circumstances.
How to complain to us: Email privacy@cohvia.com with the subject line [Data protection complaint], use the privacy request form at the bottom of this page and select Data protection complaint, or visit https://app.cohvia.com/legal/privacy-complaints. We will acknowledge your complaint without undue delay and, where UK law requires, within 30 days of receipt. We will investigate and pursue resolution without undue delay and keep an internal record until the complaint is closed.
12.2 United States — state privacy rights
Depending on your state of residence (including California, Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and others with comprehensive privacy laws), you may have rights to know/access, correct, delete, and obtain a portable copy of your personal information, to opt out of "sale," "sharing"/targeted advertising, and profiling, and to limit the use of sensitive personal information, plus a right against discrimination for exercising these rights.
- Categories of personal information we collect, our purposes, and the categories of recipients are described in Sections 2, 3, and 5. We collect identifiers, commercial information, internet/usage activity, and professional information.
- Sale/Sharing: We do not sell personal information and do not share it for cross-context behavioral advertising.
- Sensitive personal information: We do not use or disclose sensitive personal information for purposes that would trigger the right to limit.
- Universal opt-out / Global Privacy Control (GPC): Where supported by our consent management platform (Cookiebot), we treat a valid GPC signal in the browser as a request to opt out of cookies and similar technologies that are not strictly necessary for providing our website — including analytics cookies that could otherwise qualify as “sharing” for targeted advertising under some US state laws. This supplements (and does not replace) the choices you make in our cookie banner.
- Do Not Sell or Share My Personal Information: You may use the Do Not Sell or Share My Personal Information link in our website footer (or Cookie preferences) at any time to open the same consent tool and withdraw consent for non-essential cookies, or to adjust categories such as analytics, where offered.
- To exercise other rights, contact privacy@cohvia.com. You may use an authorized agent. We will verify requests as required by law.
12.3 Canada (PIPEDA)
We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act and applicable provincial laws. You may request access to and correction of your personal information and may direct questions or complaints to our privacy contact, and ultimately to the Office of the Privacy Commissioner of Canada.
12.4 Quebec (Law 25)
For Quebec residents: our designated person responsible for the protection of personal information is Sarah Cunningham-Scharf, Founder & CEO, reachable at privacy@cohvia.com. We obtain consent appropriate to the sensitivity of the data; we have conducted (or will conduct) a privacy impact assessment before transferring Quebec residents' personal information outside Quebec; you have rights of access, correction, portability, and de-indexation; and where we make a decision based exclusively on automated processing, you may be informed and may submit observations. A French-language version of this Policy is available at /legal/confidentialite.
13. Changes to this Policy
We may update this Policy. We will post the updated version with a new "Last updated" date and, for material changes, provide additional notice where required.
Contact: SACS Ecommerce Stores Inc. (operating as Cohvia), 620 King Street North, Suite 1004, Waterloo, Ontario N2J 4G8, Canada. Privacy enquiries and requests: privacy@cohvia.com.