Draft. These terms are not in force yet and are being reviewed before launch.
Privacy Policy
What CoAlign collects, why, who sees it, and your choices.
Updated 7 November 2026
Who is responsible
Rohan Joshi, a sole proprietor trading as CoAlign, Mumbai, India ("we") runs CoAlign. For account, billing and website data we decide how the data is used, so we are the "controller". For the files, comments and names that a customer puts into its workspace, the customer decides and we process the data for it as a "processor"; we sign a data processing agreement with any customer that needs one (email support@coalign.app).
Contact for anything about privacy: support@coalign.app.
What we collect
Account data
Your name, email address, role and workspace. Team members and clients are added by invitation; we hold the email the invitation was sent to.
Content you or your team add
Files (PDFs and images), their versions, thumbnails, comments, replies, pin and area positions, decisions, due dates and notes. Files are stored privately.
Guest review links
When someone opens a link they type a name to comment. We record that the link was opened, with the time, an approximate network address and the browser type, so the customer can see who opened what. For confidential files the name or email and time are also shown on the watermark.
Activity and security records
An audit trail of opens, decisions, shares and permission changes, with the network address and browser type, and limits on sign-in and comment rates, to keep the Service secure and give customers a record.
We send sign-in links, invitations and notifications you ask for (new files, replies, decisions, due dates, an optional daily digest). Messages contain no file contents for confidential documents. You can change categories in Settings, or use the unsubscribe link in any email. We record whether an email was delivered or bounced.
Payment
Payments are handled by our reseller and Merchant of Record, Dodo Payments. It collects your card or payment details, billing address and tax information. We receive your name, email, plan, amount, country and payment status, but never your full card number.
Website visits
Standard server logs (network address, pages, browser, time). If we use website analytics we will name the provider in the list below and update this policy; we set it up to count visits without tracking you across other sites.
Why we use it, and our legal bases
| Purpose | Legal basis (GDPR and similar laws) |
|---|---|
| Provide the Service: accounts, review, comments, versions, notifications | Contract with the customer; legitimate interests of reviewers |
| Take payment, issue invoices, prevent fraud | Contract; legal obligation; legitimate interests |
| Security, abuse prevention, audit trail | Legitimate interests; legal obligation |
| Support | Contract; legitimate interests |
| Product updates and service emails | Contract; consent for any marketing, which you can withdraw at any time |
| Improve the Service from aggregate usage | Legitimate interests |
We do not sell personal data, and we do not use your files or comments to train AI models.
Companies that help us run the Service
| Company | What it does | Location |
|---|---|---|
| Supabase | Database, sign-in, scheduled email jobs, live updates | United States (East) |
| Cloudflare (R2) | Private storage of uploaded files and page images | United States (East) |
| Vercel | Hosts the website and application | United States (East) |
| Resend | Delivers sign-in, invitation and notification emails | United States |
Payments are handled by Dodo Payments, our reseller and Merchant of Record. It is an independent controller of your payment data under its own privacy policy. We give customers 30 days' notice by email before adding or replacing a company on this list that handles customer data.
Where data is stored and transfers
Customer files and the database are stored in United States (East). Our subprocessors and team may access data from other countries. Where personal data moves from the UK, EEA or Switzerland to a country without an adequacy decision we rely on the standard contractual clauses or another lawful safeguard.
How long we keep it
- Workspace content: while the subscription is active, then read-only for 30 days after it ends, then deleted (backups rotate out afterwards).
- Audit trail: as long as the workspace exists, and as long as the law requires for payment records.
- Billing and tax records: as long as tax and accounting law requires, typically 6 to 8 years.
- Guest sessions and sign-in records: short-lived, removed on a schedule.
- Email delivery records: up to 12 months.
Your rights
Depending on where you live (for example under the GDPR, UK GDPR, California law or India's Digital Personal Data Protection Act) you can ask to access, correct, delete or export your personal data, object to or restrict some uses, and withdraw consent. Email support@coalign.app. We reply within one month.
If you are a client or guest and your data is in a customer's workspace, we may pass your request to that customer, who decides how to answer it. You can also complain to your data protection authority.
Security
Each workspace is isolated in the database by row-level security. Files are private, never public, and reached only through short-lived links, each access logged. Data is encrypted in transit and at rest by our infrastructure providers. Restricted viewers get watermarked images, not the original file. No system is perfectly secure; if a breach affects you we will tell the customer and you without undue delay, as the law requires.
Children
CoAlign is for businesses and is not meant for people under 16. We do not knowingly collect their data.
Changes
We will update this page when something changes and email account owners before a material change. Updated 7 November 2026.