1. Controller and contact
The controller for this website and our own account, contract and security processes is centerbit UG (haftungsbeschränkt), Ganghoferstraße 67, 83059 Kolbermoor, Germany, represented by managing director Kevin Eder. Contact info@centerbit.co or write to this address for privacy enquiries.
Where an organisation uses CogLake for employee, customer or other workspace data, it generally determines the purposes of that processing. We act as processor to the extent we process those contents on its instructions. Please also contact the relevant organisation about those contents; we assist it with requests. Operators of self-hosted installations are responsible for their infrastructure and configuration.
2. Website, connection data and security
Servers process connection IP addresses, requested addresses, timestamps, response status and technical browser information as necessary to deliver, troubleshoot and protect the service. The basis is Article 6(1)(f) GDPR and our legitimate interest in a secure, working service. Transport uses TLS.
Website fonts are served by our website; ordinary page access is not intended to make your browser request fonts from Google. Linked external sites are operated independently and have their own privacy notices.
3. Accounts and collaboration
We process names, email addresses, account and organisation membership, roles, permissions, preferences and authentication/security data. Passwords are stored as hashes. Verification and recovery use time-limited codes or tokens. Invitations include identity and organisation details necessary for collaboration.
Processing supports contracts and pre-contractual steps under Article 6(1)(b) GDPR and legitimate interests in secure collaboration and abuse prevention under point (f). Legally required records use point (c). Workspace administrators manage members and permissions within their authority.
4. Knowledgebase, files, chats and agents
CogLake processes supplied documents, metadata, extracted text, search indexes, embeddings, queries, selected context and answers. Connectors can synchronise authorised source data and access rights. Uploaded/generated files, conversations and personal memories are stored according to the feature. An index or reference does not mean no copies or derived data exist.
Agents and automations process instructions, rules, schedules, tool calls, parameters, results and approvals. Browser and sandbox features can process visited pages, screenshots and working files. External actions use the granted permissions. Supply only contents and credentials you are entitled to use.
These functions are provided under Article 6(1)(b) GDPR or on behalf of a controller. Special-category data additionally requires an applicable Article 9 condition. Filters may detect, redact or pseudonymise contents; they do not guarantee complete detection or legal anonymity.
5. AI providers, plugins and customer connections
External model calls transmit the assembled inputs, context and, where applicable, images or files to the selected provider. Availability depends on deployment, plan and workspace permissions. Your own provider keys (BYOK), plugins and configured endpoints can involve additional recipients.
An EU endpoint for one service is not a promise that all providers, account data, support or customer connections operate exclusively in the EU. The specific provider settings and contract apply. We make no universal EU-only, no-training or zero-retention guarantee for every model. Any use of contents by us for training requires its own applicable legal basis; the service contract is not blanket training consent.
6. Infrastructure, payment and email providers
Hosting uses netcup. Object storage and backups use Backblaze; the configured SaaS storage endpoint is in European region eu-central-003. Transactional emails use Resend. Payments and subscriptions use Stripe. Each receives data necessary for its task, such as operational data, stored contents, recipient addresses or payment and contract information.
Providers may be processors or independent controllers depending on the activity. Processing on behalf of a controller requires an Article 28 agreement. Third-country transfers must meet Articles 44 et seq. GDPR, for example an applicable adequacy decision or standard contractual clauses with necessary supplementary measures. Ask our privacy contact about recipients and safeguards applicable to your processing.
Payments and contractual communication use Article 6(1)(b) GDPR; statutory accounting and record obligations use point (c). CogLake does not store full payment-card details.
7. Optional Rybbit website analytics
This public website loads self-hosted Rybbit from analytics.centerbit.net only with your express permission. It measures visits, navigation, page titles, referrers, URL parameters, outbound links and browser, language and screen information. The receiving server also processes the connection IP address. The deployed script stores a random visitor identifier under rybbit-visitor-id in browser local storage. Self-hosting and hashed or random identifiers do not automatically mean complete anonymity.
Session replay, form, clipboard and button capture, error tracking and Web Vitals are not currently enabled for this website. We do not use Google Analytics, Meta Pixel or advertising profiles here. The basis for optional analytics is Article 6(1)(a) GDPR and Section 25(1) TDDDG.
“Necessary only” is equally accessible; declining leaves the site usable without loading analytics. Change or withdraw your choice for the future under “Privacy settings” in the footer. Withdrawal does not affect prior lawful processing. See the cookie information for browser storage details.
8. Contact and editorial access
We process information in enquiries to respond and handle the matter, under Article 6(1)(b) GDPR for contractual enquiries or otherwise point (f). The website contact form opens an email draft; only sending it through your email service transmits the message to us.
Protected editorial access processes account data, password hashes, sessions and editing activity for authentication and attribution. Only authorised editors have access.
9. Retention and deletion
We keep data as long as necessary for its purpose or a legal obligation. Contract and accounting records follow applicable commercial and tax retention periods, which depend on the record type. Claims or security incidents may require longer, purpose-limited retention.
After an unrenewed trial expires, workspace working data is normally retained for another 30 days for reactivation, then scheduled for deletion. Account, billing and audit evidence is handled separately. Expiry of the AI Workspace addon does not immediately delete existing chats: read access and retention depend on remaining access and account status. Suspension and deletion are separate actions.
Backups are managed separately from active data. Deleted contents may remain in protected backups until the applicable rotation ends. Restoration must not permanently undo completed deletions. Removing a CogLake copy does not itself delete data in connected original sources.
10. Your rights and complaints
Subject to statutory conditions, you have rights of access, rectification, erasure, restriction and portability under Articles 15–20 GDPR. Consent can be withdrawn for the future. You may object to legitimate-interest processing on grounds relating to your particular situation, and at any time to direct marketing (Article 21 GDPR).
You may complain to a supervisory authority, particularly where you live or work or where an infringement is suspected. The authority generally responsible for our Bavarian company is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. Data necessary for a contract is required for that service; optional analytics can be declined without disadvantage.
AI answers are not binding decisions about legal entitlements. If you use CogLake for decisions with legal or similarly significant effects, Article 22 GDPR requirements must be considered separately. Contact info@centerbit.co for privacy requests.
Last updated: