Privacy policy

Last updated: 30 October 2026

CoStaff is a personal assistant you message on WhatsApp, run by CoStaff Technologies LLC ("CoStaff", "we", "us"). This policy explains what we collect, why, who processes it for us, how long we keep it, and the choices you have. CoStaff is invite-only and for adults.

The short version

• We use your data only to run CoStaff for you. We do not sell it, use it for advertising, or use it to train AI models.
• Nothing goes out in your name without your tap. Emails, calendar events, invite answers and bookings are shown to you first, and happen only when you approve them on WhatsApp.
• CoStaff signs in only to accounts you ask it to connect (such as Deliveroo), with a one-time code the site sends you, and never types a password. It never messages anyone but you. It uses a card you add only for a booking you confirm.
• You can pause CoStaff, disconnect Google, or delete everything from your CoStaff page at any time.

What we collect

Your account. Your name, email address, the WhatsApp number you link, your timezone, and the invite you joined with.

Your conversations. The messages and voice notes you send CoStaff on WhatsApp, and CoStaff's replies. Voice notes are turned into text; we keep the text, not the audio.

What CoStaff remembers. Preferences and facts you ask it to keep (a favourite restaurant, a seat preference, a family member's name), and the goals and reminders you set.

Gmail and Google Calendar, if you connect them. CoStaff reads new email to spot what needs you, such as bills, deadlines and bookings, and keeps a short excerpt of each email with the facts it found. It reads your calendar when you ask about your day or your plans. It sends an email, adds an event or answers an invite only after you tap to approve the exact draft. The Google permissions we ask for are: your email address, read your Gmail, send email you approve, read your calendar, and add or change events you approve.

Email you forward to your CoStaff address.

Browser errands. When you ask CoStaff to book something or fill in a form on a website, it uses a browser in the cloud and types only the details you gave it or asked it to remember. Screenshots of the page are kept only while the errand runs and are deleted when it ends; the one CoStaff sends you to confirm stays in your WhatsApp chat. We keep the outcome, such as the booking reference. The browser keeps your own profile between errands, as your laptop would: cookies and site settings, so sites see a returning visitor. It never keeps card numbers or passwords.

Usage and safety records. Which features ran, the AI cost of each message, delivery status, errors, and an audit log of sensitive actions such as a draft approved or Google connected.

Your card, if you add one. When a booking needs a card to hold it (a guarantee, a deposit or a no-show fee), you can add a card on a secure CoStaff page, never in the chat. It is stored encrypted in a vault only our backend can read. We keep its brand, last 4 digits and expiry to show you, and its security code only until that booking is done. CoStaff types the card only into a booking you confirmed, and the AI never sees the number. You can remove it from your CoStaff page at any time.

CoStaff never types passwords into websites.

How we use it

• To answer you and do what you ask: search, compare, remind, draft and book.
• To keep CoStaff safe and working: checking each reply against its sources before it goes out, spotting misuse, limiting costs and fixing errors.
• To improve CoStaff: an automated review notes where conversations went wrong, in its own words and without quoting you. A founder reads a conversation only if you turned on chat review, with personal details masked, and every view is logged. You can turn chat review off at any time.

We do not use your data for advertising, we do not sell it, and we do not use it to train AI models.

Google user data

CoStaff's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Gmail and Calendar data only to provide the CoStaff features you see and use.
• We do not transfer it to anyone, except the service providers below that run those features, for security, or to comply with the law.
• We do not use it for advertising, and we do not use it to develop, improve or train generalised AI or machine-learning models.
• No person at CoStaff reads it unless you ask us to (for example for support), it is needed for security or to comply with the law, or it is aggregated and anonymised for running the service.

Your Google access is stored encrypted, in a vault only our backend can read. You can disconnect Google from your CoStaff page or from your Google Account at any time.

Who processes data for us

Each receives only what it needs for its task, under its own terms. A business you ask CoStaff to book with receives the details needed for that booking, under its own terms and privacy policy.

Where it is stored

Our providers may store and process data outside the UAE, for example in the European Union or the United States. Where they do, we rely on their contractual data protection commitments.

How long we keep it

• Messages: 365 days, then deleted automatically.
• Email excerpts: 30 days. The sender, subject and facts CoStaff noted: 365 days.
• Memories and reminders: until you ask CoStaff to forget them, or delete your account.
• Browser screenshots: deleted when the errand ends (the confirm screen stays in your WhatsApp chat).
• Your browser profile: deleted by the browser provider 30 days after your last errand. When you delete your account, CoStaff stops using it at once.
• Your card: until you remove it or delete your account. Its security code: until the booking it was given for is done.
• Your account and its audit records: while your account exists.

When you delete your account, all of the above is deleted within minutes. Copies in encrypted backups expire on their normal cycle.

Your choices and rights

• Ask CoStaff what it remembers about you, and tell it to forget anything.
• Pause CoStaff, disconnect Google, remove your card, or turn chat review on or off on your CoStaff page.
• Delete everything: on your CoStaff page, choose Delete everything. It removes your account and all your data, and disconnects Google.
• Ask us for a copy of your data, or to correct it, using the contact details at the end of this policy.

You may also complain to the data protection authority that applies to us.

Security

Data is encrypted in transit. Each person can reach only their own data, Google access is kept in an encrypted vault, sensitive actions go into a tamper-evident log, and founder access is limited as described above. No system is perfectly secure; if a breach affects your data, we will tell you without undue delay.

Children

CoStaff is for adults aged 18 and over. We do not knowingly collect data from children.

Changes

We will tell you on WhatsApp before a material change to this policy takes effect.

Contact

CoStaff Technologies LLC
27 Escondido Avenue, San Francisco, California, USA
Email: contact@getcostaff.com