Privacy Policy

Last updated: 31 August 2026

Cobbo ("Cobbo", "we", "us") is a product operated by Cobbo Technologies Pty Ltd (ACN 698 882 870, ABN 89 698 882 870). We are committed to protecting your privacy. This policy explains how we collect, use, store, and disclose your personal information when you use the Cobbo web application (the "Service"). It is designed to comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and the New Zealand Privacy Act 2020 and Information Privacy Principles (IPPs).

1. Information we collect

• Account information: name, email, business name, ABN, address, phone number, logo, bank details (BSB and account number for invoicing).
• Customer data you enter: client names, contact details, addresses, quotes, invoices, line items, photos, voice recordings, and email content.
• Usage data: pages visited, features used, device and browser type, IP address, and approximate location.
• Authentication data: handled by our identity provider (Clerk). If you choose to sign up or sign in with Google or Facebook, we receive your name, email address and profile picture from that provider. We never receive your password, and we ask for no permission to post as you, read your posts, or see your contacts or friends.
• Connected mailbox access: if you connect Gmail or Outlook, we store the access and refresh tokens that let Cobbo send mail as you, and the email address of the connected account.
• Payment data: processed by Stripe; we do not store full card numbers.

2. How we use your information

• To provide and operate the Service (creating quotes/invoices, sending emails, tracking opens).
• To process AI features (voice transcription, quote/email drafting) via OpenAI.
• To send transactional emails on your behalf via your connected provider.
• To detect and prevent abuse, fraud, and security incidents.
• To comply with our legal obligations.

3. AI processing

Voice recordings and text you enter may be sent to OpenAI for transcription and parsing. OpenAI does not use API submissions to train models. Recordings are processed in transit and not retained by us beyond the duration required to return a result.

4. Storage and data residency

Customer data and files are stored in Supabase in Sydney, Australia (ap-southeast-2). Application servers run in the United States, and some sub-processors (Clerk, Stripe, OpenAI, Resend, Upstash, Vercel, Sentry, PostHog) also process data outside Australia and New Zealand. If you connect a Gmail or Outlook account, the messages Cobbo sends on your behalf are transmitted through Google or Microsoft under your own account, in regions those providers determine. If you sign up or sign in with Google or Facebook, that provider (Google LLC or Meta Platforms, Inc.) also processes your sign-in outside Australia and New Zealand.

5. Connected email accounts (Gmail and Outlook)

If you connect a Gmail or Outlook account, Cobbo requests permission to send mail and nothing else — Google's gmail.send scope, Microsoft's Mail.Send — together with your email address, so we can show you which account is connected and set the correct From address on what we send.

Cobbo does not read, list, download, index, or store the contents of your mailbox. The only messages it sends are the quote and invoice emails you have reviewed and explicitly confirmed. Access and refresh tokens are encrypted at rest and used solely to send on your behalf. Disconnecting the account in Settings deletes them.

Cobbo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Disclosure

We disclose personal information only to sub-processors necessary to operate the Service, to comply with law, or with your consent. We do not sell personal information.

7. Security

We use TLS in transit, encryption at rest for sensitive credentials (AES-256-GCM), strict multi-tenant isolation, signed URLs for documents, and rate limiting. No system is perfectly secure; you must keep your account credentials confidential.

8. Your rights

You can delete your account and its data yourself from within Cobbo: Settings → Account → Delete account. Where your account is still linked to billing — a paid subscription, or payment records we are required to retain — that button will tell you so rather than proceed. In those cases, and for any request to access or correct your personal information, contact us at privacy@cobbo.com.au and we will handle it for you. Data is deleted within 30 days, subject to legal retention requirements (e.g. tax records).

9. Cookies

We use essential cookies for authentication and session management. We do not use third-party advertising cookies.

10. Children

The Service is not intended for individuals under 18.

11. Changes

We may update this policy from time to time. Material changes will be notified by email or in-app notice.

12. Contact

Privacy questions or complaints: privacy@cobbo.com.au. Australian users may also contact the Office of the Australian Information Commissioner (OAIC). New Zealand users may contact the Office of the Privacy Commissioner.