Privacy Policy

This information is provided for transparency and is not legal advice. Have qualified counsel review documents for your jurisdiction.

This Privacy Policy describes how coconutStudio, an Algerian technology startup, processes personal data when you use our services. We align our practices with Algerian Law No. 18-07 on the protection of natural persons in the processing of personal data, and we use the EU General Data Protection Regulation (GDPR) as a reference framework for additional transparency and individual rights.

1. Data controller

The data controller responsible for processing personal data in connection with coconutStudio is coconutStudio (Algeria). Contact details for privacy requests appear at the end of this policy.

2. Categories of data we process

• Account and authentication data, such as phone number, country, PIN or credentials, and security-related logs needed to operate sign-in and account recovery.
• Chat and content data that you submit to the service (messages, uploads, voice inputs, and related metadata) to provide AI-assisted chat, translation, and document features.
• Technical and usage data, such as IP address, device and browser type, approximate location derived from network information, timestamps, and diagnostic logs, for reliability and security.
• OAuth and integration data when you connect third-party accounts. App connections are managed through Composio, which acts as our MCP (Model Context Protocol) integration layer. Some apps are pre-configured by Composio and managed on their platform, while others are configured directly by us. Composio may process OAuth tokens and connection metadata on our behalf according to their service terms and our configuration.

3. Purposes and legal bases

We process data for the following purposes:

• To provide, operate, and improve the service (performance of a contract and legitimate interests).
• To secure accounts, prevent abuse, and enforce our Terms of Use (legitimate interests and legal obligations).
• To comply with applicable law, including Algerian Law 18-07, and respond to lawful requests (legal obligation).
• Where required, with your consent (for example optional communications or non-essential cookies).

4. Data storage — split infrastructure

coconutStudio operates a split database architecture to comply with Algerian data sovereignty requirements:

• Personal data in Algeria: Your personal data — including account information, authentication credentials, phone numbers, and other personally identifiable information — is stored in a database hosted in Algeria, in compliance with Algerian Law No. 18-07 on the protection of personal data.
• Operational data in Europe: Other data tables (chat content, session metadata, usage logs, AI model interactions) are stored on servers hosted by Hetzner Online GmbH (Germany) and other European infrastructure providers. These servers process and store data in the European Economic Area.

Our application servers are hosted with Hetzner Online GmbH (Germany). Hetzner hosts the application — not the personal data database, which remains in Algeria.

5. Subprocessors and integrations

We rely on carefully selected providers to run the product. Depending on features you use, this may include AI model providers (OpenAI, Anthropic, Google, DeepSeek, and others via OpenRouter and Fireworks.ai), search or tooling vendors (Tavily, Firecrawl), storage and database services, and Composio for MCP-based app integrations. Some apps available in the platform are pre-configured and managed by Composio; others are configured and managed directly by us. Each provider processes data only as needed to deliver the relevant feature and in line with their documentation and our agreements.

6. International transfers

Personal data stored in Algeria remains subject to Algerian Law 18-07. Operational data stored in Europe is processed under GDPR-aligned safeguards. Where data is transferred between Algeria and Europe, we implement safeguards appropriate to the situation, in compliance with both Algerian and EU legal frameworks.

7. Retention

We keep personal data only as long as necessary for the purposes above, including legal, accounting, and security requirements. Chat content and uploads may be retained for the lifetime of your account or session history unless you delete them or we delete them according to our retention schedule.

8. Your rights

Under Algerian Law 18-07 and the GDPR, you may have rights to access, rectify, erase, restrict, or object to certain processing, and to data portability. You may also lodge a complaint with the relevant supervisory authority — in Algeria, the National Authority for the Protection of Personal Data (ANPDP), or your local EU supervisory authority. To exercise your rights, contact us using the details below.

9. Security measures

We implement technical and organizational measures to protect your data, including encryption in transit and at rest, access controls, and regular security reviews. Personal data in Algeria is stored with additional safeguards to ensure compliance with Law 18-07.

10. Contact

For privacy questions, data requests, or to exercise your rights under Law 18-07 or the GDPR, contact us at contact@coconutstudio.io.

Last updated: 2026-06-25