Privacy policy

CognaOne Privacy Policy

Effective date: 24 October 2026

1. Introduction and Scope

CognaOne & Cogna8.ai ("CognaOne", "we", "us", "our"), names for the same business and platform, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose and safeguard your information when you visit cognaone.com or use the CognaOne platform and related services (the "Service").

This policy applies to all users of the Service, including visitors to our website, people who contact us or apply for a role, registered account holders, API consumers and anyone who interacts with our platform. By using the Service, you consent to the practices described in this Privacy Policy.

How CognaOne accesses, uses, stores and shares Google user data

This section applies to the CognaOne web application at console.cognaone.com (also reachable at console.cogna8.ai), which offers "Continue with Google" (Sign in with Google). It explains exactly what Google user data the CognaOne application receives and what we do with it.

Data accessed

CognaOne requests only Google's basic sign-in scopes: openid, email and profile. With your permission, Google shares the following with CognaOne:

• your name;
• your email address, and whether Google has verified it;
• your profile picture URL;
• your Google account identifier (a number Google assigns to your account);
• the sign-in tokens Google issues for that log-in (an ID token and an access token limited to the scopes above).

Why CognaOne needs each permission:

• openid: to confirm with Google that it is really you signing in, using your Google account identifier;
• email: to match you to the access your organisation granted, which is recorded against your work email address, and to identify you in your organisation's audit trail;
• profile: to show your name and profile picture in the console, so you and your colleagues can see who is signed in and who took each action.

CognaOne does not request, and cannot access, your Gmail, Google Drive, Google Calendar, Google Contacts, Google Workspace content or any other Google service.

Data usage

CognaOne uses Google user data only to provide the sign-in feature you use:

• to authenticate you and keep you signed in;
• to check that your email address has been granted access to CognaOne by your organisation;
• to create and maintain your CognaOne user account;
• to show your name and profile picture in the CognaOne console;
• to record which user performed which action in your organisation's audit trail, and to protect the service against misuse.

CognaOne does not use Google user data for advertising of any kind, including targeted or personalised advertising, and does not sell it. CognaOne does not use Google user data to determine credit-worthiness or for lending. CognaOne does not use Google user data, or any data obtained through Google Workspace APIs, to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models.

Data sharing

CognaOne does not share, transfer or disclose Google user data to third parties, except:

• to the service providers that host and operate CognaOne on our behalf, under contract and only to provide the service: cloud application hosting, database hosting, and email delivery for one-time log-in links;
• when required by law, regulation or valid legal process;
• as part of a merger, acquisition or sale of assets, as described in section 6.3, with notice to you beforehand.

Google user data is never transferred to advertising platforms, data brokers or information resellers. Our staff do not read Google user data unless you ask us to (for example in a support request), it is needed for security purposes such as investigating abuse, or the law requires it.

Data storage and protection

Google user data is stored in CognaOne's account database. It is encrypted in transit (TLS 1.2 or later) and encrypted at rest, and access is limited to authorised personnel through role-based access controls with multi-factor authentication.

The sign-in tokens Google issues are used only to complete your log-in. They are limited to the openid, email and profile scopes, so they cannot be used to read any of your other Google data, and CognaOne does not use them to call Google services on your behalf. Your CognaOne session itself is a signed, encrypted cookie that expires automatically.

Data retention and deletion

CognaOne keeps Google user data for as long as your CognaOne account is active. You can request deletion of your account and all Google user data we hold at any time by emailing contact@cognaone.com; we delete it within 30 days of your request, unless the law requires us to keep it. When your organisation's access ends, the data is deleted on the timeline in section 9. You can also revoke CognaOne's access to your Google account at any time at myaccount.google.com/connections. Revoking access there stops CognaOne from receiving any further Google user data; to remove what we already hold, ask us to delete it as described above.

Limited Use

CognaOne's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2. Information We Collect

2.1 Information you provide directly

• Enquiry data: your name, email address, company, the topic you choose and your message, when you use the contact form on our website.
• Job applications: your CV and any details you send to our careers address.
• Account registration data: name, email address, organisation name and role.
• Authentication credentials: OAuth tokens (through Google or other providers) and API keys.
• Payment information: billing address and payment method details (processed by our payment provider; we do not store full card numbers).
• Communications: emails, support requests, feedback and survey responses you send to us.

2.2 Information collected automatically

• Usage data in the platform: features used, actions performed, timestamps and session duration.
• Device information: browser type, operating system, screen resolution and device identifiers.
• Network data: IP address, approximate location (city or country level) and referring address, recorded in our hosting provider's server logs.
• Performance data: page load times, error logs and API response times.

2.3 Customer Data in the platform

When you use the CognaOne platform, you may submit records such as AI systems, owners, risks, controls, evidence, approvals, governed state, conflict records, gate evaluations, policy configurations and audit trail entries. This is Customer Data as defined in our Terms of Service. We process Customer Data solely to provide the Service to you. We do not access, analyse or use your Customer Data for any other purpose, including training machine learning models or building aggregate datasets.

2.4 Signing in

You can log in to the CognaOne console with a one-time link sent to your work email, or with your Google account. How we handle the information Google shares with us is set out in full in the section How CognaOne accesses, uses, stores and shares Google user data above.

3. Legal Basis for Processing

We process your personal information on the following bases:

• Contract: processing necessary to provide the Service you have requested and to fulfil our contractual obligations.
• Legitimate interests: processing necessary for our legitimate business interests, such as replying to enquiries, improving the Service, preventing fraud and ensuring security, provided these interests are not overridden by your rights.
• Consent: where you have given specific consent, such as ticking the consent box on our contact form or opting in to updates.
• Legal obligation: processing necessary to comply with applicable laws, regulations or legal proceedings.

4. How We Use Your Information

4.1 Providing the Service

• Replying to enquiries and considering job applications.
• Authenticating your identity and managing your account.
• Processing Customer Data, evaluating gates, detecting conflicts and maintaining audit trails.
• Delivering API responses and integration functionality.
• Providing customer support.

4.2 Improving the Service

• Analysing aggregate usage patterns to improve features and performance (using anonymised, aggregated data only, never your Customer Data).
• Conducting internal research and development.
• Monitoring and improving infrastructure reliability and security.

4.3 Communication

• Sending service-related notifications (for example security alerts, maintenance windows and account changes).
• Responding to your support requests and enquiries.
• Sending product updates and feature announcements (with opt-out available).

4.4 Security and compliance

• Detecting, investigating and preventing fraudulent or unauthorised activity.
• Enforcing our Terms of Service and other policies.
• Complying with applicable legal requirements and responding to lawful requests.

What we do not do

• We do not sell your personal information to third parties.
• We do not use your Customer Data to train machine learning models.
• We do not share your Customer Data with other customers.
• We do not create advertising profiles from your usage data.
• We do not use your data for any purpose unrelated to providing and improving the Service.

5. Data Storage, Security and Infrastructure

5.1 Encryption

All data is encrypted in transit (TLS 1.2 or later) and at rest (AES-256). API keys and authentication tokens are hashed and salted before storage.

5.2 Access controls

Access to Customer Data is restricted to authorised personnel who require access to perform their duties. We use role-based access controls, multi-factor authentication and audit logging for all internal access.

5.3 Infrastructure

The Service is hosted on enterprise-grade cloud infrastructure with redundancy across multiple availability zones. We use automated monitoring, alerting and incident response procedures.

5.4 Audit trail integrity

CognaOne's audit trail is designed to be immutable. Once an event is recorded, it cannot be modified or deleted. This protects the integrity and reliability of your compliance and governance records.

5.5 Incident response

In the event of a data breach, CognaOne will notify affected users within 72 hours of becoming aware of the breach, in accordance with applicable data protection laws, including the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). We will provide details of the nature of the breach, the data affected and the steps being taken to reduce its impact.

6. Data Sharing and Third Parties

We may share your information in the following limited circumstances:

6.1 Service providers

We engage trusted third-party service providers to help deliver the Service, for example website and cloud hosting, email delivery for our contact form, and payment processing. These providers are contractually obliged to protect your data and may only process it on our behalf.

6.2 Legal requirements

We may disclose your information if required by law, regulation, legal process or governmental request, or if we believe disclosure is necessary to protect our rights, your safety or the safety of others.

6.3 Business transfers

If CognaOne is involved in a merger, acquisition or sale of assets, your information may be transferred as part of that transaction. We will give notice before your personal information is transferred and becomes subject to a different privacy policy.

6.4 With your consent

We may share your information with third parties when you have given explicit consent for us to do so.

7. Cookies and Tracking Technologies

7.1 Our website

cognaone.com does not set advertising or analytics cookies. The site follows your device's light or dark setting without storing anything, and pages you visit are recorded only in our hosting provider's standard server logs.

7.2 The platform

The CognaOne platform uses essential cookies to maintain your session and authentication state, and preference cookies to remember settings such as theme and display options. Essential cookies are strictly necessary and cannot be disabled. If we use analytics in the platform, the data is aggregated and anonymised.

7.3 What we do not use

• We do not use third-party advertising cookies.
• We do not use tracking pixels for advertising purposes.
• We do not use cross-site tracking technologies.
• We do not sell cookie data to data brokers or advertisers.
• We do not use fingerprinting technologies to identify users.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

1. Access: you may request a copy of the personal information we hold about you.
2. Correction: you may request correction of inaccurate or incomplete personal information.
3. Erasure: you may request deletion of your personal information, subject to legal retention requirements.
4. Restriction: you may request that we restrict processing of your personal information in certain circumstances.
5. Portability: you may request your personal information in a structured, commonly used, machine-readable format.
6. Objection: you may object to processing of your personal information based on legitimate interests.
7. Withdrawing consent: where processing is based on consent, you may withdraw consent at any time.
8. Complaint: you have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, please contact us at contact@cognaone.com. We will respond within 30 days (or as required by applicable law).

9. Data Retention

We retain your information for the following periods:

• Enquiries and job applications: kept while we deal with them, then for up to 2 years in case we need to follow up, unless you ask us to delete them sooner.
• Account data: kept for the duration of your account, plus 30 days after account closure for export purposes.
• Backup copies: purged within 90 days of account closure.
• Usage logs: kept for up to 12 months for security and performance analysis, then anonymised or deleted.
• Billing records: kept for 7 years to comply with tax and accounting obligations.
• Support correspondence: kept for 3 years after resolution, then deleted.

You may request early deletion of your data by contacting contact@cognaone.com, subject to any legal retention requirements.

10. International Data Transfers

CognaOne is based in Australia. Your information may be processed in Australia, the United States and other countries where our service providers operate. When we transfer data outside your jurisdiction, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission for transfers from the EU and EEA.
• Adequacy decisions where applicable.
• Binding corporate rules or equivalent mechanisms.
• Your explicit consent where required.

11. Children's Privacy

The Service is not directed at children under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete it promptly. If you believe a child under 18 has provided us with personal information, please contact us at contact@cognaone.com.

12. Jurisdiction-Specific Provisions

12.1 Australian Privacy Act

If you are an Australian resident, your personal information is handled in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

12.2 GDPR (European Economic Area)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including the rights described in section 8 above. Our bases for processing are described in section 3. For GDPR-related enquiries, contact us at contact@cognaone.com. You may also lodge a complaint with your local Data Protection Authority (DPA).

12.3 CCPA and CPRA (California)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information is collected, the right to delete, the right to opt out of the sale of personal information and the right to non-discrimination. We do not sell personal information as defined by the CCPA and CPRA.

12.4 Other jurisdictions

We are committed to complying with applicable data protection laws in all jurisdictions where we operate. If you have questions about how the laws of your jurisdiction apply, please contact us at contact@cognaone.com.

13. Third-Party Links and Integrations

Our website and the Service may contain links to third-party websites, services or integrations (for example LangChain, OpenAI or GitHub). We are not responsible for the privacy practices or content of these third parties, and we encourage you to review their privacy policies before providing personal information. Our integrations with third-party services are limited to the functionality described in our documentation and do not give those services access to your Customer Data unless you explicitly configure such access.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email to the address associated with your account, or by a prominent notice on the Service, at least 30 days before the changes take effect. We encourage you to review this Privacy Policy periodically. The effective date at the top of this policy shows when it was last revised.

15. Contact and Data Protection Enquiries

If you have any questions, concerns or requests regarding this Privacy Policy or our data practices, please contact us at contact@cognaone.com.

You may also contact the relevant supervisory authority in your jurisdiction:

• Australia: Office of the Australian Information Commissioner (OAIC), oaic.gov.au
• EU and EEA: your local Data Protection Authority (DPA)
• UK: Information Commissioner's Office (ICO), ico.org.uk