Privacy Policy

Version 2025-04-29

1. Who We Are

Shirriff BioAdvisors Inc. operating as "Cordecho" ("Cordecho," "we," "us," or "our") provides an AI-assisted writing studio that helps authors draft and refine novels.

2. What Data We Collect

• Account information — name (optional), email address, and encrypted password.
• Content you create — manuscripts, prompts, notes, file uploads, and feedback.
• Usage data — IP address, browser type, device information, feature interactions, and time stamps.
• Payment data — handled securely by Stripe; we never store full card numbers.
• Cookies & similar technologies — strictly necessary cookies plus optional analytics cookies (see Section 8).

3. How We Use Your Data

1. To operate, secure, and improve Cordecho.
2. To generate AI suggestions by securely transmitting your selected text to third-party large-language-model (LLM) providers via OpenRouter.
3. To respond to support requests and send service-related notices.
4. To process payments through Stripe.
5. To comply with legal obligations and prevent fraud or abuse.

4. Legal Bases for Processing (GDPR)

• Contractual necessity: providing the service you request.
• Legitimate interests: product analytics, fraud prevention, and service security.
• Consent: marketing emails and non-essential cookies.
• Legal obligation: bookkeeping, tax, and compliance.

5. Where We Store & Process Data

All traffic is encrypted in transit (TLS 1.2+). Data at rest is encrypted on servers hosted by Neon (PostgreSQL) and other infrastructure providers located in North America. Requests to LLMs are sent over HTTPS to OpenRouter and its upstream model hosts, which may process data in the United States, Canada, or the European Union. By using Cordecho, you consent to this processing.

6. How Long We Keep Data

• Account & manuscript data — retained until you delete the item or close your account.
• Closed accounts — deleted within 30 days; backups purge within 90 days.
• System logs & analytics — retained for 12 months for troubleshooting and metrics, then anonymised or deleted.

7. Sharing & Disclosure

We never sell your personal data. We share data only with:

• LLM providers via OpenRouter (to fulfil your requests).
• Stripe (payments).
• Clerk (identity & authentication).
• Neon (cloud database).
• Email delivery & analytics vendors acting as processors under contract.
• Government authorities when legally required.

8. Cookies & Tracking

Essential cookies keep you signed in and protect against CSRF. Optional analytics cookies (currently Plausible, privacy-focused and cookieless) run only with your opt-in consent. You can adjust preferences at any time in Settings → Privacy.

9. Your Rights

Depending on where you live (e.g., GDPR, CCPA, UK-GDPR), you may:

• Access, correct, or delete your personal data.
• Object to or restrict processing.
• Receive a portable copy of your data.
• Withdraw consent without affecting prior lawful processing.

To exercise these rights, email contact@cordecho.com. We will respond within 30 days.

10. Children's Privacy

Cordecho is not directed to children under 13, and we do not knowingly collect data from them. If you believe a minor has provided personal data, contact us and we will delete the information.

11. Security Measures

We apply industry-standard safeguards: encryption at rest and in transit, role-based database access, penetration testing, automated dependency scanning, and a coordinated vulnerability disclosure program.

12. International Transfers

If you are located outside the United States or Canada, note that your information may be processed in these jurisdictions. We rely on Standard Contractual Clauses or similar safeguards for cross-border data transfers where required.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced by email or prominent in-app notice at least 14 days before they take effect. Continued use of Cordecho after the effective date constitutes acceptance.

14. Contact Us

Questions about privacy? Email contactcordecho@gmail.com or write to:
Shirriff BioAdvisors Inc. (Cordecho)
604 — 1965 W 4th Ave, Suite 211
Vancouver, BC V6J 1M8
Canada