This Privacy Policy explains how Spear America LLC, doing business as Cogs (“Cogs,” “we,” “us,” or “our”), collects, uses, discloses, and retains personal information in connection with GetCogs.ai and the Cogs Service.
Cogs is a business-to-business accounting software service. This policy describes information Cogs processes for its own business purposes and information Cogs processes in providing the Service. When personal information is contained in a business customer's accounting or commerce records and Cogs processes it on that customer's instructions, the customer generally determines the purposes of that processing and Cogs acts as a processor, service provider, or contractor where those roles apply.
1. Categories of Information We Collect
Account and business-contact information
We collect identifiers and business contact information such as name, business name, business address, email address, telephone number, role/title, account identifiers, organization membership, subscription information, and authentication/account-security information.
Accounting and commerce data
At a customer's direction, Cogs processes accounting records, transaction details, ledger entries, chart-of-account information, categorizations, rules, reconciliations, invoices, orders, taxes, discounts, shipping information, merchant data, and related business records. These records can contain personal information about a customer's employees, customers, vendors, contractors, or other counterparties.
Financial-account data through Plaid
When a customer connects an eligible financial account, Plaid or another disclosed connectivity provider handles the bank-authentication flow. Cogs does not receive or store the customer's online-banking username or password. Cogs may receive account identifiers, account type and metadata, balances, transaction history, merchant/descriptive information, and other financial information the customer authorizes to be provided through Plaid.
Depending on the institution and connection method, financial-account credentials may be entered directly with the financial institution or within Plaid's flow. Plaid does not provide those credentials to Cogs.
Shopify and other integration data
When a customer connects Shopify or another service, Cogs receives information authorized through that integration. Depending on the integration and requested scopes, this may include orders, products, customers, payments, refunds, taxes, discounts, shipping, fees, and related business records.
Subscription billing information
Paid plans are billed through Shopify's app billing on the connected Shopify store. Cogs receives the plan, its status, and subscription identifiers from Shopify. Cogs never holds a payment card.
AI interactions and accounting corrections
We process instructions, prompts/context needed for AI Features, outputs, and interaction signals generated through accounting workflows, including when a user confirms, rejects, corrects, or changes a transaction categorization or creates or changes an accounting rule.
Usage, device, security, and diagnostic information
We may collect IP address, browser/device information, timestamps, pages and features used, logs, error information, authentication events, security events, and diagnostic information.
Communications and marketing preferences
We process information sent to sales, support, legal, or other Cogs channels, along with communication and marketing preferences.
2. Sources of Information
We collect information directly from users; from the business customer that administers the account; from Connected Services a customer chooses to authorize, including Plaid, financial institutions, and Shopify; from Shopify, for subscription billing; automatically from browsers, devices, and application infrastructure; and from service providers that support Cogs.
3. How We Use Information
We use information to:
- provide, operate, maintain, and support Cogs;
- authenticate users and administer organizations and permissions;
- import, organize, categorize, reconcile, and maintain accounting records;
- provide reports, AI Features, rules, and workflow automation;
- provide customer-selected integrations;
- bill and administer subscriptions;
- communicate about the Service;
- provide customer support;
- detect, investigate, and prevent fraud, abuse, and security incidents;
- debug, monitor, and improve reliability and performance;
- comply with law and enforce our agreements; and
- send marketing communications consistent with the preferences described below.
Improving Cogs' accounting automation
Cogs uses feedback and user actions from accounting workflows—such as category confirmations, corrections, overrides, and rule changes—to improve categorization and automation.
For cross-customer or generalized model improvement, Cogs' policy is to use information that has been aggregated, deidentified, or otherwise transformed so it is not reasonably linked to a particular customer or identifiable individual, unless a customer separately authorizes another use or applicable law permits it. Cogs does not use customers' raw accounting ledgers as a general-purpose training corpus merely because those ledgers are stored in Cogs.
Cogs may use Customer Personal Data within a customer's own instructions and environment to improve or personalize that customer's categorization and rules.
4. AI Service Providers
Cogs currently uses Anthropic commercial/API services for certain AI functionality. Anthropic's current commercial data practices state that inputs and outputs from commercial products are not used to train Anthropic's general models by default. Cogs does not knowingly opt Customer Data into a third-party provider's general-model training.
Anthropic's standard API retention may include temporary retention of inputs and outputs, subject to Anthropic's commercial terms, safety-policy enforcement, legal obligations, and any separate retention arrangement Cogs may have with Anthropic. Cogs does not represent that third-party AI processing is always zero-retention unless Cogs has a specific zero-data-retention arrangement in effect.
Current providers are identified on the Cogs Subprocessors page.
5. Categories of Recipients and Disclosures
We disclose information as reasonably necessary to the following categories of recipients:
- infrastructure and hosting providers, for application hosting, database, storage, networking, authentication, and security;
- AI providers, for requested AI Features;
- financial-connectivity providers, when a customer connects financial accounts;
- commerce integration providers, when a customer connects an external commerce platform;
- payment processors, for Cogs subscription billing;
- communications providers, for transactional email, support, and business communications;
- security, diagnostics, and professional advisers, where used and appropriate;
- authorized users and administrators of the customer's organization, according to account permissions;
- government authorities or other parties when reasonably necessary to comply with law, legal process, enforce agreements, or protect rights and security; and
- transaction counterparties in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale or transfer of all or part of the Cogs business, subject to applicable law and appropriate confidentiality protections.
A current list of relevant service providers/subprocessors is maintained on the Cogs Subprocessors page.
6. No Sale or Behavioral-Advertising Sharing
Cogs does not sell personal information or Customer Data. Cogs does not share Customer Personal Data for cross-context behavioral advertising or targeted advertising. Cogs does not provide customer accounting data to data brokers or advertisers.
7. Cookies and Similar Technologies
Cogs uses cookies, local storage, and similar technologies for authentication, security, session management, preferences, and other Service functions. If Cogs deploys non-essential analytics or similar technologies, their use must be reflected in the Cogs Cookie Policy and any consent controls required by applicable law.
Cogs does not use customer accounting data for third-party behavioral advertising.
Do Not Track and browser privacy signals
Because Cogs does not sell personal information or share it for cross-context behavioral advertising or targeted advertising, browser opt-out signals generally do not change those practices. Cogs will recognize a legally required universal opt-out preference signal to the extent applicable to Cogs' processing. Cogs does not currently respond to legacy Do Not Track (DNT) browser signals as a separate preference where no law requires a response.
Cogs does not authorize third parties to track authenticated accounting activity across unrelated third-party websites for behavioral advertising.
8. Marketing Communications
Cogs' stated operational policy is to send marketing email only to recipients who opt in. Marketing messages provide a functioning unsubscribe method. A marketing opt-out does not prevent transactional, account, security, billing, legal, or service communications.
9. Retention
Cogs is designed to maintain business accounting records. Cogs' standard Service policy is a seven-year accounting-record retention period, measured from the applicable accounting or tax period or another reasonable record date, subject to applicable law, Customer instructions/configuration, legal holds, and contractual requirements.
This seven-year period is a Cogs policy; U.S. law does not impose a universal seven-year retention period on every business accounting record.
Cogs retains account, security, billing, communications, and operational information for periods reasonably necessary for the purposes described in this policy, including legal, security, fraud-prevention, and dispute needs.
After account closure, Cogs may delete, deidentify, or scrub personal information that is not reasonably necessary to preserve accounting-record integrity, provenance, auditability, security, or a lawful retention purpose. A customer may request eligible deletion/scrubbing and may request that eligible deletion be scheduled after an applicable retention period expires.
Where Cogs acts as a processor/service provider and applicable law requires deletion or return on the business customer's instruction, Cogs will follow the applicable Data Processing Addendum and lawful instruction. Information in backups may persist until overwritten in the ordinary backup lifecycle.
10. Security
Cogs uses administrative, technical, and organizational safeguards designed to protect information appropriate to the nature and risk of the Service. No system can be guaranteed completely secure. Customers are responsible for protecting credentials, configuring account access appropriately, and promptly removing users who no longer require access.
11. Business Customer Data and Individual Requests
If your personal information appears in records controlled by a Cogs business customer—for example, because you are that customer's employee, customer, vendor, contractor, or other counterparty—the Cogs customer may be the party responsible for responding to your request. If you contact Cogs about Customer Personal Data, we may direct or forward the request to the relevant customer where appropriate and lawful.
12. U.S. State Privacy Rights
Depending on where you live, the nature of the information, applicable statutory thresholds and exemptions, and whether Cogs acts as a controller/business or processor/service provider, you may have rights concerning certain personal information. These may include rights to request access, correction, deletion, portability, or information about processing, and rights to opt out of certain sales, targeted advertising, sharing, or qualifying profiling.
Cogs does not sell personal information or share it for cross-context behavioral advertising or targeted advertising. To submit a privacy request, email legal@getcogs.ai. We may need to verify your identity, business relationship, and authority. Authorized agents may submit requests where applicable law permits. Cogs will not unlawfully discriminate against a person for exercising applicable privacy rights.
Some comprehensive state privacy statutes exclude or treat differently information processed in a business-to-business or employment context; others, including California law when applicable, may protect certain personal information in those contexts. This section does not represent that every statutory right applies to Cogs, every business contact, or every requester.
13. California Privacy Disclosures
California's Online Privacy Protection Act (CalOPPA) requires qualifying commercial websites and online services that collect personally identifiable information from California users to conspicuously post a privacy policy. This policy describes:
- the categories of personally identifiable information Cogs collects;
- the categories of third parties/service providers with whom information may be disclosed;
- how users may request review or correction of account information;
- how Cogs handles browser privacy signals and third-party tracking; and
- the effective date of this policy.
Users may review or update ordinary account/profile information through available account settings or by contacting legal@getcogs.ai.
If the California Consumer Privacy Act (CCPA) applies to Cogs for a particular processing activity, California residents may have the rights provided by that law, subject to exceptions and verification. Cogs does not sell personal information or share it for cross-context behavioral advertising. Where required, Cogs will provide the applicable notices and request mechanisms.
California's “Shine the Light” law may permit certain residents to request information about qualifying disclosures of personal information to third parties for the third parties' own direct-marketing purposes. Cogs does not disclose personal information to third parties for their own direct marketing in that manner.
14. Children
Cogs is a business service and is not directed to children. Individuals opening, purchasing, or administering Cogs accounts must be the older of 18 or the age of majority where they reside and use Cogs.
15. International Processing
Cogs is operated by a U.S. company and may use service providers in the United States and other countries. Where legally required, Cogs will use appropriate contractual or legal mechanisms for restricted cross-border transfers. Business customers with applicable data-protection requirements may enter into the Cogs Data Processing Addendum.
16. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in the Service, law, or our practices. We will post the updated version with a new effective date and provide additional notice when required by applicable law.
17. Contact
Privacy and legal requests: legal@getcogs.ai
Spear America LLC
1021 E Lincolnway, Ste 6344
Cheyenne, Wyoming 82001
United States
Operator: Spear America LLC, 1021 E Lincolnway, Ste 6344, Cheyenne, Wyoming 82001, United States
Service: Cogs (GetCogs.ai)
Legal contact: legal@getcogs.ai