Privacy Policy

Last Updated: January 21, 2026

Cobbery, Inc. ("Cobbery," "we," "us," or "our") operates the Cobbery discovery platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

1. Information We Collect

When you create an account, we collect your name, email address, and organization details. We also collect information you provide about legal matters, including case names, key players, and custom tags.

When you connect third-party data sources to Cobbery for discovery purposes, we collect and process data from those sources as directed by you. From Google Workspace, we collect email messages and attachments from Gmail via Google Vault, files and documents from Google Drive via Google Vault, user directory information including names, email addresses, and organizational units, and Google Cloud Storage data related to Vault exports. From Microsoft 365, we collect data from Exchange, Teams, OneDrive, SharePoint, and Calendar. From Slack, we collect messages, files, channels, and user information. From Discord, we collect messages, attachments, and server data. From Notion, we collect pages, databases, and comments. From mobile devices, we collect SMS, MMS, WhatsApp messages, Signal messages, and attachments.

We automatically collect usage data about how you interact with the Service, including features used, searches performed, and documents reviewed. We also collect log data including IP addresses, browser type, and access times.

2. How We Use Your Information

We use the information we collect to provide the Service, which includes processing and analyzing data for discovery purposes such as document review, search, tagging, and export. We use artificial intelligence to assist with document scoring, relevance assessment, key player identification, and conversation analysis. We use your information to maintain and improve the Service by monitoring performance, fixing bugs, and developing new features. We use your contact information to send service-related notices and respond to inquiries. We may also use your information to comply with applicable laws and legal processes.

3. Google User Data

Cobbery uses Google APIs to access your Google Workspace data for discovery purposes. We request access to the Google Vault eDiscovery API to create and manage matters, holds, and exports. We request Admin Directory read-only access to retrieve user information for custodian identification and organizational structure for scoping collections. We request Cloud Storage read-only access to download Vault export files. We request basic user info scopes to identify the authorizing user.

Cobbery's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We only use Google user data to provide and improve the discovery features that are visible and prominent in the Cobbery interface.

We do not transfer Google user data to third parties except as necessary to comply with litigation, applicable laws, or as part of a merger, acquisition, or sale of assets with explicit prior user consent.

We do not use Google user data for advertising, including retargeting, personalized ads, or interest-based advertising.

We do not sell Google user data to third parties, data brokers, or information resellers.

Human access to Google user data is limited to situations where you have given affirmative agreement, security investigations, legal compliance requirements, and aggregated internal operations in accordance with applicable law.

4. Data Storage and Security

Data is stored on secure cloud infrastructure with encryption at rest and in transit. Google Workspace data accessed via Vault exports is processed and stored within our secure environment for the duration of your matter.

We implement appropriate technical and organizational measures to protect your data. These measures include encryption of data in transit using TLS and at rest using AES-256, access controls and authentication requirements, regular security assessments and monitoring, and employee training on data protection.

5. Data Retention

We retain data associated with your matters for as long as you maintain an active account or as needed to provide services. You may request deletion of your data at any time by contacting us. Data subject to legal holds or litigation may be retained as required by law.

We do not sell your personal information. We may share your information with service providers who assist in operating our Service, subject to confidentiality obligations. We may disclose your information when required by law, subpoena, or legal process. We may share your information in connection with a merger, acquisition, or sale of assets. We may also share your information when you direct us to share information with third parties.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the right to request access to the personal information we hold about you, request correction of inaccurate personal information, request deletion of your personal information subject to legal retention requirements, request a copy of your data in a portable format, and withdraw previously granted consent. To exercise these rights, contact us at [email protected].

You may revoke Cobbery's access to your Google account at any time through your Google Account permissions at myaccount.google.com/permissions. Revoking access will prevent further data collection but will not automatically delete previously collected data.

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act and California Privacy Rights Act. You have the right to know what personal information we collect, use, and disclose. You have the right to request deletion of your personal information, subject to certain exceptions. You have the right to correct inaccurate personal information. You have the right to opt out of the sale or sharing of your personal information. Cobbery does not sell personal information and does not share personal information for cross-context behavioral advertising. You have the right to limit the use of sensitive personal information. You have the right not to receive discriminatory treatment for exercising your privacy rights.

To exercise these rights, contact us at [email protected]. We will verify your identity before processing your request. You may designate an authorized agent to make a request on your behalf.

In the preceding twelve months, we have collected the following categories of personal information: identifiers such as name and email address, commercial information related to your subscription, internet or network activity including usage logs, and professional or employment-related information. We collect this information for the business purposes described in Section 2 of this Privacy Policy.

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation. We process your personal data based on the following legal bases: performance of a contract when providing the Service, legitimate interests in operating and improving our business, compliance with legal obligations, and consent where you have provided it.

You have the right to access your personal data, rectify inaccurate data, erase your data subject to legal retention requirements, restrict processing in certain circumstances, data portability, object to processing based on legitimate interests, and withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority.

For international transfers of personal data outside the EEA, we rely on Standard Contractual Clauses approved by the European Commission or other lawful transfer mechanisms.

10. Do Not Track

Some browsers include a Do Not Track feature that signals to websites that you do not want your online activity tracked. The Service does not currently respond to Do Not Track signals. However, we do not track your activity across third-party websites.

11. International Data Transfers

If you are located outside the United States, your information may be transferred to and processed in the United States or other countries where our service providers operate. We implement appropriate safeguards for such transfers.

12. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last Updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact Cobbery, Inc. by email at [email protected] or visit our website at https://cobbery.com.