Privacy notice

Who we are

Corrobly is a live copilot for expert calls and diligence meetings. Corrobly is operated by Corrobly Ltd, a private limited company registered in England and Wales (company number 17506188), registered office Aria House, 23 Craven Street, London WC2N 5NS. Contact: support@corrobly.com. That address is also the contact for data protection questions.

We have two roles. For your account, the public forms, our security logs and the public site, we decide how personal data is used, so we are its controller. For the content a firm’s members put into its workspace (notes, transcripts, documents and everything derived from them), the firm is the controller and we are its processor: we use that content only to provide the service, on the firm’s instructions under our data processing agreement.

What we collect

• Account details: name, email address, workspace and role.
• Content you type: notes, question guides, facts, expert labels and ratings.
• Derived content: coverage states, suggestions, reports and scores. The keep, borderline or kill read on an expert call is advice to the analyst, never a decision about the expert.
• Documents you upload to a deal: the text read from them (the file itself is never stored).
• Emails dropped on a deal, as stripped before they are stored: the sender’s display name, the date, the subject and the body of the first message, with every email address, the recipients, phone-number signatures, images and quoted earlier messages removed.
• Transcripts of calls, kept by default under your workspace's retention window unless an admin turns transcript retention off.
• Pilot requests: the details you submit on the pilot form, and a one-way hash of your IP address.
• DPA requests: the details you submit when you ask for our data processing agreement, and a one-way hash of your IP address.
• Waitlist sign-ups: your email address and, if you give them, your name, firm and role, with your browser’s user agent.
• Bot checks: on sign-in and on the waitlist form, Cloudflare Turnstile sees your IP address and browser signals during the check.
• Security records: a log of sensitive actions in each workspace (sign-ins, invites, role changes, exports, deletions and transcription consent confirmations), and short-lived counters keyed to a one-way hash of your IP address or to your user id, used to limit abuse.
• Usage data: privacy-friendly page analytics on the marketing site only.

We never record audio or video. Notes come first. Optional live transcription streams the meeting audio and your microphone straight to Deepgram as two separate streams; your own voice is labelled You and is never used as evidence, the audio is never recorded or stored, and a consent step comes before each capture. Transcript text is kept by default under your workspace's retention window, as consent is logged at the start of each capture; an admin can turn it off.

Where it is processed

Data is stored in London, UK. Note text and document text are sent to the Anthropic API for analysis, and text is sent to Voyage AI to build the search index for Ask; both are in the United States and neither may train on it. With live transcription on, call audio goes from your browser straight to Deepgram, which processes it in the European Union. Email is sent through Resend, and the bot check on sign-in and the waitlist form runs on Cloudflare Turnstile, both in the United States. The sub-processors are listed on our security page; what each receives is set out in the DPA, available on request.

Lawful basis

Where we are controller: we use account details to provide the service under our contract with you or your firm. We use pilot, DPA and waitlist requests, bot-check signals, security records and page analytics for our legitimate interests: answering your enquiry, keeping the service secure and understanding how the public site is used.

Where we are processor: the firm that runs the workspace decides its lawful basis for the content its members add, including notes about experts and other people on a call.

Retention

Content is kept according to your workspace’s settings. Raw notes follow the retention window an admin sets, transcripts are kept only when transcript retention is on, and everything is deleted with its deal or with the workspace. Pilot, DPA and waitlist details are kept until you ask us to remove them or we no longer need them to reply to you, and never longer than 24 months. Abuse-limit counters are deleted after a day. Your account details are kept while your account exists; you can delete your account in Settings, or ask us and we will delete it.

International transfers

Some of our providers are in the United States (the security page lists each one). Transfers to them are covered by the UK International Data Transfer Agreement (IDTA) or by the EU Standard Contractual Clauses with the UK Addendum, as each provider’s data processing terms set out, and for providers certified under it, the UK Extension to the EU-US Data Privacy Framework.

Your rights

Under UK data protection law you can ask to see, correct or delete your personal data, to restrict or object to how we use it, and to receive a copy of it. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

How to ask depends on who holds the data. For your account, the public forms, our security records and the public site, email us at the address below and we will answer within one month. If your personal data is in a firm’s workspace, for example because you were an expert on a call or are named in a document, the firm is the controller: ask the firm directly. If you ask us instead, we pass your request to the firm and help it answer.

Security incidents

If a personal data breach affects a firm’s workspace, we tell the firm without undue delay so it can meet its own duties. If a breach affects data we control and is likely to put people at risk, we report it to the ICO within 72 hours of becoming aware of it and tell the people affected where the law requires. To report a security issue, email security@corrobly.com.

Cookies and similar technologies

We use only what the service needs to work: a cookie that keeps you signed in, one that remembers your active workspace, and, while the site is in private preview, one that remembers you entered the site password. In the app, your browser keeps unsent notes and a half-typed note on your device until they are sent, and remembers a couple of display choices until you sign out. The marketing pages use Vercel Web Analytics, which Vercel describes as counting page views without cookies and without identifying you. The bot check on sign-in and the waitlist form is Cloudflare Turnstile, a security measure that is strictly necessary to protect those forms. We use no advertising or tracking cookies.

The European Union

We serve customers from the UK. We have not yet appointed a representative in the European Union and will do so before serving customers there.

Contact

Corrobly is operated by Corrobly Ltd, a private limited company registered in England and Wales (company number 17506188), registered office Aria House, 23 Craven Street, London WC2N 5NS. Contact: support@corrobly.com.