This policy explains how Collevo (“we”, “us”) handles personal information collected through the collevo.io website: what we collect, why, who helps us, how long we keep it, and what you can do about it.
It covers the website as it exists today, including the early access form and the newsletter. The Collevo product is not public yet. A short summary of how it will handle data is in The Collevo product, and this policy will get a full, product-specific update before launch.
Who we are
The controller of your personal information is:
Collevo
Email: hello@collevo.io
You can contact us at that address about anything in this policy, including to use any of the rights described below.
What we collect and why
We only collect what we need for the purposes below. Where data protection law asks for a “lawful basis”, we name it next to each purpose.
Early access signups
When you join the early access list, you give us:
- Contact details: your email address (required) and, if you choose, your name and company.
- About your business: the kind of business you run (for example contractor, agency, insurance agent, property manager or accountant, or a description you type), what you want to collect from clients (photos, documents, IDs, forms, approvals or other, plus an optional note), your team size, and roughly how many items you collect a month.
- Design partner interest: whether you would like to be a design partner, and any note you add.
Alongside the form, your browser sends:
- Where your visit came from: campaign tags in the link you used (
utm_source,utm_medium,utm_campaign,utm_term,utm_content), the website that referred you, the page you first landed on, and the page where you opened the form. If you accepted analytics cookies on an earlier visit, it also sends the first tagged visit we saw from your browser. - The email you started with: if you type your email into a “Get early access” box elsewhere on the site, it is kept in your browser’s session storage so the early access form can be filled in for you. It is cleared when you close the tab.
- Spam protection signals: a Cloudflare Turnstile token, the time you started the form, and an invisible field that only bots fill in.
Why: to manage the early access list, decide who to invite and when, contact you about your access and about Collevo’s launch, choose design partners, and understand which channels bring people to us.
Lawful basis: our legitimate interests in running early access and understanding our marketing, and taking steps you asked for before any contract with us. You can ask us to remove you from the list at any time, and every email we send about early access includes a link to unsubscribe.
Newsletter
If you sign up for the newsletter, we collect your email address and add it to our mailing list.
Why: to send you product news and updates.
Lawful basis: your consent. Every newsletter email has an unsubscribe link, and you can also email us to stop.
Where visitors come from (first-party attribution)
When you arrive on collevo.io, the site keeps the campaign tags in the link, the referring website, and the page you landed on in your browser’s session storage. This stays in your browser, is cleared when you close the tab, and is only sent to us if you submit the early access form.
If you accept analytics cookies, the site also remembers the first tagged visit from your browser in local storage, so a later signup can be credited to the campaign that first brought you here. If you reject analytics cookies, this is not stored, and anything already stored is removed.
Why: to understand which campaigns and websites lead to signups.
Lawful basis: our legitimate interests for the session record, and your consent for the first visit record.
Google Analytics (only with your consent)
If you click Accept on the cookie banner, we load Google Analytics 4 to measure how the website is used: pages viewed, how you got here (including campaign tags in the link), the type of device and browser, approximate location derived from your IP address, and events such as opening or completing the early access form.
We use Google Consent Mode. Until you accept, everything is set to denied and the Google Analytics script does not load at all. Advertising features (ad_storage, ad_user_data and ad_personalization) stay denied even if you accept, because we do not run ads. Google Analytics 4 does not log or store full IP addresses.
Why: to see which pages are useful, which are not, and how people find us.
Lawful basis: your consent. You can withdraw it at any time with the Cookie settings button in the footer of every page.
Error monitoring (Sentry)
If something on the website breaks in your browser, we send an error report to Sentry so we can find and fix it. A report includes technical details such as the error message, the page address without its query string, and your browser and operating system. We configure Sentry not to collect your IP address, user details, cookies, request headers or URL query strings, not to set cookies, and not to record your session. A small sample of page loads may include timing information.
Why: to keep the website working.
Lawful basis: our legitimate interests in running a reliable website.
Hosting, security and cookieless analytics (Cloudflare)
The website and its forms run on Cloudflare. When you visit, Cloudflare processes your IP address and request details to deliver pages and protect the site from attacks.
- Cloudflare Web Analytics counts visits in aggregate. It does not use cookies or identify individual visitors.
- Cloudflare Turnstile checks that the early access form is filled in by a person, not a bot. It looks at signals from your browser and may set a security cookie (see the Cookie policy).
- Rate limiting: to stop repeated submissions, our forms keep a one-way hash of your IP address for a short window. We never store the IP address itself.
- Signup database: early access signups are stored in a Cloudflare D1 database, our main record of the list.
Why: to deliver the website, keep it secure, prevent spam and abuse, and count overall traffic.
Lawful basis: our legitimate interests in running a secure website. Turnstile’s checks are strictly necessary for the form to work.
Our waitlist and email platform (Loops)
Each early access signup, including your answers about your business and how you found us, is added as a contact in Loops, the platform we use to manage the early access list and email the people on it. Every email we send through Loops includes a link to unsubscribe.
Why and lawful basis: the same as for early access signups.
Email (Resend)
We use Resend to manage the newsletter list and send newsletter emails. When someone joins early access, Resend also sends our team a short internal alert containing details from the signup.
Why and lawful basis: the same as for the newsletter and early access signups.
When you email us
If you email us, we receive your email address, your message and anything you attach, and we use them to reply.
Lawful basis: our legitimate interests in answering you.
What we do not do
- We do not sell personal information.
- We do not share personal information for cross-context behavioral advertising, and we do not run ads.
- We do not collect sensitive personal information through the website, and we ask you not to include it in free-text fields.
- We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Who we share it with
We share personal information only with service providers that process it for us, under contracts that limit what they can do with it, and when the law requires it (for example, to respond to a valid legal request or to protect our rights and users’ safety). If Collevo is involved in a merger, acquisition or sale of assets, personal information may transfer as part of that deal, and we will tell you if that happens.
Processors and sub-processors
| Provider | What they do for us | Where | Privacy information |
|---|---|---|---|
| Cloudflare, Inc. | Website hosting, security, Turnstile, Web Analytics, signup database (D1) | Global network, United States | cloudflare.com/privacypolicy |
| Google LLC | Google Analytics 4, only with your consent | United States | policies.google.com/privacy and how Google uses data from sites |
| Functional Software, Inc. (Sentry) | Error monitoring | United States | sentry.io/privacy |
| Resend, Inc. | Newsletter list and email delivery, signup alerts | United States | resend.com/legal/privacy-policy |
| Loops.so, Inc. | Waitlist contacts and early access emails | United States | loops.so/privacy |
We will update this list before we add a new provider that handles personal information from the website.
International transfers
We and our providers are based in, or process data in, the United States and other countries that may not have the same data protection laws as where you live. When personal information from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on an approved safeguard, such as a provider’s certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) or the European Commission’s Standard Contractual Clauses with the UK addendum. You can ask us for more detail about the safeguard used for a particular provider.
How long we keep it
- Early access signups (in D1, Loops and the alert email): until the early access program ends and for up to 24 months after our last contact with you, or until you ask us to delete them, whichever comes first.
- Newsletter subscribers: until you unsubscribe. After that we keep only your address on a suppression list, so we do not email you again.
- Session attribution and the email carried to the early access form: in your browser until you close the tab.
- First visit record: in your browser until you reject analytics cookies or clear your browser storage.
- Google Analytics data: event data is kept for no more than 14 months, then deleted by Google.
- Error reports: up to 90 days in Sentry.
- Rate limiting hashes: overwritten as each short window resets. They cannot be turned back into an IP address.
- Emails you send us: as long as needed to deal with your message, and for up to 24 months after the conversation ends.
We may keep information longer if the law requires it or to resolve a dispute.
Your rights
You can contact us at hello@collevo.io to use any of these rights. We will not treat you differently for using them. We may need to confirm your identity first, usually by asking you to reply from the email address we hold. You can also use an authorized agent where the law allows it; we may ask for proof that they are acting for you.
If you are in the EEA, the UK or Switzerland
You have the right to:
- access the personal information we hold about you and get a copy;
- correct information that is wrong or incomplete;
- delete your information;
- restrict how we use it, or object to us using it on the basis of legitimate interests, including for direct marketing (an objection to marketing always wins);
- port information you gave us to another service, in a machine-readable format;
- withdraw consent at any time, without affecting what we did before you withdrew it. For analytics, use the Cookie settings button in the footer;
- complain to your local data protection authority. In the UK, that is the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to help first.
We reply within one month, and tell you if we need longer for a complex request.
If you are in California
Under the California Consumer Privacy Act, as amended by the CPRA, you have the right to:
- know what personal information we collect, use and disclose, and to get a copy;
- delete personal information we collected from you;
- correct inaccurate personal information;
- opt out of the sale or sharing of personal information. We do not sell personal information and we do not share it for cross-context behavioral advertising. Google Analytics runs only if you accept it, and we honor Global Privacy Control as a request to opt out unless you later choose Accept yourself;
- limit the use of sensitive personal information. We do not collect sensitive personal information through the website;
- not be discriminated against for using these rights.
In the last 12 months we collected these categories of personal information: identifiers (such as email address, name and IP address), professional information (company, business type and team size), internet or other electronic network activity (pages viewed, referrers and campaign tags), and approximate location derived from IP address. We collected them from you and from your browser, for the purposes described in What we collect and why, and disclosed them for business purposes to the providers listed in Who we share it with. We keep each category for the periods in How long we keep it.
We respond to verified requests within 45 days, and tell you if we need longer.
If you are in another US state
Residents of states with comprehensive privacy laws, including Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah and Virginia, have similar rights: to confirm whether we process your personal information, to access, correct and delete it, to get a portable copy, and to opt out of targeted advertising, sale and profiling. We do not sell personal information, run targeted advertising, or profile people in ways that produce legal or similarly significant effects.
If we decline your request, you can appeal by replying to our decision or emailing hello@collevo.io with “Appeal” in the subject. We will respond within the time your state’s law requires. If you are not satisfied with the outcome, you can contact your state attorney general.
Everyone else
Wherever you live, you can ask us to access, correct or delete your information, and we will do our best to help.
Children
The website and Collevo are for businesses. They are not directed at children under 16, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, email us and we will delete it.
Security
We protect personal information with measures that fit the risk, including encryption in transit (HTTPS) everywhere on the website, access to our systems limited to people who need it, and providers chosen for their security practices. No method of sending or storing data is completely secure, so we cannot promise absolute security. If you find a security problem, please tell us at hello@collevo.io.
Do Not Track and Global Privacy Control
Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal and you have not made a choice, we treat it as a Reject: the banner does not appear, Google Analytics does not load and the first visit record is not stored. If you later open Cookie settings and choose Accept yourself, we follow that explicit choice instead.
Do Not Track. There is no agreed standard for how websites should respond to Do Not Track, so we do not change anything based on it. Since Google Analytics only runs after you accept it, you are not tracked for analytics unless you choose to be.
The Collevo product
Collevo is not public yet. When it is, businesses (“customers”) will use it to request files and information from their own clients. In short, based on how the product is being built:
- Clients do not need an account. They confirm a one-time code sent by text or email before uploading.
- Uploads are encrypted in transit and at rest.
- Uploads are processed temporarily so they can be checked, then removed. Accepted files go to the customer’s own Google Drive or Dropbox.
- An activity log records opens, uploads, checks and reminders, so the customer can see what happened.
- For files and information that clients upload, the customer decides what is collected and why, and Collevo processes it on the customer’s behalf.
This section is a summary. Before launch we will update this policy with full details of how the product handles customer and client data, and publish a Data processing addendum for customers.
Changes to this policy
We will update this policy when what we collect or how we use it changes, and change the “Updated” date at the top. If a change is significant, for example a new purpose or a new kind of provider, we will make it clear on the website and, where we have your email address and the change affects you, tell you by email before it takes effect. Where the law requires your consent to a change, we will ask for it.
Contact
For questions about this policy or your personal information, or to use your rights:
- Email: hello@collevo.io