Cormaa Privacy Policy

Effective date: August 5, 2026

Cormaa helps businesses and creators produce product tutorials, walkthroughs and related content by allowing automated systems and AI agents to perform authorized workflows inside software applications.

The privacy of your information matters to us. This Privacy Policy explains what information Cormaa collects, why we collect it, how we use and disclose it, how long we retain it and the choices available to you.

When this policy refers to “Cormaa,” “we,” “our” or “us,” doing business as Cormaa. The Platform is accessible via app.cormaa.com and is operated by a solo founder.

When this policy refers to the “Services,” it means the Cormaa website, web application, browser automation systems, AI-assisted tutorial-generation tools, video-generation features and other services operated under the Cormaa name.

This policy applies to visitors to cormaa.com, prospective customers, account holders, authorized account users and people who contact us.

1. Our role when processing information

Cormaa may process information in two different capacities.

When we collect information about website visitors, account holders, prospective customers or people who contact us, Cormaa generally acts as the controller or business responsible for that information.

When a customer directs Cormaa to access a third-party application, complete a workflow, analyze application screens or generate a tutorial, Cormaa generally processes the information found in that application on behalf of the customer. In that situation, the customer is generally the controller or business, and Cormaa acts as its processor or service provider.

If your information appears in a tutorial workflow created by one of our customers, questions about that information should normally be directed to the customer that created or operated the workflow.

Where required, Cormaa and a customer may enter into a separate data processing agreement.

2. Information we collect

Our guiding principle is to collect and retain only the information reasonably needed to operate, secure and improve the Services.

Account and identity information

When you create an account, sign in or join a Cormaa workspace, we may collect:

• Your name.
• Email address.
• Company or organization name.
• Profile image.
• Account role and permissions.
• Authentication information.
• Information received from an identity provider, such as Google, when you use a third-party sign-in option.

If you use Google or another identity provider to sign in, that provider may separately process information under its own privacy policy.

Connected application information

Cormaa allows customers to connect applications so that an authorized agent can perform workflows and generate tutorials.

Depending on the workflow, we may process:

• The name and website of the connected application.
• Login URLs and other application URLs.
• Dedicated demo, test or authorized account credentials.
• Authentication tokens, cookies or session information.
• Workspace names, project names and account configuration.
• Instructions describing the actions the agent should perform.
• Information displayed in the connected application during the workflow.
• Screenshots, page structures, interface elements and interaction data.
• Files uploaded to or downloaded from the connected application.
• Logs showing actions performed by the agent.

Customers should use dedicated demo or test accounts whenever possible and avoid providing production credentials or unnecessary personal information.

Customer Content

We collect and store information you submit to the Services, including:

• Prompts and workflow instructions.
• Scripts and transcript instructions.
• Application credentials supplied for an authorized workflow.
• Uploaded images, documents, videos, logos and other files.
• Screenshots and screen recordings.
• Voiceover instructions and audio files.
• Brand information and visual assets.
• Comments, revisions and project settings.
• Generated tutorials, videos, transcripts, guides and other outputs.

We refer to this information collectively as “Customer Content.”

Billing information

If you purchase a paid plan, we or our payment processor may collect:

• Billing name and address.
• Tax or business identification information.
• Subscription and plan information.
• Payment status and transaction history.
• Limited payment-card information, such as card type, expiration date and the last four digits.

Full card details are normally submitted directly to our payment processor rather than stored by Cormaa.

Product usage and technical information

When you use the Services, we may automatically collect:

• IP address.
• Browser type and browser version.
• Device and operating-system information.
• Approximate location derived from an IP address.
• Pages visited and features used.
• Login times and session duration.
• Button clicks, scroll activity and navigation paths.
• Tutorial-generation activity.
• Usage minutes, credits, exports and plan limits.
• Errors, crashes, performance measurements and diagnostic logs.
• Security events and suspected abuse.

We use this information to operate the Services, understand product usage, troubleshoot problems, improve performance and protect Cormaa and its users.

Cookies and similar technologies

Cormaa may use cookies, local storage, pixels, tags and similar technologies.

These technologies may be used for:

• Authentication and account security.
• Remembering preferences.
• Measuring website and product performance.
• Understanding how people use the Services.
• Diagnosing errors.
• Measuring marketing campaigns.
• Preventing fraud and abuse.
• Delivering or measuring advertising where permitted.

We may use analytics and website-performance services such as Google Analytics, Google Tag Manager, Microsoft Clarity or similar providers.

Some jurisdictions treat the use of advertising or cross-site analytics technologies as the “sale,” “sharing” or use of personal information for targeted advertising. Where required, we will provide an appropriate consent or opt-out mechanism.

You may also control cookies through your browser settings. Blocking essential cookies may prevent some parts of the Services from working.

Communications

When you email us, request support, complete a survey, join a waitlist, book a meeting or otherwise contact Cormaa, we may retain:

• Your contact details.
• The contents of your message.
• Support history.
• Meeting information.
• Survey responses.
• Feedback and interview notes.
• Any files or screenshots you provide.

We may use service providers to manage customer support, email delivery, newsletters and meeting scheduling.

3. How we use information

We use personal information and Customer Content to:

• Create, maintain and secure accounts.
• Authenticate users.
• Operate Cormaa’s automated browser and AI systems.
• Access connected applications under customer instructions.
• Perform requested workflows.
• Analyze screens and identify application controls.
• Generate scripts, screenshots, voiceovers, videos and tutorials.
• Store, edit, export and publish Customer Content.
• Process payments and manage subscriptions.
• Enforce usage limits.
• Provide customer support.
• Diagnose errors and improve reliability.
• Prevent fraud, unauthorized access and abuse.
• Understand how customers use the Services.
• Develop and improve Cormaa features.
• Communicate product, billing, security and policy updates.
• Send marketing communications where permitted.
• Comply with legal obligations.
• Establish, exercise or defend legal claims.

Where applicable privacy law requires a legal basis, we rely on one or more of the following:

• Performance of our contract with you.
• Our legitimate interests in operating, securing and improving the Services.
• Your consent.
• Compliance with legal obligations.
• Protection of the vital interests, rights and safety of users or other people.

You may withdraw consent where processing is based on consent. Withdrawal does not affect processing that occurred before the withdrawal.

4. AI processing and automated systems

Cormaa uses artificial intelligence and automated systems to understand software interfaces, identify possible actions, follow workflow instructions and generate tutorial content.

To provide these features, we may send relevant portions of prompts, screenshots, interface information, transcripts, audio or other Customer Content to contracted AI, speech, cloud-computing and media-processing providers.

We limit this processing to information reasonably necessary to perform the requested service.

Cormaa does not intentionally use private Customer Content to train public or general-purpose AI models for unrelated customers. Our service providers may process Customer Content only as needed to provide their contracted services to Cormaa, subject to their agreements with us.

Cormaa’s systems may make automated decisions about how to navigate an interface or construct a tutorial. These decisions are not intended to make legal, employment, lending, insurance, healthcare or similarly significant decisions about individuals.

AI-generated results can be incomplete or inaccurate. Customers are responsible for reviewing tutorials and generated content before publishing or relying on them.

5. How we disclose information

We may disclose information in the following circumstances.

Service providers and subprocessors

We use third parties to provide infrastructure and business functions, which may include:

• Cloud hosting and data storage.
• AI and machine-learning processing.
• Browser automation.
• Speech synthesis and audio processing.
• Video rendering and media delivery.
• Authentication.
• Payment processing.
• Email delivery.
• Customer support.
• Analytics and performance monitoring.
• Error logging.
• Security and fraud prevention.
• Meeting scheduling.
• Marketing and customer-relationship management.

These providers may process information only for the services they provide to us and subject to applicable contractual obligations.

Cormaa may publish and update a separate list of material subprocessors.

At your direction

We may disclose information when you direct us to interact with a connected application, publish a video, export content, send information to an integration or otherwise share information with another service.

Information sent to a third-party application is also governed by that application’s privacy practices.

Support and troubleshooting

Authorized Cormaa personnel may access Customer Content when reasonably necessary to:

• Respond to a support request.
• Investigate an error.
• Restore an interrupted workflow.
• Protect the security of the Services.
• Investigate suspected misuse.
• Comply with legal obligations.

Where practical, we will request permission before accessing Customer Content for ordinary support purposes. Access is limited to personnel who reasonably need it.

Legal obligations and protection

We may preserve, access or disclose information when we reasonably believe it is necessary to:

• Comply with applicable law, regulation, court order or valid legal process.
• Protect the rights, property or safety of Cormaa, our users or the public.
• Investigate fraud, security incidents or illegal activity.
• Enforce our agreements.
• Respond to an emergency involving a risk of serious harm.

Where legally permitted and reasonably practical, we will attempt to notify affected customers before disclosing their information in response to legal process.

Corporate transactions

If Cormaa is involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of assets, information may be transferred as part of that transaction. We will take reasonable steps to ensure that the recipient continues to protect personal information and will provide notice where required.

6. Sale, sharing and advertising

Cormaa does not sell personal information in exchange for money.

We may use analytics, advertising or campaign-measurement providers. Certain uses of these technologies may be considered “sharing,” targeted advertising or a sale under some privacy laws, even when no money is exchanged.

Where applicable, you may opt out through our cookie controls, a “Your Privacy Choices” mechanism, a recognized browser-based opt-out signal or by contacting us.

We do not use Customer Content stored inside private Cormaa projects for third-party advertising.

7. International processing

Cormaa and its service providers may process information in countries other than the country where you live.

Those countries may have different privacy laws. Where required, we use recognized safeguards for international transfers, such as contractual protections, data-processing agreements or another legally approved transfer mechanism.

8. Data retention

We retain information only for as long as reasonably necessary for the purposes described in this policy.

In general:

• Account information is retained while the account remains active.
• Customer Content is retained while needed to provide the Services or until the customer deletes it.
• Connected-app credentials and session information are retained only while needed to maintain the authorized connection or perform the requested workflow.
• Temporary browser files, uploaded assets and downloaded files may be deleted after tutorial generation or publication is completed.
• Security, diagnostic and usage logs may be retained for a limited period for troubleshooting, abuse prevention and legal compliance.
• Billing and transaction records may be retained as required by accounting, tax and legal obligations.
• Support correspondence may be retained so we can respond consistently to future requests.

Following an account-deletion request, we aim to remove Customer Content from active systems within 30 days. Residual copies may remain in encrypted or access-restricted backups for up to 90 days before being overwritten, unless a longer period is required by law, security obligations or an unresolved dispute.

Aggregated or de-identified information that can no longer reasonably identify you may be retained for longer.

9. Security

We use administrative, organizational and technical safeguards designed to protect information against unauthorized access, alteration, loss, misuse or disclosure.

These measures may include access controls, authentication protections, encrypted transmission, restricted employee access, monitoring, backups and security reviews.

No online service can guarantee absolute security. You are responsible for protecting your account, using strong passwords, maintaining the security of connected application credentials and limiting access to authorized users.

You should promptly notify us if you believe your Cormaa account or connected application has been compromised.

10. Your privacy rights

Depending on where you live, you may have the right to:

• Request access to personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of information.
• Obtain a portable copy of certain information.
• Object to or restrict certain processing.
• Withdraw consent.
• Opt out of marketing communications.
• Opt out of the sale or sharing of personal information, targeted advertising or certain profiling.
• Appeal a decision concerning a privacy request.
• Lodge a complaint with a data-protection authority.

These rights are not absolute. We may need to retain information where permitted or required by law, including for security, fraud prevention, billing, dispute resolution or legal compliance.

To exercise a privacy right, contact us at privacy@cormaa.com.

We may need to verify your identity before completing a request. You may also use an authorized agent where applicable. We will not discriminate against you for exercising a privacy right.

If Cormaa processes your information solely on behalf of one of our customers, we may direct your request to that customer.

11. Marketing choices

You may unsubscribe from marketing emails using the unsubscribe link included in the message or by contacting us.

Even if you opt out of marketing communications, we may still send transactional messages relating to your account, billing, security, requested support or important changes to the Services.

12. Children

Cormaa is a business-oriented service and is not intended for children under 16.

We do not knowingly collect personal information directly from children under 16. If you believe a child has provided personal information to Cormaa without appropriate authorization, contact us so that we can investigate and delete it where required.

Account holders must be at least 18 years old or otherwise old enough to enter into a binding agreement in their jurisdiction.

13. Third-party applications and websites

The Services may contain links to or interact with websites and applications that Cormaa does not operate.

Cormaa is not responsible for the privacy, security or data-handling practices of third parties. You should review the policies of each third-party service before connecting it to Cormaa.

14. Changes to this policy

We may update this Privacy Policy as Cormaa changes.

When we make a material change, we will update the effective date and take reasonable steps to notify affected account holders, such as by email or through a notice in the Services.

Your continued use of the Services after an updated policy becomes effective means that the updated policy will apply to future processing, subject to applicable law.

15. Contact us

Questions, concerns and privacy requests may be sent to:

Cormaa AI
Doing business as Cormaa
privacy@cormaa.com

Attribution

This Privacy Policy contains material adapted from the Basecamp open-source policies, made available under the Creative Commons Attribution 4.0 International licence. The material has been substantially modified for Cormaa’s services and data-processing activities.