Privacy

This website

The controller for data processing on covey.work is the operator named in the legal notice.

This website sets cookies only if you consent to reach measurement. Without your consent no measurement script is loaded and no cookie is set. The chosen language and appearance are kept in the browser's local storage; they never leave the device.

When a page is requested, the web server logs the time, the address requested, the status code, the referring page and the browser identification. The IP address is stored truncated (IPv4 without its last octet, IPv6 without the device part) and can no longer be attributed to a person. The logs serve operation, security and an anonymous reach statistic. The legal basis is Art. 6 (1) (f) GDPR. The logs are deleted after 90 days.

All content — including fonts and images — is served from this server; no external services are embedded. For the signed-in interface on app.covey.work, see the section below.

Data subjects have the right to access, rectification, erasure, restriction of processing and objection (Art. 15–21 GDPR). Contact: see legal notice.

With your consent we use Google Analytics 4 (Google Ireland Limited, Dublin). Collected are the pages requested, approximate origin, device and referring source; the IP address is truncated. Advertising and personalisation features are switched off. Data may be transferred to the USA — Google LLC is certified under the EU-US Data Privacy Framework. The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You may withdraw it at any time with effect for the future.

The control plane

The signed-in interface lives on app.covey.work and processes different data than this page. Anyone running covey themselves runs it on their own infrastructure — the following then applies to their installation and is the starting point for their own notice.

The controller is the operator of the respective installation. For app.covey.work that is the operator named in the legal notice.

The application sets a technically required session cookie for sign-in. No tracking or analytics services are used and no data is shared with third parties.

Processed is what operation requires: account and sign-in, the agents' configuration, their tasks, and the recordings of their sessions including the cost incurred. The legal basis is Art. 6 (1) (b) and (f) GDPR.

Agents access connected target systems — ticket systems, source control, mailboxes. Which ones is the operator's decision; access is issued short-lived at runtime and is never stored in the sandbox workspace. What an agent did there is in the recording.

The language models the agents run on are third-party services. Which content is transmitted to them follows from the tasks an operator gives their agents; the choice of provider is theirs.