Privacy
This website
The controller for data processing on covey.work is the operator named in the legal notice.
This website sets cookies only if you consent to reach measurement. Without your consent no measurement script is loaded and no cookie is set. The chosen language and appearance are kept in the browser's local storage; they never leave the device.
When a page is requested, the web server logs the time, the address requested, the status code, the referring page and the browser identification. The IP address is stored truncated (IPv4 without its last octet, IPv6 without the device part) and can no longer be attributed to a person. The logs serve operation, security and an anonymous reach statistic. The legal basis is Art. 6 (1) (f) GDPR. The logs are deleted after 90 days.
All content — including fonts and images — is served from this server; no external services are embedded. For the signed-in interface on app.covey.work, see the section below.
Data subjects have the right to access, rectification, erasure, restriction of processing and objection (Art. 15–21 GDPR). Contact: see legal notice.
With your consent we use Google Analytics 4 (Google Ireland Limited, Dublin). Collected are the pages requested, approximate origin, device and referring source; the IP address is truncated. Advertising and personalisation features are switched off. Data may be transferred to the USA — Google LLC is certified under the EU-US Data Privacy Framework. The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You may withdraw it at any time with effect for the future.
The control plane
The signed-in interface lives on app.covey.work and processes different data than this page. Anyone running covey themselves runs it on their own infrastructure — the following then applies to their installation and is the starting point for their own notice.
The controller is the operator of the respective installation. For app.covey.work that is the operator named in the legal notice.
The application sets a technically required session cookie for sign-in. No tracking or analytics services are used and no data is shared with third parties.
Processed is what operation requires: account and sign-in, the agents' configuration, their tasks, and the recordings of their sessions including the cost incurred. The legal basis is Art. 6 (1) (b) and (f) GDPR.
Agents access connected target systems — ticket systems, source control, mailboxes. Which ones is the operator's decision; access is issued short-lived at runtime and is never stored in the sandbox workspace. What an agent did there is in the recording.
The language models the agents run on are third-party services. Which content is transmitted to them follows from the tasks an operator gives their agents; the choice of provider is theirs.
The covey app
The covey app for iPhone, iPad and Mac connects to one covey installation: app.covey.work or an organisation's own server. The controller is the operator of that installation; for app.covey.work, the operator named in the legal notice.
The app processes what its use requires: the account it is paired with (name, e-mail address and a key that identifies the account), messages, notes and meeting transcripts, and the photos, videos and files a person chooses to send. They are stored on the installation the app is paired with. The legal basis is Art. 6 (1) (b) GDPR.
Speech for dictation and meeting notes is recognised on the device with a model from the installation. No audio is stored or sent, only the recognised text. In a call with an agent on the Mac, the reply is spoken by the speech service the organisation has set up; covey does not store the audio.
On iPhone and iPad, notifications are delivered through Google Firebase Cloud Messaging (Google Ireland Limited) and Apple's push service; for this the app registers a device token with the installation. A notification carries the agent's name and what happened, and the first line of the message only if the organisation has switched that preview on. Installations that do not send notifications themselves pass them through a relay on app.covey.work, which only forwards them. Data may be transferred to the USA; Google LLC is certified under the EU-US Data Privacy Framework. The legal basis is Art. 6 (1) (b) GDPR.
The app contains no analytics, advertising or crash-reporting services. A diagnostic log, if switched on in the settings, stays on the device.
On the Mac, an activity log can be switched on in the settings. While it is on, it records which app and window are in front, the address of a browser page and an excerpt of the focused field, and sends this to the installation, visible only to the person's own account. It is off by default and records no keystrokes, no screenshots and no password fields.
The app creates no accounts of its own. Its access can be revoked at any time in the web interface, and an account is removed by the organisation that created it. The rights under Art. 15–21 GDPR apply as described above.