---
title: "Privacy Notice"
url: "https://conecto.chat/privacy"
description: "How CherryWave LLC, which runs Conecto, handles personal data: what it collects and why, who receives it, how long it is kept and your rights."
publisher: "CherryWave LLC"
published: 2026-10-16
updated: 2026-10-23
version: 2026-10-23
---

# Privacy Notice

This notice explains how CherryWave LLC, which runs Conecto, handles personal data. Most personal data in Conecto belongs to the businesses that use it, and we handle it on their instructions. For our own accounts, payments, website and the Sales index, we decide, and this notice covers that in full.

## 1. Who we are

CherryWave LLC, 1309 Coffeen Avenue, Suite 1200, Sheridan, Wyoming 82801, United States, runs Conecto at conecto.chat, api.conecto.chat and cncto.co ("we", "us"). Its managing members are Amelia Cardona Hernandez and Vadim Dunaevskiy.

For anything about your personal data, write to legal@conecto.chat with "Privacy request" in the subject. Data protection authorities, and people in the European Economic Area, the United Kingdom and Switzerland, can reach us there directly.

## 2. Our two roles

**For businesses, we are a processor.** Businesses use Conecto through their AI agents to email, call, book, invoice, hire, publish pages and keep records. The personal data their agents put into Conecto, and the data of the people they deal with (customers, callers, job applicants, staff, website visitors, newsletter subscribers, people who sign documents or report concerns), belongs to that business. The business is the controller and its own privacy notice applies. We handle that data only on its instructions, under the data processing terms in [section 26 of our terms](https://conecto.chat/terms#data-processing-terms). Section 4 describes what that involves.

If your data is in a business's account and you want to use your rights, contact that business. If you write to us, we pass your request to it.

**For our own purposes, we are the controller.** That covers the accounts and the people who run them, payments, visitors to our website, people who write to us or join our waitlist, our partners, and the Sales index behind Sales and prospect search. Section 3 explains each.

## 3. What we collect and why

### Accounts and the people who run them

- **What:** the business's name, website and country; the email addresses and roles of its owners and members; the name and software each bot gives when it signs up or joins; keys, which we store only as hashes; the network the account signed up from (the first three parts of an IPv4 address, or the first 48 bits of an IPv6 address); the record of who accepted our terms, which version and when; sign-in sessions for the account pages; and the audit log of admin and security actions, with the IP address each came from.
- **Why:** to provide the account and the service (performance of our contract, GDPR Article 6(1)(b)); to limit free credit to one new account per network a day and to stop abuse, to keep accounts secure, and to keep proof of what was accepted (our legitimate interests, Article 6(1)(f)).
- **Needed?** An account can't exist without the business's name and a bot or an owner. An owner email is optional, but without it nobody receives notices or approves changes.
- **How long:** while the account exists (section 9).

### Calls and usage

- **What:** each call to a tool: which tool, when, by which key, the price, whether it succeeded, how long it took, and its input and output.
- **Why:** to run and bill the calls, to show the account its history, to answer questions about charges, and to secure and improve Conecto (contract; legitimate interests).
- **How long:** a call's input and output are deleted after 30 days; the rest of its record after 13 months.

### Payments

- **What:** top-ups, auto-reloads, plan payments, refunds and disputes: the amount, currency, date, Stripe's reference for the payment, and a purchase order number if one was given. Link, Stripe's merchant of record service, takes the payment and keeps the card or other payment details, the billing name, address and tax ID. We don't receive full card numbers.
- **Why:** to add credit, handle refunds and disputes, pay partners their commissions, and keep accounting records (contract; legal obligations, Article 6(1)(c); legitimate interests).
- **How long:** with the account, and our accounting records for as long as tax law requires.

### Visitors to our website

- **Server logs:** when you visit conecto.chat or call api.conecto.chat, our hosting provider, Google Cloud, records the request: your IP address, browser, the page or address, and the time. We use these logs to run and secure the service (legitimate interests). They are kept for 30 days.
- **Measurement on some pages:** the home page and the tools, solutions, agents, guides, terms and privacy pages use no analytics, and neither do the account pages or the pages businesses publish on cncto.co. Our other pages, such as the blog, the partner pages, sign-in and the dashboard of the earlier products, use Google Analytics to measure visits, with Google's advertising features off, and the Meta Pixel to measure visits and sign-ups that come from our ads.
- **Your choice:** in Europe, and wherever your browser's time zone can't be placed, both stay off until you accept them in the banner (consent, Article 6(1)(a)). Elsewhere they run unless you decline them in Cookie settings or your browser sends a Global Privacy Control signal, which we honor. You can change your answer at any time in Cookie settings at the foot of those pages.
- **Meta:** for collecting data through the pixel and sending it to Meta, Meta and we are joint controllers; Meta decides on its own what it does with the data after that, under its own policy. Google and Meta keep what they receive under their own retention settings.

### People who write to us, use our chat or join the waitlist

- **What:** your email address and what you write; on pages that show our own chat, what you write there and a random chat number kept in your browser so the conversation can continue; if you join the waitlist, your email address, your language and the page that sent you to us.
- **Why:** to answer you and, for the waitlist, to tell you when Conecto opens to you (legitimate interests; for the waitlist, the request you made).
- **How long:** messages for as long as needed to deal with them and their follow-up; the waitlist until we invite you or you ask us to remove you.

### Partners

- **What:** if you join our partner program: your name, email address and company, your password (stored as a hash), your referral code, the accounts you referred and the commissions they earned, your payout currency and language, and the tax form needed for payouts (a W-9, W-8BEN or W-8BEN-E), which we store encrypted and log every time it is opened.
- **Why:** to run the program and pay you (contract), and to meet tax rules (legal obligation).
- **How long:** while you are a partner, and afterwards as long as tax law requires.

### The Sales index, behind Sales and prospect search

Conecto Sales, and the prospect search businesses run through their AI agents on Conecto, help our customers find businesses to contact about products relevant to their work. If your name and work contact details are published on a company website or another public business page, they may find them. For this data we are the controller.

- **What:** your name, job title and employer; your work email address and business phone number; the company's name, website, location, industry and size; and the public page where each detail was found. We deliver a personal-looking email address or a mobile number only when it is published on a public page about your business. We hold no home addresses, dates of birth or special categories of data.
- **Where it comes from:** company websites, other public business pages and search engine results. To check whether a work email address can receive mail, we may ask the receiving mail server; this sends no message. We may infer a work address from the format a company uses and check it the same way. AI models reached through OpenRouter, and Anthropic's when we use them, read public pages for us and judge whether a business matches a customer's request.
- **Why:** to show customers businesses and contacts that match their searches, and to keep the index accurate. The legal basis is our and our customers' legitimate interest in contacting businesses about relevant products (Article 6(1)(f)). We limit the data to your professional role, keep it for a fixed time, and let you object at any time.
- **Who receives it:** customers whose searches, in Sales or through their agent, match your company and role. A customer that saves or uses your data becomes a separate controller and must give you its own information and a way to object.
- **How long:** 24 months after we last found it on a public page.
- **Your choice:** you can ask what we hold, including the page where we found each detail, and have it corrected or deleted, or object, at [conecto.chat/do-not-sell](https://conecto.chat/do-not-sell) or by writing to legal@conecto.chat. When we remove you, we keep only a hashed form of your email address, so that we never collect or deliver it again.

## 4. Data we handle for businesses

When a business's agent uses Conecto, we handle personal data for it as its processor. What happens depends on the area:

- **Records:** customers, contacts, tickets, orders, invoices, staff records, job applications and the rest are kept in our database in Frankfurt, Germany.
- **Email:** emails to and from the business's inboxes go through Amazon SES in Ireland; the originals of received emails are kept for 30 days. Emails the business's AI writes end with a line saying so. Before an email the business wrote goes to someone who never wrote to it first, and before a newsletter issue or a batch of newsletter invitations goes out, its subject and text are checked for cold outreach by Perplexity's decision model, reached through OpenRouter in the United States.
- **Outreach campaigns:** campaign emails go from the business's own mailbox, through its own mail servers. We keep that mailbox's password encrypted and use it only to send the campaign's emails and to read the replies to them. For the business we keep the names, addresses, companies and first lines of the people a campaign writes to, the emails sent and the replies. An address that unsubscribes, bounces, is marked not interested or is erased stays on the business's do-not-email list, so no campaign writes to it again.
- **Calls:** Twilio carries calls to and from the business's numbers. Every caller first hears a notice that the AI call gets recorded and transcribed. ElevenLabs turns what callers say into text and the business's replies into speech. Conecto runs no AI on calls; the business's own agent receives the words and decides the answers, and receives the transcript when the call ends.
- **Websites and analytics:** the analytics on businesses' websites sets no cookies. It counts visitors with a number made each day from the IP address, browser and site together with a secret that is deleted after a day, so a visitor can't be followed from one day to the next. When a visitor becomes a contact, the business keeps the visit that brought them with their record.
- **Signatures:** the signing record keeps each signer's name, email address, IP address, browser, the time and every step taken.
- **Job applications:** each application keeps the IP address it was sent from and that network's country (looked up in a database on our own servers), checks of its email address and phone number, and what it shares with other applications to the same business, so the business can see signs of fake applications. No AI makes these checks and nothing is decided by them. They are deleted with the application.
- **Whistleblowing:** reports are stored encrypted and shown only to the handlers the business names. Our hosting provider's server logs record the IP address of each visit, as for every page, for 30 days. Closed cases are deleted 3 years after they close.
- **Email address checks:** when a business checks whether an address can receive mail, we ask the receiving mail server; no message is sent. We keep a one-way hash of each address a business checks or finds with our lookups, so its Conecto inboxes never write to that address first.

The [data processing terms](https://conecto.chat/terms#data-processing-terms) list the people and data involved in each area, and each area's page on [conecto.chat/tools](https://conecto.chat/tools) names where its data goes.

## 5. Who receives personal data

We don't sell personal data. These providers process personal data for us, or for the businesses that use Conecto, each for the task shown:

| Provider | Where | What for |
| --- | --- | --- |
| Amazon Web Services, Inc. | Frankfurt, Germany (database); Ireland (email) | the database holding every account's records; sending and receiving email |
| Google LLC (Google Cloud) | Belgium; server logs in a global location | running every call; stored files, PDFs and exports; server logs for 30 days |
| Hetzner Online GmbH | Nuremberg, Germany; Helsinki, Finland | our servers for the code sandbox, social posting (Postiz), web search and email address checks, and our own mail server (CitrusMail), which sends sign-in links, notices, invoices, bookings and signing requests |
| Cloudflare, Inc. | global network | the connection to our search server; Turnstile checks that a person sends a form |
| Twilio Inc. | United States | phone numbers and calls |
| Eleven Labs Inc. | United States | speech to text and text to speech |
| Anthropic, PBC | United States | when we use its models: reading public pages for the Sales index and prospect search, and judging which businesses and people match a search |
| OpenRouter, Inc. | United States | questions to AI assistants for AI visibility checks, passed on to the assistants asked (OpenAI, Anthropic, Google, Perplexity and others); reading public pages for the Sales index and prospect search, and judging which businesses and people match a search, passed on to the makers of the models used (such as Inception for Mercury); checking emails, newsletter issues and invitations for cold outreach before they go, and requests for higher limits, with Perplexity's decision model |
| Stripe, Inc. and its affiliates, including Link | Ireland and the United States | payments, receipts and invoices, refunds and disputes |
| Wise | United Kingdom and United States | payouts to partners |
| Google LLC (Google Analytics) and Meta Platforms | United States and Ireland | measurement on some of our pages (section 3) |

Others receive personal data as part of what a business asks for:

- search engines (DuckDuckGo, Google and Bing) receive the search queries of the web search tool;
- the European Commission's VIES service receives VAT IDs to check them;
- social networks receive the posts a business sends to its own accounts;
- the services a business connects itself, such as its Google Workspace, Microsoft 365, HubSpot, Salesforce, Stripe account or AI provider, receive what its agent sends them.

We may also disclose personal data to professional advisers bound to confidentiality, to courts and authorities when the law requires it or to protect people's rights and safety, and to a buyer or successor in a merger or sale of the business, under the same protections.

We give businesses at least 30 days' notice by email before adding or replacing a provider that processes their data.

## 6. Transfers outside Europe

CherryWave LLC is a U.S. company, and some of the providers above are in the United States. Our database is in Germany and our servers are in Belgium, Germany and Finland. Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses: in our contracts with providers, and in our data processing terms with the businesses that use Conecto. Several of our U.S. providers, including Amazon Web Services, Google, Stripe, Twilio and ElevenLabs, are also certified under the EU-U.S. Data Privacy Framework. You can ask us for a copy of the safeguards at legal@conecto.chat.

## 7. Cookies and storage in your browser

- **Account pages:** signing in sets one cookie that holds a random session key; it is needed for the pages to work.
- **Dashboard of the earlier products:** sign-in cookies, and your preferences (such as the theme) in your browser's local storage.
- **Your cookie choice:** stored in your browser's local storage.
- **Google Analytics and the Meta Pixel:** their cookies are set only as section 3 describes.
- **Our chat:** on pages that show it, a random chat number in local storage.
- **Forms with Turnstile:** Cloudflare runs a check in your browser when you send the form.
- **Partner links:** on the pages of our earlier products, arriving through a partner's link sets a cookie with a random visit number for 120 days, so the partner gets credit if you sign up. It follows your choice for Google Analytics and the Meta Pixel. On our other pages, a partner's code only goes into the setup line you copy, and nothing is stored.
- **Everything else:** the home page and the tools, solutions, agents, guides, terms and privacy pages set no cookies. Pages businesses publish on cncto.co carry no Conecto cookies; their analytics reads one value in local storage that records whether you opted out.

## 8. Security

We protect personal data with encryption in transit, keys stored as hashes, encrypted credentials and whistleblowing reports, scoped keys, an audit log that shows any change to its entries, and providers whose data centers secure the buildings and hardware. [Section 26.5 of our terms](https://conecto.chat/terms#security-measures) lists the measures. No system is perfectly secure; if a breach affects your personal data, we tell you and the authorities where the law requires.

## 9. How long we keep data

| Data | How long |
| --- | --- |
| An account and its records | While the account exists. An account with no calls and no top-ups for two years is deleted, after warnings 60 and 14 days before, unless it holds credit or rents something; one with invoices or books is kept until the newest of them is ten years old, counted from the end of its year. |
| A closed account | Available for export for at least 30 days after the account stops working, then deleted within 30 days |
| A call's input and output | 30 days |
| The rest of a call's record | 13 months |
| Originals of received emails | 30 days |
| Server logs | 30 days |
| The daily secret behind website analytics | 1 day |
| The Sales index | 24 months after a detail was last found; at once on request, keeping a hash of the email address |
| Closed whistleblowing cases | 3 years after closing |
| The waitlist | Until we invite you or you ask us to remove you |
| Payments and our accounting | As long as tax law requires |
| Backups | Overwritten in the normal backup cycle |

## 10. Your rights

**In the EEA, the United Kingdom and Switzerland,** you may ask us for access to your data, to correct it, to erase it, to restrict its use, or for a copy to take elsewhere. You may object to our use of it based on legitimate interests, and at any time to its use for direct marketing. Where we rely on your consent, you may withdraw it at any time, without affecting what was done before. You may also complain to the data protection authority where you live or work, or where you think the law was broken.

**In U.S. states with privacy laws,** such as California, you may ask to know what we collect and how we use it, to get a copy, and to have it corrected or deleted, and you may opt out of the sale or sharing of your personal information and of targeted advertising. We don't sell personal information for money. Measurement through the Meta Pixel on some of our pages may count as sharing for advertising under California law; you can opt out in Cookie settings or with Global Privacy Control. For the Sales index, use [conecto.chat/do-not-sell](https://conecto.chat/do-not-sell). We won't treat you differently for using these rights. If we refuse a request, you can appeal by replying with "Privacy appeal" in the subject.

**How to ask:** write to legal@conecto.chat with "Privacy request" in the subject, saying which right you want to use. We may ask for information to confirm it is you. We answer within one month, or tell you within that month if a complex request needs up to two more. It costs nothing. If your data is in a business's account, we pass your request to that business.

## 11. Decisions made by software

We don't make decisions about people based only on automated processing that have legal or similarly significant effects. A business's own AI agent may make decisions with the data it holds in Conecto; the business is responsible for them and must tell you about them.

## 12. Children

Conecto is a service for businesses and is not meant for children. We don't knowingly collect personal data from children for our own purposes. If you think a child gave us personal data, write to us and we will delete it.

## 13. Google user data

Conecto's use and transfer of information received from Google APIs to any other app adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. When a business connects a Google Calendar, Conecto uses it only to list the business's calendars, check free times and add its bookings. Conecto doesn't use, transfer or sell Google user data, raw or derived, to create, train or improve any AI or machine learning model, and doesn't transfer it to anyone who would.

## 14. Changes to this notice

We publish each version of this notice here with its date. When a change materially affects how we use personal data, we also tell account owners by email before it takes effect.

## 15. Contact and complaints

Write to legal@conecto.chat with "Privacy request" in the subject, or by post to CherryWave LLC, 1309 Coffeen Avenue, Suite 1200, Sheridan, Wyoming 82801, United States. You can also complain to your data protection authority.

See also: [Terms of Service](https://conecto.chat/terms.md)