Privacy policy coorda.me & coorda tools
This privacy policy applies to the coorda account on coorda.me and to coorda tools (coorda.me/tools).
1. Controller
The controller responsible for processing your data is Peter Sulser, sole trader, trading as Coorda Consulting, SIRET 429 648 009 00117, 2 Lot Gélis, 11120 Moussan, France.
E-mail: coorda.eu@pm.me · Phone: +33 6 99 90 98 24
For any question about data protection, you can reach us at this e-mail address.
2. The essentials at a glance
- We do not sell data and do not build advertising profiles.
- Ad banners are chosen by location, never by your entries. There is no tracking and there are no advertising cookies.
- Your data is stored on servers in the EU (Germany).
- You encrypt the encrypted cabinet on your own device. We cannot read it.
- We only use your location if you allow it and a feature needs it.
- You can export your data and delete your account at any time.
3. What data we process
| Area | Data | When |
|---|---|---|
| coorda account | E-mail address, password (only as an encrypted hash), name or nickname, coorda ID (CID), country of the CID, language, chosen plan | when you register and use the service |
| Country of the CID | one-time location request on the phone, only the country is kept | when you register on the phone; on a computer later |
| Entries in coorda tools | everything you enter yourself: appointments, tasks, notes, contacts, family, inventory, shopping lists, recipes, journeys, contracts and more | when you save something |
| Photos and files | images and files you upload; we remove location data (EXIF) on upload | when you upload |
| Shared drawers | who may see which drawer (CID or e-mail of the invited person) | when you share |
| Encrypted cabinet | encrypted data only; only your device knows the key | when you use it |
| Location features | coordinates for “My location”, weather, compass and the 3-word address (what3words); rounded to about 2 km for weather reports | only on your request |
| Translator and coorda AI | the text you translate or ask about | when you use the feature |
| Error reports and contact | your message, optionally your e-mail, the page concerned, language, browser type | when you write to us |
| Server logs | IP address, date and time, address requested, browser | on every request |
| Payments | plan, billing details; payment is by invoice, by bank transfer or through a European payment service provider – we store no card or account details. During the beta phase we ask for no payment details. | when you choose a paid plan |
In test mode without an account, all entries stay on your device only. We receive them only when you register and transfer them.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Account, sign-in, coorda tools, sharing, storing your entries | contract (Art. 6(1)(b)) |
| Location, camera, microphone, notifications | your consent in the browser (Art. 6(1)(a)), revocable at any time in the browser settings |
| Translator, coorda AI, weather | contract (Art. 6(1)(b)), only on your request |
| Security, abuse prevention, server logs, troubleshooting | legitimate interest in secure operation (Art. 6(1)(f)) |
| Ad banners by location | legitimate interest in financing free services (Art. 6(1)(f)); without profiles, without tracking |
| Invoices, accounting | legal obligation (Art. 6(1)(c)) |
5. Recipients and service providers, third countries
We only pass your data on to service providers we need to run the service. We conclude a data processing agreement (Art. 28 GDPR) with each of them.
| Service provider | Purpose | Country |
|---|---|---|
| Hetzner Online GmbH | servers and storage | Germany (EU) |
| Proton AG (Proton Mail) | receiving e-mails and contact messages | Switzerland – recognised by the EU as adequate |
| Anthropic PBC (Claude AI) | translating and answering the texts you send | USA – safeguarded by the EU standard contractual clauses and the EU–US Data Privacy Framework |
| MET Norway | weather data; the server only sends rounded coordinates, no account data | Norway (EEA) |
| OpenStreetMap / Nominatim | place names for coordinates; the server only sends coordinates | EU |
| what3words Ltd | 3-word address for the location; the server only sends coordinates, no account data | United Kingdom – recognised by the EU as adequate |
| Météo-France | severe weather warnings; no personal data | France (EU) |
| Payment provider | processing paid plans | will be named as soon as paid plans start |
People you share a drawer with only see that drawer. The CID directory only shows what you release yourself.
If data is processed outside the EU, we safeguard this with an adequacy decision or the EU standard contractual clauses.
6. Storage period
| Data | How long |
|---|---|
| Account and entries | until you delete them or close your account |
| Deleted entries | 30 days in the bin, then permanently deleted |
| Closed account | deleted within 30 days, backups after 30 days at the latest |
| Test mode without an account | on your device only: usable for 14 days, readable for 30 days, then deleted |
| Server logs | 7 days, then deleted automatically |
| Error reports and contact messages | until your request is settled, 12 months at most |
| Invoices | 10 years (retention obligation in France) |
7. Cookies and browser storage
We only use what is needed to run the service: a session cookie for signing in, and your language, display and settings in your browser's storage. In test mode your entries are stored there too. There are no analytics, tracking or advertising cookies and no third-party fonts or scripts. That is why we do not need a cookie banner.
8. Security
- All connections are encrypted (HTTPS).
- We store passwords only as a hash, never in plain text.
- The encrypted cabinet is end-to-end encrypted; without your password nobody can open it, not even us.
- Only a few people on the team have access to the servers, each with a personal account.
9. Your rights
You have the right of access, rectification, erasure, restriction, objection and data portability (Art. 15–21 GDPR). You can withdraw consent at any time.
You can exercise many rights directly in “My coorda”: export data, delete entries, close your account. For everything else, an e-mail to coorda.eu@pm.me is enough; we reply within one month.
You can also lodge a complaint with the French data protection authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
10. Minimum age, changes, version
You can open a coorda account from the age of 16 – the same in all countries.
If we change this policy materially, we will inform you in “My coorda” and by e-mail before the change takes effect.
Version: 27 October 2026