Privacy Policy
What personal data CORE collects, why, who receives it and what you can ask us to do about it. Last updated 10 November 2026.
Who is responsible
The controller is CORE Labs, whose details are in our legal notice. For any question about this policy, or to exercise your rights, write to privacy@core.report.
For the data in a customer’s workspace, that customer is the controller and we act as its processor, under the processing terms in our terms.
What we collect, why and for how long
| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Account: name, work email, role, sign-in events | Giving you access; recording who changed what | Contract | While the account exists |
| Workspace content: brands, prompts, the answers and sources collected | Providing the service | Contract (we process it for the customer who owns the workspace) | The workspace’s retention period, two years by default, then deleted |
| Demo requests: name, work email, company, your message | Answering you and following up | Legitimate interest | At most three years after our last contact |
| Billing: billing name and email, invoices (card details stay with the payment provider) | Charging for paid plans | Contract; legal obligation | Ten years, as French accounting law requires |
| Server logs: IP address, request path, timing | Operating and securing the service | Legitimate interest | At most one month |
| Product analytics: masked page address, referrer, browser, approximate location, a random identifier linked to your account once you sign up | Measuring how the site is used | Legitimate interest | At most 25 months |
Account data is needed to give you access; without it we cannot open an account. Prompt text and answers are never sent to error tracking, and we do not sell personal data or use workspace content to train models of our own.
Who receives it
Only the service providers we need, each receiving only what its purpose requires:
- hosting, database and backups, in the European Union;
- email delivery, for sign-in links and reports;
- single sign-on, when your organisation uses it;
- the AI engines we query on your behalf: OpenAI (ChatGPT), Anthropic (Claude), Google (Gemini and AI Overviews) and Perplexity, and the search provider that reads AI Overviews;
- payment processing, when a workspace subscribes;
- product analytics, hosted in the European Union;
- call scheduling, when you book a demo; and
- company logos, loaded by your browser from a logo service.
Some of them are established outside the European Economic Area, mainly in the United States. Those transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses. The list of providers is available on request at privacy@core.report.
Your prompt text reaches the AI engines named above, so write prompts as though they will be read outside your organisation. Results a customer chooses to send to its own AI assistant, webhook or tools are handled by those recipients under their own terms.
Your rights
You can ask for a copy of your data, its correction or deletion, to restrict or object to its use, or to receive it in a portable form, and give instructions about what happens to it after your death. Write to privacy@core.report and we will answer within one month. If your data sits in a customer’s workspace we pass your request to that customer. We take no decision about you based solely on automated processing. You may also complain to the CNIL, or to your local supervisory authority.
Cookies and analytics
We set only cookies that are strictly necessary, and so need no consent: to keep you signed in, to protect the sign-in steps, to remember your current workspace, and to carry your name and email from the demo form to the scheduler for a few minutes. There are no advertising cookies.
Our analytics set no cookie. They keep a random identifier in your browser’s session storage, gone when you close the tab, and record nothing at all if your browser sends Do Not Track or Global Privacy Control, which is how you opt out. The demo scheduler is a frame served by our scheduling provider, which may set its own cookies.
Changes
If we change this policy we update the date at the top, and we tell customers before any change that materially affects them takes effect.