Privacy Notice

1. About Coly

This Privacy Notice describes how Coly, Inc. ("Coly," "we," "our," or "us") processes personal data in connection with the Coly platform, as well as Coly’s website, applications, Coly Assistant, and related products, features, and functionality (collectively, Coly’s “Services”).

In most cases, Coly processes personal data on behalf of the organization that provides you with access to the Services, such as a university, college, housing provider, landlord, employer, or other organization. That organization determines the purposes and means of the processing of your personal data and acts as the Data Controller. Coly acts as a Data Processor and processes personal data in accordance with the Data Controller's instructions and applicable law.

This Privacy Notice explains how we collect, use, disclose, store, transfer, protect, and otherwise process personal data in connection with the Services. It also describes certain limited circumstances in which Coly may process personal data for its own operational, security, compliance, legal, or service-improvement purposes, as permitted by applicable law.

We respect your privacy and are committed to protecting personal data in accordance with applicable data protection laws.

‍

2. Data Processor

Where Coly processes personal data for its own limited operational, security, compliance, legal, or service-improvement purposes as described in this Privacy Notice, Coly acts in accordance with applicable law and its own responsibilities relating to that processing.

Our contact details are provided in Section 14.

‍

2. Personal Information We Use

2.1 Information that you provide to us

When you use our Services, you may provide:

• Contact Information: first name, last name, email address, telephone number, and other contact information you choose to provide.

• Assessment and Preference Information: responses to assessments, assessment results, personality information, values, interests, lifestyle preferences, living preferences, survey responses, and similar information.

• Demographic Information: native language, date of birth, age, gender identity, country of residence, and similar information where provided.

• Communications and User Content: information you provide through surveys, support requests, feedback mechanisms, free-text fields, messages, and other communications submitted through the Services.

‍

‍2.2 Information that your institution or housing provider provides to us

Your institution or housing provider — the company, university or landlord you are applying to or living with — creates your account and provides:

• your first name, last name and email address;

• any labels they apply to your record for their own administrative purposes;

• the unit or shared living space you are assigned to, and which other residents are assigned to it; and

• whether you are under 18, where applicable.

They also provide information about themselves, which is not personal data about you: their organization name and logo, their legal entity details, and the staff accounts authorized to use the platform together with those staff members’ email addresses.

The information provided by your institution or housing provider depends on how that organization chooses to use the Services and the features it has enabled.

‍

2.3 Information collected automatically when you use the service

• User and session identifiers;

• IP address;

• Device, browser, operating system, and platform information;

• Pages, screens, features, and functions accessed;

• Interaction, usage, and event data generated through use of the Services; and

• Diagnostic, security, performance, and troubleshooting information.

‍

2.4 Coly Assistant for Tenants conversation data

When you use Coly Assistant, we process:

• the messages you write and the responses generated;

• message timestamps and session identifiers;

• the feedback you give on responses, such as a thumbs up or thumbs down;

• any message you flag using “Report message,” together with the reason and any comment you provide; and

• a record of whether you chose to send an “I need support” request.

‍

Coly Assistant is not designed to collect sensitive personal information and we encourage users not to share sensitive personal information unless necessary for the topic they wish to discuss. Because users communicate freely, conversation content may nevertheless include sensitive personal information, including information relating to health, beliefs, disability status, sexual orientation, or other personal matters.  

Where such information falls into a special category under applicable data protection law, it is processed only because you chose to include it in your message, on the legal basis established by your institution as Data Controller, and only as necessary to provide and support Coly Assistant, process user-requested functionality, address reported messages or technical issues, and carry out the other limited purposes described herein, in accordance with the Data Controller’s instructions and applicable law. We do not analyze it to profile you, score you, or classify your risk.

To generate personalized and contextually relevant responses, Coly Assistant may use information available within the Services, including profile information, assessments, preferences, values, interests, roommate or shared-living information, prior conversation history, and institution-specific configuration information where applicable.

‍

2.5 Coly Assistant for Staff

Where authorized personnel at your institution use Coly Assistant for Staff, we process their queries and our responses to them. Coly Assistant for Staff does not provide Customer personnel with routine access to browse individual-user conversations, except where specified conversation data has been lawfully disclosed in accordance with Section 11.5.

Customer personnel may provide information, questions, notes, summaries, concerns, or other content to Coly Assistant for Staff. Such information may be processed to generate responses, summaries, suggested approaches, draft communications, administrative support materials, and related outputs requested by authorized personnel.

‍

2.6 Technical logs and monitoring

No separate record of model interactions is kept. AWS Bedrock model invocation logging is disabled, so no copy of your messages or of Coly Assistant’s responses is written to any separate log. Your conversations exist only in Coly’s primary database.

We use two technical service providers to keep the service running:

• Sentry, for error monitoring, is hosted in the United States under European Standard Contractual Clauses. It receives error messages and technical metadata only. It does not receive your messages, and it does not receive your IP address. In one narrow case it may receive personal data: if Coly Assistant fails or times out part-way through generating a response, the error record can include a fragment of that partially generated response (up to 5,000 characters).  

• PostHog, for product analytics, receives information about how the service is used — screen and interaction events, workspace, language, and whether an assessment has been completed — together with your IP address. It does not receive the content of your conversations. A filter removes names and email addresses from event data.  

We may also process technical, security, diagnostic, and operational information to maintain, secure, troubleshoot, monitor, improve, and support the Services.

‍

3. How and Why We Use Personal Information

Coly processes personal data on the documented instructions of the Data Controller and for the purposes described in this Privacy Notice, the applicable agreement between Coly and the Data Controller, and applicable law.

Where Coly processes personal data solely on behalf of a Data Controller, the Data Controller determines the legal basis for that processing. Where Coly acts for its own limited purposes as described in this Privacy Notice, the applicable legal basis may include compliance with legal obligations, Coly’s legitimate interests in protecting and operating the Services, or consent where required by applicable law.

Depending on the Services and features enabled by the Data Controller, we may process personal data to:

• create, administer, and maintain accounts and access to the Services;

• administer assessments, surveys, roommate matching, shared-living functionality, and related Services;

• generate profiles, reports, insights, recommendations, and other outputs requested by the Data Controller or authorized users;

• provide Coly Assistant functionality where enabled by the Data Controller;

• maintain conversation history and other user-requested functionality;

• transmit user-initiated support requests;

• provide customer support, training, implementation, configuration, integration, maintenance, and troubleshooting services;

• maintain, operate, secure, monitor, evaluate, test, develop, and improve the Services;

• detect, prevent, investigate, and address misuse, abuse, fraud, security incidents, technical issues, and violations of applicable terms;

• comply with legal obligations, lawful requests, court orders, and other legal processes; and

• carry out other processing reasonably necessary for the Services and consistent with the purposes described in this Privacy Notice, or as otherwise disclosed at the time of collection.

We do not use your personal data for incompatible purposes.

We do not use Coly Assistant conversations to monitor you, assess or predict your mental health, assess or predict your risk of harm, recognize or infer your emotions, perform emotion recognition, make decisions about you, support automated decisions producing legal or similarly significant effects, create advertising profiles, or provide advertising. We do not sell your personal data.

We do not use identifiable or pseudonymized Coly Assistant conversation data to train, fine-tune, or develop artificial intelligence models unless expressly authorized by the Data Controller and permitted by applicable law.

To provide and improve Coly Assistant and the Services, we may use conversation data and related information, subject to appropriate access controls and safeguards, to:

• generate and deliver responses;

• maintain conversation history and user-requested functionality;

• investigate reported messages, feedback, or suspected misuse;

• troubleshoot technical issues;

• evaluate response quality;

• test changes to functionality, safeguards, and operating instructions;

• improve system performance, reliability, and user experience; and

• maintain, support, secure, evaluate, develop, and improve the Services.

‍

Where these activities involve review of conversation data, access is limited to authorized personnel and is subject to appropriate confidentiality, security, and access-control requirements.

We may create aggregated, statistical, or anonymized information that does not identify an individual. We may use such information to operate, analyze, secure, test, maintain, develop, and improve the Services and related products, technologies, and functionality. We do not attempt to re-identify anonymized information.

Upon termination of your account, your personal data will be deleted in accordance with the retention periods described in this Privacy Notice, the instructions of the Data Controller, and applicable legal obligations. Certain information may remain in protected backups for a limited period as part of our normal backup and disaster recovery processes.

‍

4. Sharing Your Personal Information

We share personal data only where necessary to provide the Services, comply with applicable law, follow the instructions of the Data Controller, protect the security and integrity of the Services, or otherwise as described in this Privacy Notice.

The Data Controller

We share personal data with the organization that provides or administers the Services for you, such as your university, college, housing provider, landlord, employer, or other organization acting as the Data Controller.

Service Providers and Subprocessors

We use carefully selected service providers and subprocessors to help us provide, operate, secure, maintain, support, and improve the Services. These providers process personal data only on our behalf and subject to contractual and legal obligations designed to protect that information.

Our current subprocessors include:

We may update our subprocessors from time to time in accordance with our agreements with Data Controllers and applicable law.

‍

Coly Assistant Technology Providers

Coly Assistant uses artificial intelligence models made available through Amazon Bedrock within Coly's own AWS environment.

Your conversations and related processing are managed through Coly's environment. We do not provide your conversations to Anthropic for Anthropic's own purposes. Neither Amazon nor Anthropic uses your conversations to train, fine-tune, or develop artificial intelligence models for their own benefit based on the functionality currently enabled by Coly.

‍

Legal Requirements and Protection of Rights

We may disclose personal data when required to do so by applicable law, regulation, court order, subpoena, governmental request, legal process, or other lawful authority.

We may also disclose personal data where reasonably necessary to:

• comply with legal obligations;

• investigate or respond to security incidents, fraud, misuse, or unlawful activity;

• protect the rights, safety, property, or security of Coly, the Data Controller, users, or others; or

• establish, exercise, or defend legal claims.

Where permitted by law, we will seek to notify the Data Controller before making such a disclosure.

‍

Coly Assistant Conversation Data

Your institution or housing provider does not have routine access to browse your Coly Assistant conversations.

Conversation data may be disclosed only in limited circumstances, including:

• where required by applicable law or valid legal process;

• on the documented instruction of the Data Controller;

• in connection with a legal hold, investigation, serious safety incident, death, or similar circumstance where the Data Controller is authorized to request the information;

• where disclosure is necessary to protect rights, safety, or security; or

• where you request or authorize the disclosure.

Any such disclosure will be subject to applicable law, the agreement between Coly and the Data Controller, and appropriate access controls.

No Sale of Personal Data

We do not sell personal data. We do not use personal data for targeted advertising or create advertising profiles based on Coly Assistant conversations.

‍

5. Where We Process Your Personal Information

Your account information, assessment data, profiles, matching information, and Coly Assistant conversation data are hosted and processed within the European Union and European Economic Area ("EU/EEA"). Where Coly Assistant is enabled, model processing occurs within Coly's AWS environment in the EU/EEA.

We use certain service providers that process limited categories of information outside the EU/EEA.

Specifically:

• PostHog, our analytics provider, processes service-usage and interaction information, technical usage information, and IP addresses in the United States to help us understand, maintain, evaluate, and improve the Services. PostHog does not receive the content of Coly Assistant conversations.

• Sentry, our error-monitoring provider, processes error information and technical metadata in the United States to help us identify, investigate, and resolve service and security issues. Sentry is not used to monitor user conversations and does not receive conversation content except in the limited circumstances described above.

Except as described in this Privacy Notice, Coly does not transfer your account data, assessment results, or Coly Assistant conversations outside the EU/EEA.

Where personal data is transferred internationally, Coly implements appropriate safeguards required by applicable law. Depending on the circumstances, these safeguards may include:

• the European Commission's Standard Contractual Clauses;

• the United Kingdom International Data Transfer Addendum or other approved United Kingdom transfer mechanism;

• adequacy decisions issued by applicable regulators; or

• other lawful transfer mechanisms recognized under applicable data protection law.

We may transfer personal data to additional countries if necessary to provide the Services, engage approved subprocessors, comply with legal obligations, or follow the documented instructions of the Data Controller. Where required, we will implement appropriate safeguards before making such transfers.

Additional information about our subprocessors and the locations in which they process personal data is available in Section 5 of this Privacy Notice.

‍

6. Retention of Personal Information  

We retain personal data for as long as reasonably necessary to provide the Services, fulfill the purposes described in this Privacy Notice, follow the documented instructions of the Data Controller, and comply with applicable legal, security, backup, and preservation requirements.

When the applicable Services expire or terminate, personal data is returned or deleted in accordance with the agreement with the Data Controller. Personal data may remain in protected backups until overwritten through Coly’s ordinary backup cycle and may be retained longer where required by law or a valid legal hold.

‍

7. Your Rights

Depending on the laws that apply to you and your relationship with the Data Controller, you may have certain rights regarding your personal data, including the right to:

• request access to your personal data;

• request correction of inaccurate personal data;

• request deletion of personal data;

• request restriction of processing;

• object to certain processing activities; and

• request a copy of personal data in a portable format where applicable.

Because Coly generally processes personal data on behalf of the Data Controller, requests relating to your personal data should ordinarily be directed to the organization that provides or administers the Services for you.

If you submit a request directly to Coly concerning personal data that we process on behalf of a Data Controller, we may forward the request to the appropriate Data Controller or direct you to contact them so they can respond in accordance with applicable law.

Coly will reasonably assist the Data Controller in responding to valid requests concerning personal data where required by applicable law or our obligations to the Data Controller.

If you believe your personal data has been processed in violation of applicable law, you may have the right to lodge a complaint with the relevant supervisory authority, regulator, or privacy commissioner in the jurisdiction where you reside or where the alleged violation occurred.

Where Coly determines the purposes and means of processing, Coly will respond directly to applicable requests in accordance with applicable law.

‍

8. How We Protect Personal Information

Coly maintains technical, organizational, and administrative safeguards designed to protect personal data against unauthorized access, disclosure, alteration, loss, misuse, or destruction. These measures are designed to be appropriate to the nature of the personal data processed and the risks associated with that processing.

Our safeguards include measures relating to:

• access controls and authentication;

• encryption of data in transit and at rest where appropriate;

• personnel confidentiality obligations and training;

• logging, monitoring, and incident response processes;

• backup, recovery, and business continuity procedures; and

• vendor and subprocessor oversight.

Access to personal data, including Coly Assistant conversation data, is limited to authorized personnel with a legitimate business need and is subject to appropriate confidentiality, security, and access-control requirements.

If Coly becomes aware of a Personal Data Breach involving personal data processed on behalf of a Data Controller, Coly will notify the Data Controller in accordance with its contractual and legal obligations.

No method of transmission, storage, or security measure can guarantee absolute security. However, Coly continuously reviews and updates its safeguards as appropriate to support the security of the Services and the personal data we process.

‍

9. Cookie Notice

Coly uses cookies and similar technologies, including pixels, tags, software development kits (SDKs), local storage technologies, and analytics tools, to provide, secure, operate, maintain, and improve the Services.

These technologies may be used to:

• remember your preferences and settings;

• authenticate users and maintain sessions;

• provide security and fraud-prevention functionality;

• understand how the Services are used;

• measure performance and reliability;

• troubleshoot errors and technical issues; and

• improve the user experience, features, and functionality of the Services.

Some cookies and similar technologies are strictly necessary for the operation of the Services. Others help us understand usage patterns, performance, and effectiveness so that we can maintain and improve the Services.

Where required by applicable law, we will obtain consent before placing or using non-essential cookies or similar technologies and will provide mechanisms for managing your preferences.

Additional information regarding the technologies currently used by Coly, including their purpose, provider, duration, and applicable opt-out options, is provided in the table below and may be updated from time to time.

The specific cookies, pixels, local storage technologies, SDKs, and similar tools used by Coly may change over time as the Services evolve. The categories above describe the primary purposes for which such technologies are used. Additional details regarding specific technologies currently deployed may be made available through Coly's cookie banner, consent-management platform, or cookie-preference center.

Google Analytics. Coly may use Google Analytics or similar analytics technologies to help understand how visitors and users interact with the Services. These technologies may collect information regarding device characteristics, browser information, IP address, pages visited, interactions with the Services, referral sources, and similar usage information. Coly uses this information to understand usage patterns, improve functionality, maintain performance, and enhance the user experience.

Where required by applicable law, Google Analytics will be deployed only after the required consent has been obtained. You may manage your preferences through Coly's cookie consent tools. Additional information regarding how Google collects and processes data is available from Google at https://policies.google.com/technologies/partner-sites.

‍

10. Coly Assistant

10.1 What is Coly Assistant?

Coly Assistant is an artificial intelligence feature made available through the Services. Depending on the features activated by the Data Controller, Coly Assistant may be available to individual users, including students, tenants, and residents, and to authorized personnel of the Data Controller. It is designed to provide information, guidance, communication support, and other functionality related to the use of the Services.

Coly Assistant is artificial intelligence and not a human being. Its responses are generated automatically and may be incomplete, inaccurate, outdated, or inappropriate for a particular situation.

Coly Assistant may be made available only to users who satisfy the applicable minimum-age requirements. The Data Controller is responsible for determining whether parental or guardian authorization is required and for providing the age-related information necessary to provision access.

‍

10.2 Information Processed by Coly Assistant

When you use Coly Assistant, we may process:

• messages you submit and responses generated by Coly Assistant;

• conversation history;

• timestamps, session information, and related technical records;

• feedback you provide regarding responses;

• messages or conversations you report using available feedback or reporting tools;

• support requests you choose to submit; and

• profile, assessment, preference, interest, matching, and other information available within the Services that is used to generate personalized or contextually relevant responses.

Because users communicate freely, conversation content may contain sensitive personal information voluntarily provided by users. We process such information only as necessary to provide Coly Assistant and the Services in accordance with the instructions of the Data Controller and applicable law.

‍

10.3 How Coly Assistant Uses Information

Coly processes Coly Assistant information to:

• generate and deliver responses;

• maintain conversation history and related functionality;

• provide user-requested features;

• transmit user-initiated support requests;

• investigate reported messages and feedback;

• troubleshoot technical issues;

• maintain, secure, monitor, support, evaluate, test, develop, and improve Coly Assistant and the Services; and

• comply with legal obligations and the documented instructions of the Data Controller.

Coly does not use identifiable or pseudonymized conversation data to train, fine-tune, or develop artificial intelligence models unless expressly authorized by the Data Controller and permitted by applicable law.

Coly does not use Coly Assistant conversations to create advertising profiles, provide advertising, assess or predict an individual's mental health, assess or predict an individual's risk of harm, perform emotion recognition, or make automated decisions producing legal or similarly significant effects.

‍

10.4 Access to Conversations and Related Information

Access to Coly Assistant conversation data is restricted to authorized personnel with a legitimate business need and is subject to applicable confidentiality, security, and access-control requirements.

Customer personnel do not have routine access to browse individual-user conversations. Coly may access conversation data where reasonably necessary to provide, operate, support, maintain, secure, investigate, evaluate, troubleshoot, or improve Coly Assistant or the Services, or to comply with applicable law and the documented instructions of the Data Controller.

‍

10.5 Disclosure of Conversation Data

Conversation data is not routinely shared with the Data Controller.

Coly may disclose conversation data:

• where required by applicable law, legal process, court order, or governmental request;

• on the documented instruction of the Data Controller;

• in connection with a legal hold, institutional investigation, serious safety incident, death, or similar circumstance for which the Data Controller is authorized to request the information;

• to protect rights, safety, security, or property where permitted by law; or

• where requested or authorized by the individual concerned.

Any disclosure will be subject to applicable law, contractual requirements, and appropriate safeguards.

‍

10.6 Retention

Coly Assistant conversation data is retained in accordance with the retention periods described elsewhere in this Privacy Notice, the instructions of the Data Controller, and applicable legal requirements.

Users may have the ability to archive, hide, or otherwise manage conversations within the user interface. Such actions may affect visibility of conversations to the user but do not necessarily alter applicable retention, backup, preservation, legal-hold, or deletion requirements.

‍

11. SMS Communications and Consent

If you elect to receive SMS or text messages from Coly, we may use your phone number to send account-related messages, service notifications, support communications, updates, and other communications you have requested or consented to receive.

You may opt out of marketing or promotional text messages at any time by following the instructions provided in the message. Opting out of promotional messages will not prevent you from receiving service-related or transactional communications where permitted by applicable law.

Coly does not sell phone numbers or use them for third-party advertising purposes.

‍

12. Updates To This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes to the Services, applicable law, our privacy practices, or our use of technologies and service providers.

When required by applicable law, we will provide appropriate notice of material changes. The most current version of this Privacy Notice will always be made available through the Services or on our website.

Your continued use of the Services following the effective date of an updated Privacy Notice constitutes acknowledgment of the updated Privacy Notice to the extent permitted by applicable law.

‍

13. Contact Information

If you have questions regarding this Privacy Notice, our privacy practices, or the processing of personal data described in this Privacy Notice, you may contact us at:

Coly Technologies AB

Reg. No. 559289-0890

Polhemsgatan 29, 2 tr

112 30 Stockholm, Sweden

Email: privacy@coly.io

Privacy Officer: privacy@coly.io  

Where Coly processes personal data on behalf of a Data Controller, we may direct your inquiry to the appropriate Data Controller or assist the Data Controller in responding as required by applicable law.