Effective Date: October 16, 2026 · Last Updated: October 16, 2026
This Privacy Policy describes how Cohora ("Platform," "Service"), operated by Cohora ("Provider," "we," "us," or "our"), collects, uses, stores, shares, and protects personal information.
Our Platform provides organizational management software, primarily designed for educational institutions, training providers, and related businesses, but available for other lawful organizational purposes.
We are committed to protecting personal information and handling it transparently in accordance with applicable data protection laws.
This Privacy Policy applies to visitors to our websites, account holders, organizational administrators, and individuals whose personal information we process directly.
Personal information submitted by organizations may be subject to additional contractual data processing arrangements.
We may process personal information in different capacities depending on the circumstances.
As a Data Controller: We determine the purposes and means of processing information relating to account registration, service administration, security, billing, customer support, and our own business operations.
As a Data Processor: When organizations use the Platform to manage students, employees, customers, schedules, attendance, payments, or other records, we generally process that information on behalf of the relevant organization and according to its authorized instructions.
Organizations are generally responsible for determining what personal information they collect, the purposes for which it is used, and the permissions granted to their authorized users.
These distinctions apply where recognized by applicable law. The relevant legal responsibilities depend on the actual processing activities and applicable jurisdiction.
Depending on how the Platform is used, we may collect and process the following categories of information.
Organizations may submit and manage information including:
The specific categories of Customer Data depend on how each organization configures and uses the Platform.
We do not determine the specific content organizations choose to submit, except where required for the operation, security, or legal compliance of the Service.
When users access the Platform, we may collect:
When users contact us, we may process contact details, correspondence, technical support requests, and information voluntarily provided to resolve issues.
If paid subscriptions are introduced, we may process billing contact information, transaction references, subscription details, and payment status.
Payment card information may be processed directly by authorized third-party payment providers rather than stored by the Platform.
We process personal information for the following purposes, as applicable:
We do not sell personal information.
We do not use Customer Data to train artificial intelligence models without separate authorization.
Where applicable law requires a legal basis for processing personal information, we rely on one or more appropriate grounds, depending on the activity and jurisdiction.
These may include:
When processing Customer Data on behalf of an organization, the organization is generally responsible for establishing the appropriate legal basis for its processing activities.
We may use cookies, local storage, and similar technologies for authentication, maintaining sessions, remembering preferences, protecting accounts, and understanding Service performance.
Where optional analytics or tracking technologies are used, we will provide applicable disclosures and obtain consent where required by law.
Users may manage certain technologies through their browser settings. Disabling essential storage mechanisms may affect Service functionality.
We may disclose personal information to trusted third-party service providers where reasonably necessary to operate the Platform.
These may include providers of:
Such providers may process personal information only for authorized purposes, subject to applicable contractual and legal obligations.
We may also disclose information when required by law, valid legal process, or where reasonably necessary to protect the rights, safety, or security of users, the Platform, or others.
We do not sell or rent personal information to data brokers.
Personal information may be processed in countries other than the country in which a user or organization is located.
Where applicable law imposes restrictions on international data transfers, we will use appropriate legal mechanisms and safeguards.
Organizations should consider the location of their users and applicable data protection requirements when using the Platform.
We use technical and organizational security measures intended to protect personal information against unauthorized access, alteration, disclosure, loss, or destruction.
Depending on the relevant systems and features, these measures may include:
No electronic system can guarantee absolute security.
We encourage users to maintain secure credentials and promptly report suspected unauthorized access.
We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, subject to applicable legal and contractual requirements.
Retention periods may vary according to the category of information, the organization's instructions, account status, and legal obligations.
When information is no longer required, we will delete, anonymize, or otherwise handle it in accordance with applicable requirements and our retention procedures.
Certain information may remain temporarily in backups or be retained where legally required.
Each organization is responsible for managing access to its organizational environment.
Authorized administrators may grant, modify, or revoke user permissions according to the Platform's available functionality.
Users may be able to access, modify, or delete organizational information according to the permissions assigned to them.
Individuals seeking access to or correction of information managed by an organization may need to contact that organization directly.
We will provide reasonable assistance where required by applicable law or contractual obligations.
The Platform may be used by educational organizations to manage information concerning children and students.
Organizations are responsible for determining the lawful basis for collecting and processing such information and for providing any legally required notices or obtaining necessary authorizations.
We process educational Customer Data for authorized Service purposes and do not independently use such information for behavioral advertising.
The Platform is not intended for independent account registration by children except where permitted under an authorized organizational arrangement and applicable law.
Depending on applicable law and your circumstances, you may have rights relating to your personal information, including:
We may need to verify your identity before responding to certain requests.
Where personal information is controlled by an organization using the Platform, requests may need to be directed to that organization.
We maintain procedures intended to identify, investigate, and respond to suspected security incidents involving personal information.
Where required by applicable law or contractual obligations, we will notify affected organizations, individuals, or competent authorities of relevant personal data breaches.
Notification obligations and timelines depend on the circumstances and applicable legal requirements.
We may update this Privacy Policy to reflect changes in our services, processing activities, legal obligations, or business practices.
When material changes occur, we will provide appropriate notice where required by law.
The latest version will be made available through the Platform, together with its effective date.
For privacy-related questions, requests, or concerns, contact:
We will review privacy inquiries and respond in accordance with applicable legal requirements.