Legal

Privacy Policy

Last updated: 2026-05-01

Who we are

CoopSignal is operated from Vienna, Austria, and is subject to the EU General Data Protection Regulation (GDPR). We provide intelligence on development-finance mechanisms for Latin America and the Caribbean.

What data we collect

We collect only the data needed to deliver the product:

Account data: email, name, organization, role, country + sector preferences, preferred language.
Usage data: your watchlist, saved AI match projects, notifications preferences.
Billing data (Pro / Institutional only): a Stripe customer ID we use to tie your subscription to your account. We never see or store card numbers — Stripe handles them directly.
Newsletter subscribers: email address and timestamps of subscribe/confirm/unsubscribe events. IP address at time of signup is stored for 30 days for abuse prevention.
Server logs: request path, user id, and duration. We do not log email addresses, full names, or your AI match project descriptions.

What we do not collect

We do not use tracking cookies. The only cookies set are required for login session management and Stripe checkout.
We do not sell or rent data to third parties.
We do not use your AI match project descriptions to train models.

Third-party processors

We rely on the following vendors to run CoopSignal. Each is bound by their own DPA with us and by the data transfer mechanisms required under GDPR.

Supabase — database + authentication. Hosts your account record, watchlist, saved projects, and alerts.
Stripe — billing. Receives your email, billing address, and card details directly at checkout.
Resend — transactional + newsletter email delivery. Receives your email address and the content of messages we send you.
Anthropic — AI matching model. When you submit a project to Find Funding, the description you type is sent to Anthropic for inference. Per Anthropic's API terms, this data is not used for training.
Vercel — application hosting. Receives request metadata (IP, user agent, path).
Plausible Analytics — privacy-focused pageview + event counts. Does not use cookies and does not collect personally identifiable information. Aggregate data only.
Firecrawl — mechanism content scraping. Does not receive user data.

Your rights

Under GDPR and similar laws, you have the right to:

Access — export all your data as a JSON file from Account → Danger zone → Download export.
Rectify — update your profile from Account → Profile.
Erase — permanently delete your account + all associated rows from Account → Danger zone → Delete my account. This cancels any active Stripe subscription.
Portability — the JSON export above is machine-readable and portable.
Object or restrict processing — email hello@coopsignal.com and we will honor the request within 30 days.
Lodge a complaint — with the Austrian Data Protection Authority (dsb.gv.at) or your local supervisory authority.

Data retention

We retain account and usage data while your account is active. Deleted accounts and their associated rows are purged within 30 days of deletion. Billing records are retained for 7 years as required by Austrian tax law. Newsletter IP addresses are purged after 30 days.

Security

Data is encrypted in transit (TLS) and at rest (database disk encryption). Row-level security policies restrict access so that one user cannot read another's watchlist, saved projects, or contact directory entries. Admin access is role-gated at the database layer.

International transfers

Our processors may store data outside the European Economic Area (notably in the United States). We rely on the European Commission's adequacy decisions or the Standard Contractual Clauses (SCCs) where no adequacy decision applies.

Changes to this policy

We will post any material changes to this policy on this page and update the "Last updated" date at the top. For significant changes affecting how we use your data, we will notify active subscribers by email.

Contact

For any privacy question or request, email hello@coopsignal.com.