Data Compliance
Effective date: April 7, 2026
ColdCopy is designed to minimize data collection. We don't store your prospect data, we don't build user profiles, and we don't sell personal information to anyone.
GDPR — European users
Lawful basis for processing
- Contract performance — Inputs you submit (URLs, prompt text) are processed to deliver the service you requested.
- Legitimate interest — Analytics (Google Analytics) are used to understand how the product is used.
Your rights under GDPR
| Right | What it means |
|---|---|
| Access | Request a copy of any personal data we hold about you. |
| Erasure | Request deletion of your data. |
| Portability | Receive your data in a portable format. |
| Objection | Object to processing based on legitimate interest. |
| Withdraw consent | Where processing is consent-based, you may withdraw at any time. |
Since we don't store your inputs server-side, most of your data lives in your browser (LocalStorage) and is under your direct control.
CCPA — California residents
You have the right to:
- Know what personal information we collect and how it's used.
- Request deletion of your personal information.
- Opt out of the sale of your personal information.
We do not sell personal information. Ever.
Data retention
| Data type | Retention |
|---|---|
| Inputs (URLs, prompts) | Not retained — processed in real-time via Anthropic API and discarded. |
| IP addresses | Held in memory for rate limiting only. Not logged. Reset on server restart. |
| License key | Stored in your browser's LocalStorage only. Gumroad retains a hashed validation record per their terms. |
| Analytics | Retained by Google per their data retention settings (default: 14 months). |
Data requests
To exercise any of your rights, email us at info@coldcopy.pro. We'll respond within 30 days.