Privacy Notice

Effective date: 31 August 2026 · Last updated: 31 August 2026. This notice covers the CocciFlows website and CocciFlows software products, provided under the Coccinelle Technologies brand. Related documents: Terms of Service and Refund Policy.

In short

1 · How the product handles data — the important part

Understanding the architecture explains most of this notice:

CocciFlows is not in that path. We do not proxy, receive, store or analyse the conversations your agent has. We have no server that your agent contacts in order to answer a question.

The one CocciFlows-hosted file that can appear in this flow is the optional chat-widget script, if you choose to load it from our website rather than hosting the copy included in your package. That file is static JavaScript; requesting it involves your visitor's browser contacting our hosting provider, as any web request does. The widget sends conversation messages only to your agent endpoint — never to us.

2 · Data processed by this website

This is a static site served from Cloudflare Pages.

This website runs no analytics, advertising or tracking scripts, and sets no cookies of its own. There is no advertising network, no cross-site tracking, no visitor profiling, and no mailing list on this site. If that changes, this notice will be updated before the change goes live.

Server and security logs. Like any website, requests reach a hosting and content-delivery network — Cloudflare — which processes technical connection information such as IP address, request time, requested URL, and browser user-agent in order to serve the page and to protect the site from attack and abuse. That processing is carried out by the hosting provider as part of delivering and securing the site, and such logs are retained for a limited period under that provider's own practices. Cloudflare may set strictly necessary cookies for security purposes; we do not set cookies ourselves and do not read any.

Fonts. Pages load web fonts from Google Fonts, which means your browser makes a request to Google's font servers. If you prefer to avoid that, browser settings and extensions can block it; the site remains readable with system fonts.

Contacting us. If you email us, we process what you send in order to reply. Nothing on this site collects your details automatically.

3 · Data handled by the setup wizard, on your computer

CocciFlows Setup is a small application that ships inside your product download and runs on your own computer. It listens only on 127.0.0.1 — the loopback address — so it is not reachable from your network or the internet.

During setup you enter your business details, your knowledge base, your AI provider API key, your n8n address and API key, and your SMTP details if you use escalation email. As implemented today:

• Your secrets are held in the wizard's memory for that session only. The API keys, passwords and SMTP credentials are not written to the wizard's saved settings file, and the code refuses to persist any state key that looks like a credential. Close the wizard and you re-enter them next time.
• Non-secret configuration is saved locally — your business details and knowledge — so you can continue where you left off. That file stays on your computer.
• Your keys are sent only to the services they belong to — your n8n and your AI provider — from your own machine. They are not transmitted to CocciFlows. We operate no server that the wizard reports to.
• During installation your AI provider key and SMTP details are stored as credentials inside your own n8n, encrypted by n8n in its own credential store.

These are statements about how the shipped code behaves, not a guarantee about the security of your computer or your n8n instance, which are under your control. No software can protect credentials on a device that is itself compromised.

4 · Data handled by your installed agent

Once installed, your agent processes what your visitors type, the business knowledge you configured, and — where you enable escalation — the contact details a visitor provides so your team can follow up. Short-term conversation context is kept inside your n8n for a limited period so a conversation makes sense across messages.

All of that happens in systems you control. For that data, in relation to your end users, you — not CocciFlows — decide the purposes and means of processing. Buying software does not make its vendor the controller or processor of every conversation the software later handles.

That means you are responsible for:

• publishing your own privacy notice to your website visitors, describing the chat agent;
• having a lawful basis for processing what visitors send, where your law requires one;
• deciding retention periods in your own n8n and email systems;
• responding to your end users' data-protection requests;
• the terms of the AI provider you connect, since visitor messages are sent to it from your account.

If you need us to sign a data-processing agreement in order to buy the product, please note that in normal self-hosted operation we do not process your end users' data at all — but do get in touch and we will tell you honestly what is and is not applicable.

5 · Third parties

The providers you choose act under their own terms and privacy policies, directly with you. We describe their role here factually; we are not stating a contractual data-protection relationship that has not been put in place, and we are not affiliated with them.

6 · Retention

We keep as little as possible, for no longer than needed:

• Website logs — held by the hosting provider for a limited period under its own practices, for delivery and security.
• Purchase records — when checkout opens, the payment provider will retain transaction records for the period its legal, tax and accounting obligations require. Any purchase information we hold for licensing and support would be kept only as long as needed for those purposes and for legal record-keeping.
• Correspondence — kept while it is useful for support, then deleted.
• Your setup data and conversations — retained by you, in your systems, for as long as you decide. We hold none of it.

7 · Security

The principles the product is built on: secrets are held in memory rather than written to disk during setup; the setup application binds to the loopback interface only and checks the request host; credentials are stored in your n8n's own encrypted credential store; the widget shipped to your website contains no keys, no system prompt and no private configuration; and the packaged download is assembled from an allowlist and scanned so that development files and credentials cannot be included.

These are design measures, not a guarantee. No software is perfectly secure, and the security of your own n8n, servers, computer and accounts is yours to maintain. If you believe you have found a security issue in a CocciFlows product, please tell us.

8 · International transfers

The internet is global. This website is delivered from a content-delivery network with servers in many countries, so a page may be served to you from outside your own. When checkout opens, the payment provider will operate internationally under its own transfer arrangements. The third-party services you choose for your own installation may process data in their own regions — where that matters to you, check each provider's documentation and choose accordingly, since that choice is yours.

9 · Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to the processing of your personal data, to receive a copy of it, and to complain to your data-protection authority. To exercise them, contact us using the details below.

Please note what we actually hold: for a visitor to this website, that is normally nothing beyond the hosting provider's technical logs; for a customer, it would be purchase and support records. For data inside your installation, the request belongs to you as the operator of that system — we have no access to it and cannot retrieve or delete it for you.

10 · Changes to this notice

We will update this notice when the site or the product changes — for example when checkout opens and payment processing begins, or if analytics were ever introduced. The effective date above shows the current version, and material changes will be reflected here before the change takes effect.

11 · Contact

For support, privacy, refund and legal enquiries, contact us at support@coccitech.ae — this is our single public contact address, and we reply from it.

CocciFlows is provided under the Coccinelle Technologies brand.