This privacy policy applies to all Covextra services available through covextra.com, harness.covextra.com and exchange.covextra.com. Covextra Ltd is the controller of the personal information described here. By accessing or using Covextra services, you agree to this privacy policy.
The type of personal information we collect
Covextra currently collects and processes the following information:
- Account information, such as the identifier of your Privasys ID sign-in, the name and email address you choose to share when you sign in, and details about your use of our services.
- Business information you submit to Covextra Exchange, such as your organisation's name, the requirements in a request for proposals, the terms of a quote, and the orders that follow.
- Technical data, such as your internet protocol (IP) address, browser type and version, time zone setting, operating system and platform.
- Usage data, such as information about how you use our websites and services.
- Communications data, such as when you contact us, subscribe to updates or request information about our services.
How we get the personal information and why we have it
The personal information we process is provided to us directly by you for one of the following reasons:
- Signing in to Covextra Harness or Covextra Exchange
- Submitting a request, a quote or an order to Covextra Exchange
- Contacting us by email or through our website
- Browsing our websites
We do not receive personal information indirectly. We do not purchase data from third parties or data brokers.
We use the information that you have given us to:
- Provide and maintain our services, including matching requests with quotes on Covextra Exchange
- Authenticate you through Privasys ID
- Meter usage and settle what is owed under an order
- Communicate with you and support you
- Improve our websites and services
Under UK data protection law, the lawful bases we rely on are the performance of a contract with you, our legitimate interests in running and improving our services, compliance with our legal obligations, and your consent where we ask for it.
Who processes it for us
Covextra services run on the confidential computing platform of Privasys Ltd, a UK company, and you sign in to them with Privasys ID, its passwordless identity service. Privasys processes the information needed to sign you in and to run our services on our behalf, under contract, and for no other purpose. Its own privacy policy is at privasys.org/legal/privacy.
We do not share your personal information with anyone else, except where the law requires us to.
How we store your personal information
Your information is securely stored. We keep account information for as long as necessary to fulfil the purposes we collected it for, including for the purpose of satisfying any legal, accounting or reporting requirements. Records of orders settled on Covextra Exchange are kept for as long as accounting law requires.
Covextra does not store passwords: sign-in is passwordless, through Privasys ID. Account identifiers and metadata are kept for as long as your account is active.
We keep basic information about visitors, usage data and technical data for routine administration and maintenance purposes only.
Accounts you connect, and the data in them
Covextra Harness can connect an account you already have, such as a mailbox, a calendar or a cloud drive, so that an agent acting for you can work with what is in it. This section explains what happens to that data, including data received from Google APIs, and it applies in addition to everything above.
What is accessed, and why
You choose which account to connect, what it is for and how far the access goes. The boundary is the capability you approve on your own device, not a promise on this page: an agent can only do what that capability allows.
- Mail (Gmail and other IMAP mailboxes): read the messages in the mailbox you connect, write drafts, apply labels, and send a message where you have granted that.
- Calendar: read your events and when you are busy, propose events for you to confirm, and create events where you have granted that.
- Files: read the documents you point it at, and write files where you have allowed it to write.
How it is accessed
The connectors are operated by Privasys and run inside confidential computing environments whose code can be verified by attestation. Before any access happens, you approve a capability on your own device that names the account and the purpose, and you can withdraw it at any time. The credential that opens your account is held in the memory of that environment and on your own device. It is not written to disk and does not appear in logs.
How it is used
Data from a connected account is used only to produce the result you asked for, in your own session. It is never used to train or improve any model. It is never used for advertising, profiling or analytics. No Covextra employee can read it.
How it is stored and shared
We do not store the content of your mail, your calendar or your files. Connectors read on demand and keep nothing at rest. We do not transfer this data to any third party, and we do not sell it.
Limited use
Covextra's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Withdrawing access
You can disconnect an account at any time in your Privasys Wallet, which withdraws the capability and forgets the credential immediately. You can also remove access at the provider: Google at myaccount.google.com/permissions and Microsoft at myapps.microsoft.com. Anything the agent has already left in your own account, such as a draft or a label, remains yours to keep or delete.
Your data protection rights
Under data protection law, you have the following rights:
- Right of access: you have the right to ask us for copies of your personal information.
- Right to rectification: you have the right to ask us to rectify personal information you think is inaccurate, or to complete information you think is incomplete.
- Right to erasure: you have the right to ask us to erase your personal information in certain circumstances.
- Right to restriction of processing: you have the right to ask us to restrict the processing of your personal information in certain circumstances.
- Right to object to processing: you have the right to object to the processing of your personal information in certain circumstances.
- Right to data portability: you have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Please contact us at contact@covextra.com if you wish to make a request.
Cookies
We do not use tracking cookies on our websites. Covextra Harness and Covextra Exchange keep your signed-in session in your browser for as long as you stay signed in.
Advertising and third parties
We do not display advertisements and do not collect information for advertising purposes.
Links to third-party websites
Our websites may contain links to other websites. We are not responsible for the privacy policies of those websites, and they may differ from our own. When you leave our websites, we encourage you to read the privacy policy of every website you visit.
Security
We use commercially reasonable means to protect your personal information, and our services run in confidential computing environments built for exactly that. However, no method of transmission over the Internet, or method of electronic storage, is 100% secure.
Changes to this privacy policy
This privacy policy is effective as of October 2026. If any details of our policy change, this page will be updated, and the changes posted will be effective immediately. We reserve the right to update or change our privacy policy at any time, and you should check it periodically.
How to complain
If you have any concerns about our use of your personal information, you can make a complaint to us at contact@covextra.com.
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO's address:
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
Contact
Company name: Covextra Ltd
Email: contact@covextra.com