Privacy Policy

Effective date: 18 October 2026

This Privacy Policy explains how CorrespondR AS ("CorrespondR", "we", "us" or "our") collects and uses personal data when you use our website, web application, desktop applications, mobile applications and related services (the "Service").

CorrespondR AS is a Norwegian company (organisation number 931 147 765) and is the controller of the personal data described in this policy. Where an organisation uses CorrespondR for its own staff or customers, that organisation may also be a controller for the content its users share.

1. Information We Collect

Information you give us

• Account information: your name and email address, and the password you choose (which is held by our sign-in provider and never visible to us).
• Profile information: profile photo, job title, company name and short bio, if you add them.
• Messages and files: the messages, photos and files you send, and the conversations you take part in.
• Invitations: the email addresses of people you invite to a conversation or to a Pro membership.
• Reports and support: what you write when you report a user or a message, or contact us.
• Where you work (Organization plan): if your company has the Organization plan, the country and city you, or your company's owners and admins, choose to enter for you.

Information created when you use the Service

• Account activity: when your account was created, when you were last active, your notification settings, and the people you have blocked.
• Device information: a push notification token for each phone, computer or browser where you turn on notifications, and the device type.
• Purchase information: whether you have a Pro membership, which plan, how it was bought (website, App Store or Google Play) and when it renews or ends. We never receive your card number from the App Store or Google Play; website payments are handled by Stripe.
• Organization plan: if your company has the Organization plan, that you are a member, your role (owner, admin or member), when you joined or were removed, and the company's verified email domains. When a company buys the plan, Stripe also receives the company's name, address and VAT number for the invoice.
• Connected calendar (optional): if you connect your Outlook or Google calendar (Settings → Meetings), the address of that calendar account and the access Microsoft or Google gives us, stored encrypted. We use it only to: see when you, and colleagues whose availability your organisation shares, are busy (start and end times, never what the meetings are about); find times that suit everyone when someone you share a conversation with schedules a meeting with you (they see only the times that suit everyone, never your calendar); create the meetings you schedule in CorrespondR; and answer a meeting invitation when you choose Accept, Maybe or Decline in CorrespondR. You can disconnect at any time, which deletes this access at once.
• Connected OneDrive and SharePoint (optional): if you connect OneDrive and SharePoint (Settings → Files), the address of that Microsoft account and the access Microsoft gives us, stored encrypted. We use it only to: list the files and sites you can open while you pick one to share; show a shared file's name, size, folder, who last changed it and who it is shared with on its card, and keep that up to date; show you whether you can open a file someone shared with you, and its preview; and, only when you choose to send a file as a copy, read that one file once and keep the copy in the conversation like any file you upload; and, if you choose a folder for a file request, save the files people send for it in that folder, then delete them from CorrespondR (a file someone takes back is deleted from the folder too). We never change your other files, or who any file is shared with. If you are a member of a company on the Organization plan, its owners see each copy you send of a file from the company's Microsoft 365 to people at other companies (the file's name and size, who sent it, to which companies and when), and can remove the copy. You can disconnect at any time, which deletes this access at once.
• Technical information: IP address, browser or device type and similar information that is needed to deliver the Service and keep it secure, and error reports when something goes wrong.

Information from sign-in providers

If you sign in with Google, Microsoft or Apple, we receive your name, email address and, where available, your profile photo from that provider. If you use Apple's "Hide My Email", we receive the relay address Apple gives us.

People who are invited but have no account

If a user invites you to a conversation or to a Pro membership before you have an account, we store your email address, who invited you and to what, and send you an invitation email. If you sign up with that address, you are added to what you were invited to. If you do not want the invitation, you can ignore it or ask us to delete it.

We do not collect your device's location, your contacts or your device's advertising identifier, and we do not track you across other apps or websites. The only location information we hold is the country and city entered for the Organization plan, if any.

2. How We Use Your Information

We use personal data to:

• create and manage your account, and tell work accounts and personal accounts apart (based on your email domain);
• store and deliver your messages and files to the people in your conversations;
• send notifications and service emails, such as sign-in codes, invitations and receipts;
• provide and manage Pro memberships and payments;
• keep the Service secure, and handle blocks, reports and suspensions;
• find and fix errors; and
• comply with legal obligations, such as bookkeeping rules.

We do not use your messages or files for advertising, we do not sell personal data, and we do not show advertising in CorrespondR.

Google user data. CorrespondR's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use the calendar information Google gives us only for the meeting features described above. We do not use it for advertising, do not sell it, do not use it to train AI models, and do not let anyone read it, except where you ask us to, where it is needed for security or to follow the law, or where it has been made anonymous and combined for running the Service.

Legal basis. We process personal data because it is necessary to provide the Service you have asked for (contract), because we have a legitimate interest in keeping the Service secure and working (legitimate interests), because the law requires it (legal obligation), or because you have given consent, for example to push notifications.

3. Messages and Content

Messages, files and other content you send are stored so that we can deliver them to the people in the conversation, and so that you and they can read them later on any device.

Other participants in a conversation can see what you share with them, and may keep it even if you later delete your account. People who join a conversation later do not see messages sent before they joined.

What other users can see about you. People in your conversations see your name, email address, profile photo, job title, company and bio, and whether yours is a work or personal account. There is no public directory: other users can only find you through conversations you share or by knowing your email address.

Your company's Organization plan. If your company has the Organization plan, people in your conversations see a Verified badge with your company's name. Your company's owners and admins can see that you are a member, your name, email address, role, when you joined and were last active, and the country and city entered for you. They cannot read your conversations.

Your chat link. If you switch on a chat link (Settings → Profile), anyone with the link can see a public card with your name, profile photo, job title and company, and start a conversation with you. Your email address is not shown on it. You can switch the link off or change it at any time.

Reports. When you report a user or a message, the report, including the text of a reported message, is stored and sent to our team so that we can review them. The person you report is not told who reported them.

You should only share personal, confidential or sensitive information when you are allowed to do so.

4. Who We Share Data With

We use the following service providers to run CorrespondR. They process personal data on our behalf and only as needed to provide their service (what each one handles, and where, is listed on our Security page):

• Vercel (hosting of the website and service, in Frankfurt, Germany)
• Neon (database, in Frankfurt, Germany)
• Cloudflare (storage of uploaded files and profile photos, in Europe)
• Pusher (real-time delivery of messages, in the EU)
• Clerk (sign-in and account security, in the United States)
• Resend (sending emails, in the United States)
• Sentry (error reports, in the EU)
• Stripe (payments on the website)
• RevenueCat (managing subscriptions bought in the phone apps, in the United States)
• Expo, Apple and Google (delivering push notifications to phones)
• Microsoft or Google (only if you connect your calendar: the meetings you schedule are created in your own calendar there, and the invitations are sent from it)
• Microsoft (only if you connect OneDrive and SharePoint: the files you share stay there, and a file you send as a copy is read from there)

If you buy a subscription in the iPhone or Android app, the purchase is made with Apple or Google under their own terms and privacy policies.

We also share information when the law requires it, to protect people's safety or the security of the Service, or as part of a reorganisation, merger or sale of the business, in which case this policy continues to apply to your data.

Transfers outside the EEA. Some providers are located in, or may access data from, countries outside the European Economic Area, such as the United States. In those cases we rely on an EU adequacy decision (including the EU–US Data Privacy Framework where the provider is certified) or the European Commission's Standard Contractual Clauses.

5. How Long We Keep Data

We keep personal data for as long as your account exists, and for as long as needed for the purposes described above.

• When you delete your account, your profile, profile photo, uploaded files, notification devices, blocks and memberships are deleted. Messages you sent in conversations with other people are kept for those people, but are shown as sent by "Deleted user" and are no longer connected to your name or email address.
• Sign-in codes expire after a short time.
• Reports are kept for as long as needed to handle them and to protect users.
• Payment records are kept for as long as Norwegian bookkeeping law requires.
• Error reports are deleted automatically by Sentry after a limited period.

6. Deleting Your Account

You can delete your account at any time in Settings → Profile → Delete account, in the website, the desktop apps and the phone apps, or at app.correspondr.com/delete-account. You confirm with a code sent to your email address.

If you pay for Pro on the website, the subscription is cancelled. If you bought Pro in the App Store or Google Play, you must cancel the subscription in your phone's subscription settings, because only Apple or Google can stop their billing.

7. Your Rights

Under data protection law you have the right to:

• access your personal data;
• correct inaccurate information;
• have your personal data deleted;
• restrict or object to certain processing;
• receive your data in a portable format; and
• withdraw consent at any time, where processing is based on consent.

You can download a copy of your data yourself at any time in Settings → Profile → Download my data, and delete your account there too. For anything else, contact info@correspondr.com. We will answer within one month.

You also have the right to complain to the Norwegian Data Protection Authority (Datatilsynet) or another competent supervisory authority.

8. Security

We protect personal data with technical and organisational measures. All data is encrypted in transit and at rest, and passwords must be long and are checked against known data breaches. Our Security page describes how in more detail.

No internet-based service can guarantee absolute security, but we work to protect your data and will notify you and the authorities of a personal data breach where the law requires it.

9. Cookies and Similar Technologies

CorrespondR only uses cookies, local storage and similar technologies that are necessary to run the Service, such as keeping you signed in and remembering your settings.

We do not use analytics or advertising cookies. If that changes, we will ask for your consent first.

10. Children

CorrespondR is intended for professional use and is not directed at children. You must be at least 18 years old to create an account.

11. Changes to This Policy

We may update this Privacy Policy as CorrespondR develops or when the law requires it.

We will tell you about material changes in the Service or by email. The latest version always shows its effective date.

12. Contact

For privacy questions or requests, contact:

CorrespondR AS
Organisation number: 931 147 765
Address: Turbinveien 40, 0195 Oslo, Norway
Email: info@correspondr.com