Privacy Policy

Who we are

Concord AI ("we", "us") operates getconcord.ai, the open-source Concord MCP server and CLI, and Concord Cloud, the hosted service that lets coding agents on different machines share work-state. We are the data controller for the personal data described here. Contact us about privacy at privacy@getconcord.ai.

Where your organization uses Concord Cloud, the content your agents put into it (tasks, messages, handoffs) belongs to your organization. For that content we act as a processor on your organization's behalf.

What we collect

• Account details: your email address, first and last name, organization name, and, if you choose to give it, your phone number.
• Sign-in data: a password hash held by our authentication provider, or the identity Google returns if you sign in with Google (name, email, profile picture).
• Consent records: when you accepted these terms and this policy, and whether and when you agreed to marketing by email or SMS.
• Workspace content: tasks, task context, decisions, handoffs, agent messages, file paths and repository names your agents send to Concord Cloud.
• Agent and machine metadata: agent identifiers, machine names, client names and versions, and when each was last seen.
• Sign-in records: when you signed up and last signed in, and the IP address each came from.
• Usage and security logs: API requests, the IP address they came from, and rate-limit and error events.
• Billing data, once paid plans launch: plan, seat count and subscription status. Card details are collected and held by Stripe; we never see the full number.
• Open-source telemetry: the Concord MCP server can send pseudonymous usage events. Each event records the IP address and country it came from. You can turn telemetry off in the CLI.
• Waitlist: the email address and answers you give us when you join the waitlist.

Why we use it, and our lawful basis

• To provide Concord Cloud and keep your account working (performance of a contract).
• To secure the service, spot unusual sign-ins, prevent abuse and debug failures (legitimate interests).
• To verify a phone number you give us by sending a one-time code (performance of a contract).
• To send service messages you cannot opt out of, such as security alerts and changes to these terms (performance of a contract and legal obligation).
• To send product news and offers by email or SMS, only if you opted in (consent). You can withdraw consent at any time in Concord Cloud under Settings, or by using the unsubscribe link in any message. Withdrawing does not affect anything sent before.
• To bill your organization for seats, once paid plans launch (performance of a contract and legal obligation).
• To understand how the open-source tool is used and improve it (legitimate interests).

We do not sell personal data, and we do not use workspace content to train machine-learning models.

Who processes it for us

We use these sub-processors. Each is bound by a data processing agreement.

• Supabase: database and authentication for Concord Cloud.
• Google Cloud: hosting for the Concord Cloud API (europe-west1, Belgium).
• Vercel: hosting for getconcord.ai and the Concord Cloud dashboard.
• Neon: database for the waitlist, blog and open-source telemetry.
• Stripe: payments, once paid plans launch.
• An SMS provider, used through Supabase, to deliver verification codes and SMS marketing you opted in to.
• Google, only if you choose Sign in with Google.

Some of these providers process data outside the UK and the European Economic Area, including in the United States. Where they do, transfers rely on adequacy regulations, the UK International Data Transfer Addendum, or the EU Standard Contractual Clauses.

How long we keep it

• Account details and workspace content: for as long as your account or organization exists. When an account is deleted its membership is removed straight away; organization content is deleted when the organization is.
• Consent records: when you accepted these terms and this policy, and when you gave marketing consent, for as long as the account exists. Withdrawing marketing consent removes that record straight away, and we stop sending.
• Sign-in records: your sign-up time and address, and only your most recent sign-in, for as long as the account exists.
• Security logs: up to 90 days.
• Billing records: as long as tax law requires, currently six years.
• Open-source telemetry: currently kept without automatic expiry. We will publish a retention period here when one is set.

Your rights

Under the UK GDPR and the EU GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or move it to another service. Where we rely on consent you can withdraw it at any time. Email privacy@getconcord.ai and we will answer within one month.

If you are unhappy with how we handled your data you can complain to the UK Information Commissioner's Office (ico.org.uk) or to the supervisory authority where you live.

Cookies and local storage

Concord Cloud stores your sign-in session and your theme and organization choice in your browser. These are strictly necessary for the service and need no consent. getconcord.ai uses Vercel Analytics, which does not set cookies, and a Statcounter counter for page views.

Children

Concord is a tool for software teams. It is not meant for anyone under 16, and we do not knowingly collect their data.

Changes

We will post changes here and update the date above. If a change is material we will tell signed-in users and ask them to accept the new version before continuing.