Privacy Policy

Who we are

The couver.ai website and Couver Evidence are run by Couver, operating from Namibia. “We” and “us” in this policy mean Couver.

This policy covers this website, email you send us, our clients and prospective clients, our engineering work, and Couver Evidence, our product, including the AI assistants people connect to it. Questions about it go to contact@couver.ai.

This website

The site sets no cookies and runs no analytics, no forms and no third-party scripts. Its fonts are served from the site itself, so loading a page contacts no other service.

The site is hosted by Vercel, which keeps standard request logs: the IP address, the browser, the page asked for and the time. They are used to run and protect the site. The logs available to us are kept for at most a day; Vercel may keep its own records for longer under its privacy policy.

Writing to us

When you write to contact@couver.ai or security@couver.ai, we receive your address and whatever you send. We use it to reply and to keep a record of the correspondence, and keep it as long as the correspondence and our business records need it. Our email provider processes it for us.

Clients and prospective clients

For the organisations we work with or talk to about work, we keep business contact details, contracts and invoices. They are kept for the relationship, and afterwards for as long as tax and accounting law requires.

Engineering engagements

When we build software or systems for a client, any of the client’s data we handle is handled only on the client’s instructions, under the engagement contract. For that data we are the client’s processor.

Why we use it

For this website, email, our client relationships and licence check-ins, we are the controller. We use this information to run and protect the site, to reply and keep records, and to manage licences, because we have a legitimate interest in doing so. We also use it to make and carry out contracts with clients, and to meet tax, accounting and other legal duties.

We do not sell personal information or share it for advertising. We share it only with the providers that run our hosting and email, with professional advisers, and where the law requires.

Couver Evidence

Couver Evidence makes an organisation’s documents searchable, with every result citing its source, for the organisation’s people and the AI assistants they connect.

Who is responsible

• The client organisation is the controller of its documents, accounts and logs. It decides what is connected, who has access and how long things are kept.
• When Couver runs the server, in Couver’s cloud, Couver is the organisation’s processor and acts on its documented instructions.
• On a server the organisation runs, on its premises or in its own cloud account, Couver supplies the software and has no standing access. When the organisation gives Couver access, or a support bundle, to fix a problem, Couver acts as its processor for that work.
• Each client has its own server. No database, search index or storage is shared between clients.

What it holds

• Copies of the files the organisation connects.
• The text and tables read from them, and a search index.
• Accounts: name, work email, role, groups, directory id and last sign-in.
• An audit log of sign-ins, searches, documents opened and changes, with who, when, and from which address and app.
• Diagnostic logs.

AI models

On cloud set-ups, and hybrid ones (the server on the organisation’s premises, with AI models in the cloud), only what each task needs goes to the AI model providers: page images for reading scanned pages and charts, the start and end of a document for its summary and fields, and page text, document titles, file names or folder paths, and searches for search (embeddings and reranking). Fully offline set-ups run every model on the organisation’s server and send nothing.

Couver does not use client data to train or improve models. The terms of the AI model providers Couver uses exclude training on it. Each provider’s retention is in the data-handling annex.

Sub-processors

Couver Evidence uses two kinds of sub-processor: the hosting provider for servers in Couver’s cloud, and the AI model providers on cloud and hybrid set-ups. The named list, with each one’s location and retention, is in the data-handling annex, which we give to clients and prospective clients on request.

Licences

On a server the client runs, Couver Evidence may check its licence online. A check-in may send the licence and install identifiers, the software version and usage counts (such as the number of people, files and storage used). It never sends document content, search words or personal data (information about the people who use Couver Evidence, such as names, email addresses, or what they search and open). Couver uses check-ins only to manage licences.

Retention and deletion

Retention is set for each client. By default the audit log is kept for 365 days and diagnostic logs for 30 days. A file deleted at its source is removed at the next sync, and from backups as they rotate out. When a contract ends, for a server in Couver’s cloud, Couver returns the organisation’s exports on request and destroys the server, its volumes, backups and keys within 30 days. A server the organisation runs stays under its control.

If your information is in an organisation’s Couver Evidence

Contact that organisation: it decides how its data is used, and it answers requests about it. We help it do so.

How the servers are protected is on the Trust & Security page.

AI assistants and connectors

People can use Couver Evidence from AI assistants: the Couver Evidence agent in Microsoft 365 Copilot, ChatGPT, Claude, and other apps that connect over the Model Context Protocol (MCP), or with a personal token. Each one connects to the organisation’s own Couver Evidence server, not to a central Couver service.

Signing in and what the app may do

• The person signs in, through the organisation’s directory or with a Couver Evidence password, and approves the app.
• The app can then only search and read, as that person, and never more than that person may see.
• The person can disconnect it at any time on the Agents page, and the organisation’s owners can block an app.
• When a person signs in through Microsoft, including from Microsoft 365 Copilot, the server receives their name, work email and directory id from Microsoft Entra ID, and their groups where the organisation sets that up.

What is sent where

• The server receives the words of each search and what the app asks to read. It returns only what the person may see, with links to the cited pages.
• The conversation, and the results the app received, are processed by the assistant’s provider (Microsoft, OpenAI, Anthropic or another) under the terms between that provider and the organisation or the person using it. Couver does not receive the conversation.
• Each search and read is recorded in the organisation’s audit log under the person and the app’s name. The organisation chooses whether search words are kept, kept only as a hash, or not kept.

Copies of files

If the organisation allows it, an agent can take a copy of a file into its own workspace, such as its code sandbox at the assistant’s provider, to work on a table or on the file itself. It gets the copy through a link that is checked against the person’s access and expires within minutes. The copy is then kept by the assistant’s provider under its own terms. Organisations can turn this off.

International transfers

Couver works from Namibia, so our own records, and Couver’s access to servers in its cloud, are handled from there. A client’s Couver Evidence server runs in the region the client chooses. On cloud and hybrid set-ups, calls to the AI model providers may be processed in the USA and other countries. Where the law requires a safeguard for a transfer, such as the EU Standard Contractual Clauses or the UK International Data Transfer Agreement, we use one.

Security

We protect personal information with measures suited to the risk. No system is completely secure, so we cannot promise that information will never be lost or reached without permission. How Couver Evidence protects what it holds is set out on the Trust & Security page. Report a vulnerability to security@couver.ai.

Your rights

Depending on where you live, you may have the right to ask for access to the personal information we hold about you, to have it corrected or deleted, to restrict or object to how we use it, and to receive a copy in a portable form. You may also complain to your data-protection authority.

Write to contact@couver.ai. We may need to confirm who you are. We answer within one month, and if a request needs longer, we tell you why within that month. For information held in an organisation’s Couver Evidence, the request goes to that organisation, as above, and we help it answer.

Children

This website and our services are for organisations and are not directed at children. We do not knowingly collect personal information from children.

Changes to this policy

When this policy changes, the new version is posted on this page with the date it takes effect. This version is effective from 18 October 2026.

Contact

Privacy questions and requests: contact@couver.ai. Security reports: security@couver.ai.