Privacy policy

Effective October 21, 2026

This policy covers corwenco.com and the Corwen dashboard, the client platform at dashboard.corwenco.com, both run by Corwen LLC, Salt Lake City, Utah. Helen is the marketplace tab inside the dashboard; helen.corwenco.com redirects there. If you have a question about anything here, email info@corwenco.com.

Summary

The marketing site has two forms, one to request a backlog review and one in the builder demo to save an app, and sets no cookies. The builder demo runs in your browser and sends nothing unless you save your app. If you send either form or email us, we keep what you sent. The dashboard stores what you and your firm put into it and what we record about our work for you, so we can do the work you hired us for. We do not sell your information and we do not run advertising. We share it with the services listed below that help us run the site, the dashboard and your projects, with other clients only as described under Helen listings, with our lawyers and accountants, with a buyer of the business as described below, and when the law requires it.

corwenco.com

The marketing site has no account and no cookies. It has two forms: one to request a backlog review, and one in the builder demo to save an app. The backlog review form asks for your name, your work email, your company, its industry and size, and one thing that has been on the list too long, and lets you add a phone number, how you heard about us, and the code from a founding firm card if we mailed you one. What you send goes to the Corwen dashboard, where the people at Corwen read it. We use it to reply to you and to plan the review. If your firm does not become a client, the dashboard deletes the request 12 months after you sent it; if your firm becomes a client, it stays with your firm's records. If you email us instead, we receive your name, your email address and whatever you write, and we keep it in our mailbox with our email provider. Ask us and we will delete either sooner.

Our hosting provider, Cloudflare, processes technical information about each visit, including your IP address, browser type, the page requested and the time, to deliver the site and protect it from attacks. If a page fails to load, your browser may send Cloudflare an error report. We do not receive a record of individual visits. Cloudflare shows us only totals, such as how many requests the site received.

The home page has a demo of the Corwen builder. It runs in your browser and replays example runs recorded from the builder. What you type in it is never sent to the builder or to any AI provider. Unless you save your app, nothing from the demo is sent to Corwen either, and it is gone when you leave or reload the page.

After you press Build in the demo, you can save your app. The save form asks for your name, your business name and your email, and sends nothing unless you tick "Email me about this app, including when accounts open." It then sends those, the example run you played, the answer you picked, the pieces you kept, and the wording of the box you ticked. What you typed in the demo goes with it only if you also tick "Include what I typed in the demo." What you send goes to the Corwen dashboard, where the people at Corwen read it. We use it only to email you about that app, including when accounts open, from info@corwenco.com. We do not add you to a mailing list or use it for anything else. The dashboard deletes it 12 months after you sent it. Reply to any of those emails or write to us to stop them, and we delete what you saved.

The site serves its typefaces from corwenco.com itself. It loads nothing from other websites, except that the backlog review form and the save form talk to the dashboard: when you start filling one in, the page asks the dashboard for a one-time form token, which stops automated posts, and when you send it, the page sends what you entered.

We do not run advertising, analytics or tracking scripts on the site.

The Corwen dashboard

The dashboard is for clients of Corwen. You get an account because your firm hired us, and we create it for you.

What we store

About you: your name, work email, job title, your role on your firm's account (admin or user), whether your account is active, and when it was created.
Your password, as a bcrypt hash. We never store the password itself and cannot see it. You set it yourself from an emailed link and change it on the Account page.
Two-step sign-in, if you set it up: its secret, stored encrypted from the moment setup starts, whether it is on, and the time step of the last code used, so each code works only once. The secret stays stored if you stop before turning it on, and it is shown only to you, once, during setup.
A counter that signs out your other sessions when your password or sign-in settings change.
A record of each time you sign in: when the session started, when it was last used and when it ended. A session ends when you sign out, 14 days after you sign in, or after 3 days unused; for people at Corwen, after 12 hours, or 2 hours unused.
Your firm's name, industry and city, a short identifier for your firm, whether your firm is a current client, the date it stopped being one, and the date we created the record.
Requests you submit: the title, the problem, how it works today and the systems involved, plus who submitted it and when, its status, our reason if we decline it, the build it led to, and the Helen listing it refers to, if any.
Messages between your firm and Corwen, who wrote each one and when, and the last time each person at your firm opened the message thread.
For each build: its name, status, phase, owner, next milestone and start date; build notes; live work sessions and progress updates, with the name of the person working; links to preview versions; the name of its code repository; and our internal notes.
Work logs: the date, hours and summary of each piece of work, technical notes, who logged it, its status, and who reviewed it and when.
The hours ledger: approved hours with the name of the person who did the work, adjustments with their reasons, and referral credits owed to your firm. Ledger entries cannot be edited or deleted, except when all of your firm's records are deleted. Corrections are added as new entries.
Data-flow records: for each build, every system it touches, the kinds of data, whether it reads or writes, why, the vendor, how long the data is kept and who can reach it.
Records of contracts and invoices between your firm and Corwen: the title, type, project and who added the record; for an invoice, its number, amount, phase and the dates it was sent, due and paid; for a document signed in the dashboard, its full text and who was asked to sign it. Other files are not stored.
Needs you items: what Corwen asked your firm to do, answer, check or sign, and your answers, approvals and problem reports.
Workflows we run for your firm: the name, description, schedule, systems involved and time saved, and for each run, when it started and finished, whether it worked, how many items it processed and a short note written by the workflow. Your firm sees all of it. Runs are deleted 12 months after they ran.
Tasks people at Corwen give each other about your firm's work: the title, notes, checklist, replies, who it is for and when it is due. Your firm does not see them.
Links between Helen listings and your firm, if a listing came out of your project, and whether that listing names your firm or is anonymous.
A record of changes made in the dashboard: who made the change, to which record and when, for some changes the new values, and when we download a copy of your firm's records. It does not record sign-ins, page views or messages.
Chat with Corwen conversations: what you and the chat wrote, when, which category each message was sorted into, and the request it filed, if any.
Links to set or reset a password: a fingerprint of each link, when it expires and when it was used. The link itself is only in the email to you.
Electronic signatures on documents you sign in the dashboard: the name you type, the name and email address on your account at that moment, when you signed, your IP address and browser, the wording you agreed to, and a fingerprint of the exact document you signed, so either side can show later what was signed.
Plans: what you asked Corwen to build, your answers to its questions, the plan it wrote with your edits, and the request it became when you sent it.
Sign-in, password reset and account setup attempts, and submissions of the site's backlog review and save forms: the IP address and email address used, kept in the server's memory only, for up to one hour, to limit repeated attempts.
Server error logs, kept by Render for 7 days: the address of the request that failed, its method and the error message.

A build's code repository is never shared with another firm. A build's page can show recent code changes from that repository: the first line of each commit message and the name of the person who made it, read from GitHub. That is turned off today.

We do not store your IP address, except on an electronic signature, as described above. Our hosting providers process it to deliver each page.

What we use it for

Doing your projects, showing you what we did and how many hours it took, answering your requests and messages, keeping your account accurate and secure, and keeping records we need for accounting or legal reasons. If a workflow we build for your firm becomes a Helen listing, its description is also shown to other clients, as described below. We do not use your information for anything else.

Helen listings

Helen is the marketplace tab of the dashboard, where clients see workflows we can license or rebuild for them. A workflow that came out of your build may be listed there. A listing shows your firm's name, or your firm's industry and city, only if your firm has agreed in writing. Otherwise it says nothing about your firm. In a small market, industry and city may be enough to identify you. A listing never includes your firm's data. If a workflow from your build is licensed to another client, your hours ledger shows the referral credit and the listing name, not who licensed it.

Cookies

The dashboard sets two cookies when you sign in: __Host-helen, which holds your user ID, the ID of your session and your sign-in state, and __Host-helen.sig, a signature that shows we issued it. Both are HttpOnly, Secure and SameSite=Lax, and only dashboard.corwenco.com can set or read them. If your account uses two-step sign-in, the cookie set at the password step holds only a pending user ID until you enter the code. They expire 14 days after you sign in, change your password or turn on two-step sign-in, and are removed when you sign out. The session they name can end sooner on our side, as described under What we store, and signing out ends it there too, so a copy of the cookie stops working. Nothing is set if you do not sign in. They are required for the dashboard to work. There are no analytics or advertising cookies.

Who can see it

Everyone at your firm with a dashboard sign-in sees all of your firm's information in the dashboard, including hours, referral credits, contracts, requests, data-flow records and the full message thread. There is no per-person restriction: the admin and user roles see the same things. Our internal notes, technical notes, repository names, work logs we have not approved and the record of changes are not shown to your firm. You can ask us for a copy of all of it.

People at Corwen see the information of the clients they work for. Corwen's owner decides, person by person, which clients each person at Corwen can see and what they can do there, for example approve hours, manage documents, or manage the people at a client. A client can be restricted to named people at Corwen, and nobody else at Corwen sees it. Every Corwen account must use two-step sign-in. People at Corwen who build your project can connect a Claude Code plugin to the dashboard with a personal key: it reaches the same clients its holder does, can post progress updates and versions to your project, and stops working after 90 days or when its holder's password or email changes.

No client can see another client's builds, hours, requests, messages, contracts or data-flow records. The only thing other clients can see about your firm is a Helen listing, as described above.

Signing in

You choose your own password. When Corwen adds you, the dashboard emails you a link to set it, and Forgot your password? on the sign-in page emails you a link to reset it. Nobody at Corwen can see, set or reset your password. You change it on the Account page. Two-step sign-in, a code from an authenticator app, is available to every user on the same page. A person at Corwen who manages your firm's people can reset your two-step sign-in, for example if you lose your phone; that signs you out everywhere and is recorded.

Who else handles it

Render runs the dashboard, in the United States. Render routes all traffic through Cloudflare's network, so Cloudflare handles each request, including your IP address.
Neon (Databricks) runs the dashboard's database, on Amazon Web Services in Ohio. Neon keeps a change history for recovery, 6 hours back today, and we take one snapshot of the database a day, which is kept for up to 24 hours.
Render and Neon handle this data under their standard data processing terms, which limit their use of personal data to providing their services to us. They also keep their own operational, usage and security records.
GitHub holds the source code for the dashboard and for the builds we make for you, in private repositories. Client data does not go in them, by rule. When a build's page shows recent code changes, it reads them from GitHub.
Resend sends the dashboard's emails. To you: the link to set up your account, which names your firm, the link to reset your password, and a notice to your old address when your sign-in email changes, which names the old and new addresses. To people at Corwen: emails about their work, which can name your firm and project and include task notes and replies. Resend receives the name, email address and content of each email.
Anthropic provides the Claude models people at Corwen use as tools to build your project, the way a developer uses an editor. Today that is a Claude subscription under Anthropic's consumer terms. We are moving it to Anthropic's commercial terms, which do not allow training on the data. Our Claude Code plugin connects those tools to the dashboard, so your firm's name, your project names and phases, and the progress updates we post to your project pass through Claude. Apart from that, we do not put your firm's dashboard data, your customers' records, tax return information or patient information into those tools. The dashboard itself sends nothing to Anthropic or any other AI provider today. We do not have zero data retention with any provider.
Our email provider holds the email you send us.

We share your information with the services above, and with other clients only as described under Helen listings. We may also disclose it when the law requires it, such as under a subpoena or court order, and to our lawyers and accountants, who must keep it confidential. If Corwen is sold or merges, client information would pass to the new owner under this policy, and we would tell you before it does.

We do not sell personal information and have not in the past. We do not share it for cross-context advertising.

How long we keep it

For as long as your firm is a client, and up to two years after. When your firm stops being a client, we record the date. The dashboard lists firms two years past that date as due for deletion, and a Corwen founder deletes them. Workflow runs are deleted 12 months after they ran, and ended sessions and used or expired password links 30 days after. Nothing else is deleted automatically.

If you want your firm's records removed sooner, email us. Within 30 days we send you an export of all of your firm's dashboard records as a file and then delete them from the dashboard. Deletion removes everything the dashboard holds about your firm, including the hours ledger, except a record that your firm's records were exported and deleted, which holds no name and no details. Helen listings that came from your builds stay in Helen, with no link to your firm. Before deleting, we keep a copy of your invoices and signed agreements, including documents signed in the dashboard with their signature records, outside the dashboard, for as long as tax and legal rules require.

Some copies remain for a short time after deletion: the database's recovery history (6 hours today) and its daily snapshot (up to 24 hours), server error logs (7 days), what a provider listed above keeps under its own retention, working files on our computers, including records of our sessions with AI tools, and the export file until we have delivered it to you.

If someone leaves your firm, email us and we will deactivate their account. We can also anonymize it: their name becomes "Former user", their email address and title are removed, the account can never sign in again, and their message read times are deleted. Messages and requests they wrote stay in your firm's record under "Former user". Documents they signed keep their signature record, with the name they typed, their IP address and browser, for as long as your firm's records are kept.

Chat with Corwen

The dashboard has a chat box called Chat with Corwen. Today it runs on rules inside the dashboard: it sorts what you write into a category, answers from your firm's records, and files requests for the people at Corwen to review. Nothing you type there goes to any outside AI provider. We store the conversation with your firm's records, and the people at Corwen can read it. If that changes, this page will say so before it does.

Plans

In the dashboard you can describe a project in your own words. Corwen asks a few questions and writes a plan for you to edit and send. Today the plan is written by rules inside the dashboard. Nothing you type there goes to any outside AI provider. We store what you write and the plan with your firm's records, and the people at Corwen can read it, including plans you have not sent. If that changes, this page will say so before it does.

Your business data during a project

Doing your project usually means we work inside your systems (your email, files, CRM, books, or industry software) and handle your customers' or clients' information. Before work starts, we agree the scope in writing with your firm: the systems we work in and the kinds of data involved. These are the rules we follow. Project details you put in the dashboard are covered by this page.

Do not put your customers' personal, health, tax return or financial account information in dashboard requests or messages.
Workflows we build for you report their runs to the dashboard. We write them so their run notes do not include your customers' personal information.
Every build has a data-flow record before it goes live: what data goes where, why, which vendor, how long it is kept and who can reach it. You can read and print it on the build's page. The dashboard does not let us mark a build live without one.
Where a build sends your data to a language model, it does so only after we have discussed it with your firm and approved it. We use commercial API access, never a consumer chatbot subscription, and the build's data-flow record names the provider and how long it keeps the data. We do not have zero data retention with any provider.
Patient health information: none goes into any Corwen system until business associate agreements (BAAs) are in place with your practice and with every vendor involved. None are in place today, so do not send us patient health information by any channel.
Tax return information: we use it only to do the work your firm asked for, and never for our own purposes, for marketing, in Helen listings or to train any model.
Law firms: we work at your direction and under your supervision, keep what you share confidential, and treat privileged material as privileged.

Your choices

You can ask us what we hold about you or your firm, ask us to correct it, or ask us to delete it. Email info@corwenco.com.
You can change your password and turn on two-step sign-in on the Account page.
You can stop using the dashboard at any time. Only people at Corwen can deactivate users. To deactivate someone at your firm, email info@corwenco.com. It takes effect as soon as we make the change.
Blocking the __Host-helen cookies means you cannot sign in.

Do Not Track

We do not track you across other websites, and neither the site nor the dashboard runs advertising or analytics scripts. Because there is no tracking to turn off, neither one responds differently to a browser's Do Not Track or Global Privacy Control signal. Cloudflare, for hosting, receives your IP address and browser details when you load our pages, as described above.

Children

Our website and dashboard are for business users and are not directed to children. We do not knowingly collect information from anyone under 18 through them. Client data we handle during a project may include information about minors, such as dependents on a tax return, and the rules in the section above govern how we handle it.

Changes

We post every new version of this policy on this page with a new effective date. If we make a material change, we email every active dashboard user, and everyone who saved an app from the builder demo, from info@corwenco.com before it takes effect. Small wording changes will just update the date.

Contact

Corwen LLC, Salt Lake City, Utah
info@corwenco.com