Your data. Your call.

1. Who we are

CORDON is operated by Jan-Willem Bekkers, based in the Netherlands. For questions about this policy, contact us.

2. What we collect

Free tier: We don't ask for an account or email. To enforce the free usage limit and prevent abuse, we store a browser fingerprint and a hashed (non-reversible) version of your IP address server-side. We do not store your prompt content. This data is used only to count usage and rate-limit requests.

Paid tier: We collect your email address and payment status. Payments are processed by Lemon Squeezy. We do not store credit card data at any point.

Prompt content: When you use the tool, your input is sent to Anthropic's API to generate the improved prompt. We do not store your prompt content after processing. Anthropic's own data retention and usage terms apply to this processing. See Anthropic's privacy policy for details.

3. Why we collect it

Your email address is used to deliver account access and transactional messages: payment confirmations and payment failure notices. We do not send marketing emails without your explicit consent.

The lawful basis for processing your email is performance of a contract (your subscription).

4. How long we keep it

We retain your email and payment status for as long as your subscription is active, plus 12 months after cancellation. After that, non-financial account data is deleted. Invoice-relevant data is kept separately for 7 years, as required by Dutch tax law (art. 52 AWR).

5. Who we share it with

We work with the following sub-processors:

• Lemon Squeezy ⋅ payment processing
• Supabase ⋅ database hosting located in Frankfurt, EU
• Anthropic ⋅ AI processing of your prompt content via their API
• Vercel ⋅ hosting and infrastructure
• Resend ⋅ transactional and authentication email

We do not sell data. We do not share it with advertisers.

6. Your rights (GDPR)

You have the right to access, correct, or delete your personal data at any time. To exercise any of these rights, contact us. We respond within 30 days.

You may also file a complaint with the Dutch Data Protection Authority.

7. Cookies and analytics

We use Vercel Analytics to measure page visits and usage patterns. This service collects anonymised data about your visit (pages viewed, referrer, country). No personally identifiable information is collected and no cross-site tracking occurs. Vercel Analytics does not use advertising cookies.

We also set one functional cookie to remember your consent choice. No third-party advertising or social media cookies are placed on this site.

8. Changes to this policy

If we make material changes, we notify paying users by email. The "last updated" date at the top of this page reflects the most recent version.