Download

Privacy Policy

Last updated: 20 October 2026

1. Introduction

This Privacy Policy sets out how we, Phoebe Technology Limited ("Coral," "we," "us," "our"), collect and process your personal data and explains your rights in relation to your personal data.

This Privacy Policy covers:

  • our website at withcoral.com and related sites (the "Website");
  • Coral Desktop, our desktop application for running Coral on your own computer ("Coral Desktop"), and the Coral Shared Server, which your organization runs on its own infrastructure for a team (the "Shared Server") (together, the "Software"); and
  • our open source community, including our GitHub repositories, our Slack and Discord channels, and our contributor license agreement.

The Software is licensed to you under its own license terms, which govern your use of the code. This Privacy Policy only covers personal data that we collect or process.

Coral's registered office is at 9th Floor, 107 Cheapside, London, EC2V 6DN, United Kingdom. If you have any questions about this Privacy Policy or wish to exercise any of your rights in relation to your personal data, you can contact us at the address above or by email at privacy@withcoral.com. Our preferred contact method is email.

This Privacy Policy affects your legal rights, so please read it carefully.

We may update this Privacy Policy from time to time at our discretion and in particular to reflect any changes in applicable laws. If we do so, and the changes substantially affect your rights or obligations, we will take commercially reasonable measures to notify you (for example, by email or a notice on our website). Otherwise, you are responsible for regularly reviewing this Privacy Policy so that you are aware of any changes.

We are the controller of personal data we collect about you directly, for example when you visit our Website, contribute to our open source projects or contact us. This includes details your employer gives us because it is our customer, for example to manage its enterprise license or support.

Coral Desktop and the Shared Server run on your own computer or your organization's infrastructure. We do not receive the data they access, and we are neither controller nor processor of that data. If your organization runs a Shared Server, your organization is responsible for the user accounts, shared credentials and activity records held on it. If you or your organization choose to share data with us for support, such as trace data, we use it only to provide that support.

Our Website and services are not intended for children, and we do not knowingly collect data relating to children.

Our Website and Software may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and disclaim responsibility for their privacy statements. When you leave our Website, we encourage you to read the privacy policy of every website or service you visit.

2. What personal data do we collect and from whom?

By "personal data," we mean any information that can identify you, such as your name, email address, phone number(s), or a photo you upload. We reserve the right to anonymize such personal data so that it is no longer personally identifiable and to use it in anonymized form for our internal business purposes, insights, or other purposes from time to time.

Please do not send us special categories of personal data, such as information about your health, religion or ethnicity. We do not need it to provide our services.

2.1 Data you provide to us

You may provide personal data to us if you:

  • use our Website;
  • register interest in our products;
  • buy an enterprise license or support;
  • contribute to our open source projects, for example by opening issues or pull requests, posting in discussions, or signing our contributor license agreement (CLA). The CLA records your name, email address, postal address, country and GitHub username. The Corporate CLA records the signer's name, title and signature, and your organization's name, address and contact details;
  • join our community channels on Slack or Discord;
  • apply for a job with us;
  • provide services to us;
  • subscribe to receive product update emails from us; or
  • otherwise contact us with queries, comments, or complaints.

You may provide personal data to us directly through our Website or via social media platforms, or through colleagues or your employer (for example, if they name you as a contact for their enterprise license). We will process all such personal data in accordance with this Privacy Policy. Certain personal data is mandatory for us to be able to provide certain services (for example, issuing an enterprise license), and we will make this clear when we collect it. If you fail to provide any data marked as mandatory, we may not be able to perform the service or fulfil your request.

If you contact us by email or post, we may keep a record of the correspondence, and we may record any telephone call we have with you.

2.2 Data we automatically collect about you

When you use our Website, we automatically collect and store information about your device and your activities. This may include:

  • technical information about your device (e.g., browser type, operating system, device type);
  • your IP address;
  • your preferences and settings (e.g., time zone, language);
  • usage details, such as pages visited, time spent on pages, referring URLs, and which features you interact with; and
  • analytics data collected by third-party tools we use to understand how our Website is used (see Section 11: Cookies Policy below).

Some of this information is collected using cookies and similar tracking technologies. Please see Section 11 (Cookies Policy) for full details about the cookies we use, their purposes, and how you can control them.

When Coral Desktop checks for and downloads updates, it connects to GitHub, which hosts our releases. If your organization runs a Shared Server, it downloads our container images from GitHub in the same way. GitHub receives your IP address and technical details such as the version and operating system under its own privacy terms. We do not receive this information. Coral does not send us telemetry. You can choose to send Coral's metrics, traces and logs to an OpenTelemetry endpoint of your own; if you do, they go only to the endpoint you set, and request and response contents are never included.

2.3 Data sources you connect to Coral

When you connect Coral to your data sources (for example GitHub, Slack or Google), the connection runs from your own computer or infrastructure. Credentials are stored encrypted in your Coral installation, and the data Coral retrieves stays there. Neither is sent to us.

If your organization runs a Shared Server, you sign in to it through your organization's own identity provider, not through us.

2.4 Data we receive from others

We may receive personal data about you from a colleague, employer, or supplier, for instance, to add you as a contact for your organization's enterprise license or support. If a colleague or employer provides us with your personal (non-work) email address without your consent, please contact us, and we will remove it.

If you apply for a job with us, we may receive personal data about you from your previous employer(s) or other references you provide.

3. Lawful use of your personal data

We will only use your personal data where we have a lawful basis to do so. The lawful bases we rely on under this Privacy Policy are:

  • Consent — for example, when you accept analytics cookies on our Website or opt in to marketing communications.
  • Performance of our contract with you, your employer, or your colleague.
  • Compliance with legal obligations.
  • Legitimate interests — i.e., our legitimate business interests in the normal running of our business, provided your rights and interests do not override them.

How we use your personal data depends on why we collected it.

3.1 Using data from your employer when it is our customer

If we have received your personal data because you are employed by or collaborate with a company that buys an enterprise license or support from us, we will process that personal data to perform our contract with your employer or colleague or to take steps at their request prior to entering into or updating such a contract. This typically includes managing the license, providing support and contacting you about the account.

3.2 Using data you share with us for support

If you share trace data, logs or other information with us to get help with Coral, we use it only to investigate and resolve your issue, and we delete it as set out in Section 10.

3.3 Using data for our legitimate interests

We may also use your personal data for our legitimate interests, such as ensuring compliance with relevant regulations, fraud prevention, audit processes, or to notify you about changes to this Privacy Policy or our services.

3.4 Using data for product update emails (marketing)

We may use your contact details and Website usage data to form a view on what products, services, or offers may be relevant for you. You will receive these communications only if you have consented or if we are otherwise legally permitted to do so (e.g., you have an existing relationship with us and have not opted out).

You can ask us to stop sending marketing messages at any time by clicking the unsubscribe link in any marketing message or by contacting us directly. If you ask us to remove you from our marketing list, we will keep a record of your name and email address to ensure we do not send you further marketing emails. We will continue to send transactional or service-related emails if you, your employer, or a colleague has an enterprise license or support agreement with us.

We will also obtain your express opt-in consent before sharing your personal data with any third party for marketing purposes.

3.5 Using data to improve our Website

We analyze user interactions with our Website (e.g., pages visited, session duration, feature usage) using analytics tools including Google Analytics and PostHog to improve, optimize, and develop our services. We do so under our legitimate interest in enhancing user experience and maintaining a competitive service, subject to your cookie consent preferences (see Section 11).

3.6 Using data to process job applications

If you apply for a job with Coral, we will use the personal data you provide to process and assess your application, communicate with you about the status of your application, and respond accordingly.

3.7 Using data from open source contributors

If you contribute to our open source projects, we use your personal data to review and manage your contributions, to communicate with you about them, and to keep a record of the rights you grant us under the CLA. To keep this record, we rely on performance of the CLA, our contract with you. For other contributions, such as issues and discussions, we rely on our legitimate interests in running the project.

Your contributions, GitHub username and any name and email address in your commits are public on GitHub and form a permanent part of the project's history.

3.8 Change of purpose

We will only use your personal data for the purposes for which we collected it. If we need to use it for a new purpose that is compatible with the original one, we will update this Privacy Policy accordingly. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so.

4. Who do we share your data with?

For our legitimate interests or to perform our contract with you or your employer/colleague, we may share your personal data with:

  • Analytics providers: We use Cloudflare Zaraz as our tag management and consent layer, and we may route analytics data to providers such as Google Analytics (operated by Google LLC) and PostHog. These providers may process data such as IP addresses, device information, and browsing behavior on our behalf. Google may process data in the United States; PostHog processes data in the European Union. See Section 11 for further detail.
  • GitHub, which hosts our open source repositories, issues and software releases (including Coral Desktop updates and Shared Server images) and processes CLA signatures. GitHub stores trace data you choose to share with us.
  • Cloudflare stores the CLA signatures processed by GitHub.
  • Mintlify, which hosts our documentation at withcoral.com/docs.
  • Slack and Discord, which host our community channels. They handle what you post there under their own privacy terms.
  • Service providers, sub-contractors, and agents we engage to perform functions on our behalf (e.g., hosting providers, payment providers, IT service providers, accountants, auditors, lawyers).
  • Public authorities or legal advisors if we are required to do so by law or if it is necessary for legal or compliance purposes (e.g., to prevent fraud or meet anti-money laundering obligations).
  • Parties involved in a merger, sale of assets, financing, or acquisition of all or a portion of Coral's business.

Our service providers, sub-contractors, and agents will only receive personal data relevant to their role in providing services to us, and we require them to securely delete or anonymize your personal data once they no longer provide services to us.

When you use Coral with an AI agent or assistant, Coral returns results directly from your computer or infrastructure to the agent you choose. That agent's provider handles the data under its own terms, not ours.

5. Where we hold and process your personal data

Some or all of your personal data may be stored or processed outside of the United Kingdom (UK) or the European Economic Area (EEA). For example, our servers or those of our service providers may be located in countries outside the UK or EEA.

Whenever we transfer your personal data outside of the UK or EEA, we ensure a similar degree of protection is afforded to it by ensuring appropriate safeguards, such as:

  • Transferring to countries that have been deemed to provide an adequate level of protection by the relevant authority; or
  • Using specific, approved contracts such as the UK's International Data Transfer Agreement (IDTA) or Addendum, or the European Commission's Standard Contractual Clauses (SCCs).

Please contact us if you would like further information on specific mechanisms used when transferring your personal data outside of the UK or EEA.

6. How Coral handles your data

All versions of Coral run on your own computer or your organization's infrastructure. Coral connects to your data sources directly. Your credentials, query results, saved functions, access policies and run history stay in your environment and are not sent to us. Coral uses this history to improve how it answers your requests over time, and that learning also stays in your environment.

6.1 Coral Desktop

Coral Desktop is for one person and does not ask you to sign in. It keeps running in the background after you close its window, so your agents can still reach it. It stores its data, including your provider credentials in encrypted form, in its own data folder on your computer. Uninstalling Coral Desktop does not delete that folder; delete it yourself if you want the data removed. Coral Desktop downloads updates from GitHub, as described in Section 2.2.

6.2 Coral Shared Server

Your organization runs the Shared Server in its own containers and on its own domain. People sign in through your organization's identity provider. The Shared Server stores its data in a database your organization chooses, and provider credentials are encrypted with a key your organization controls. Workspace owners decide which operations people can use and whether provider credentials are shared within a workspace.

Your organization is responsible for the personal data held on its Shared Server. We cannot access it. If you have a question about that data, please contact your organization.

7. Security

We process your personal data in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage. We achieve this by using technical and organizational measures (e.g., encryption, secure servers, access controls, employee training).

We are certified to ISO/IEC 27001.

However, no system is completely secure. In the event of a data breach, we will take prompt steps to minimize the impact and notify the relevant authorities and affected individuals where legally required.

If you find a security vulnerability in Coral, please report it privately to security@withcoral.com as described in the SECURITY.md file in our repository, rather than opening a public issue.

8. Automated decision-making

We do not use your personal data for automated decision-making or profiling that produces legal effects or similarly significant effects concerning you.

9. Your rights

Under applicable data protection legislation, you have the following rights (though please note that these rights may not be absolute and can be subject to conditions):

  • Right of access: Obtain a copy of your personal data we hold.
  • Right to rectification: Request correction of any inaccurate or incomplete personal data.
  • Right to portability: Request the transfer of your personal data to another service provider.
  • Right to restriction of processing: In certain circumstances, request that we limit how we process your data.
  • Right to be forgotten: Request that we delete your personal data where it is no longer necessary for us to retain it.
  • Right to object: Object to processing based on legitimate interests, including direct marketing.
  • Right to withdraw consent: Where we rely on consent as the legal basis (e.g., analytics cookies), you may withdraw your consent at any time. This does not affect the lawfulness of processing carried out before withdrawal.

You will not typically be charged a fee to exercise these rights, but we may charge a reasonable fee or refuse to comply if a request is clearly unfounded, repetitive, or excessive.

We may need additional information to verify your identity before we can address your request, as a security measure. We will try to respond to all legitimate requests within one month, but it may take longer if your request is particularly complex or if you have made multiple requests. We will notify you if we need more time.

We do not hold data that Coral accesses on your computer or your organization's infrastructure. For that data, including anything held on a Shared Server, please contact the organization that runs Coral.

If you have contributed to our open source projects, we can remove your details from our own records, but we usually cannot remove your contributions or commit details from the public project history.

If you have any complaints regarding this Privacy Policy or our handling of your personal data, please contact us. We will investigate and respond as soon as reasonably possible. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK (www.ico.org.uk) or with your local data protection authority if you are outside the UK.

10. Retention of personal data

We retain personal data in accordance with applicable laws and only as long as necessary to fulfill the purposes for which it was collected or to comply with legal, audit, or statutory requirements (e.g., HMRC requirements).

  • If we have received your personal data because you are an employee of a customer, we will typically retain your personal data until we no longer do business with your employer.
  • Support data, such as trace data you share with us, is stored in GitHub and deleted after 24 months.
  • CLA records are kept for as long as we distribute the contributions they cover.
  • Website analytics data collected via Google Analytics is retained in accordance with Google's data retention settings, which we have configured to 14 months. PostHog analytics data is retained for 1 year.

In some cases, you can request that we delete your data (see Section 9 above).

We may anonymize your personal data for research or statistical purposes, in which case we may use it indefinitely without further notice to you.

11. Cookies Policy

11.1 What are cookies?

Cookies are small text files that a website places on your device. Some are needed for the site to work; others help us understand how visitors use it.

11.2 How we use cookies

We use cookies and similar technologies on withcoral.com and related sites for the following purposes:

Strictly necessary cookies

These cookies are required for the website to function and cannot be switched off. They are usually set in response to actions you take, such as setting your privacy preferences or filling in forms. You can set your browser to block these cookies, but some parts of the site may not work as a result.

Analytics cookies

These cookies allow us to count visits and understand how visitors move through our site, which helps us improve it. Google Analytics reports this information to us in aggregate. PostHog records individual page views and interactions against a random identifier, not your name. If you do not allow these cookies, we will not know when you have visited our site.

Marketing cookies

We do not currently use marketing or advertising cookies. If this changes, we will update this policy and obtain your consent before setting such cookies.

11.3 Cookie consent

When you first visit our website, you will be presented with a cookie consent banner that allows you to accept or reject non-essential cookies (including analytics cookies). Analytics technologies are only loaded if you provide your consent.

11.4 How to control cookies

In addition to our cookie consent tool, you can control and delete cookies through your browser settings. Most browsers allow you to refuse cookies or delete existing cookies. Please note that if you block all cookies, some parts of our website may not function properly.

11.5 Third-party analytics services

Cloudflare Zaraz: We use Cloudflare Zaraz to manage consent and load approved third-party analytics tools on our website. Cloudflare's privacy policy is available at https://www.cloudflare.com/privacypolicy/.

Google Analytics: We use Google Analytics, a web analytics service provided by Google LLC. Google may store this data on servers in the United States. Google Analytics 4 does not log or store IP addresses. Google's privacy policy is available at https://policies.google.com/privacy.

PostHog: We use PostHog for product analytics. We use PostHog Cloud (EU), which processes and stores data within the European Union. PostHog's privacy policy is available at https://posthog.com/privacy.

12. General

If any provision of this Privacy Policy is held by a court of competent jurisdiction to be invalid or unenforceable, that provision shall be construed to reflect its intended effect, and all other provisions will remain in full force and effect.

This Privacy Policy and any dispute arising out of or related to it (including any non-contractual dispute or claim) will be governed by and construed in accordance with the laws of England and Wales.

13. How to contact us

You can contact us at any time with questions, comments, or requests regarding your personal data or this Privacy Policy by emailing privacy@withcoral.com or writing to us at:

Phoebe Technology Limited9th Floor107 CheapsideLondon, EC2V 6DNUnited Kingdom