Privacy Policy

Bufr AI LLC ("we," "us," or "our") operates Copa Said It at copasaidit.com, a platform that helps separated parents communicate through AI-assisted tone moderation and shared case records. This Privacy Policy explains what information we collect, how we use it, and your choices.

Copa Said It was previously named Bufr. Accounts created under the Bufr name are the same accounts for the same service; only the product name has changed.

Information we collect

• Account information: name, email address, password (stored hashed), timezone, and optional phone number.
• Co-parenting content: messages you send through Copa Said It, including original drafts and moderated versions; extracted calendar events, expenses, decisions, and action items; case metadata such as children's first names.
• Billing information: subscription status and Stripe customer identifiers. Payment card details are processed by Stripe and are not stored on our servers.
• Usage and device data: push notification tokens (if you use the mobile app), feedback you submit, and standard server logs (IP address, browser type, timestamps).
• Error and performance telemetry: we use Sentry for application error monitoring and may use Vercel Analytics / Speed Insights for aggregated traffic and performance metrics. These tools receive technical metadata (for example URLs, device/browser class, and error stacks). We configure them to avoid intentionally sending message content or children’s names; treat any residual path or query data on case routes as sensitive and subject to our access controls. See also our service-providers list below.

How we use your information

• Provide the service: deliver moderated messages, maintain shared case records, and send invites, verification emails, and weekly digests.
• Process messages with AI to screen off-topic content, rewrite hostile language, and extract structured records.
• Manage subscriptions, trials, and account security (including optional two-factor authentication).
• Improve the product based on aggregated usage patterns and feedback you provide.

AI processing

Message text is sent to Anthropic's Claude API for screening, tone moderation, and structured extraction. Anthropic processes this data as our subprocessors under their terms and privacy policies. We do not use your messages to train public AI models.

Who can see your information

• Your co-parent: moderated messages and shared case records within your case.
• Invited attorneys: read-only access to case history and exports when a parent invites them. Attorneys cannot send messages through Copa Said It.
• Attorney partner referrals: if you register through an attorney partner link, we retain the partner code attribution for billing and payout audit purposes.
• Service providers: Stripe (payments), Resend (email), Anthropic (AI), Vercel (hosting and optional Analytics / Speed Insights), Sentry (error monitoring), and our database provider process data on our behalf under contractual obligations.
• We do not sell your personal information.

Exports and record scope

Copa Said It offers case exports in multiple formats. What appears in an export depends on who requests it:

• Parent exports show delivered messages as they appeared in the thread. Your own pre-moderation drafts may appear when Copa Said It rewrote a message you sent. Co-parent pre-moderation drafts and Copa Said It coaching notes on their messages are omitted.
• Attorney exports (when invited by a parent) may include fuller records for case preparation, including original drafts where stored.

Export integrity digests are computed from stored records; audience-specific redaction applies only to the exported view, not to underlying case storage accessible to authorized roles.

Data retention

We retain account and case data while your account is active and as needed to provide the service. You may request account deletion by contacting support@bufrai.com. Some records may be retained where required by law or for legitimate business purposes (e.g., billing disputes). Partner referral attribution and payout audit records may be retained for tax, accounting, and dispute resolution even after account closure.

Security

We use industry-standard measures including encrypted connections (HTTPS), hashed passwords, HTTP-only session cookies, rate limiting, and access controls that enforce case membership and subscription status on every request.

Your rights

Depending on your location, you may have rights to access, correct, delete, or export your personal data. Contact us at support@bufrai.com to exercise these rights.

Children

Copa Said It is intended for parents and legal professionals, not for use by children under 13. We collect children's first names only as case labels provided by parents.

Changes

We may update this policy from time to time. Material changes will be posted on this page with an updated date.

Contact

Questions about this policy: support@bufrai.com