Privacy policy

What personal data we collect when you use Coritan, why we collect it, how long we keep it, and how to reach us about it.

How Coritan LLC collects, keeps and protects personal data.

Last updated 19 October 2026

Coritan LLC (“we”, “us”, or “our”) is committed to protecting the privacy of personal data processed in connection with our services.

We collect and process personal data only as necessary for the performance of our contractual obligations, compliance with legal requirements, and our legitimate business interests. We do not sell personal data to third parties.

What we collect

Your account: Your name, email address, company and country, and a one-way hash of your password. The settings you choose, such as two-factor authentication, your sessions and your API keys.
Billing: Your invoices, payments, credit balance and refund requests. For a saved payment method we keep a token from the payment processor, its brand, the last four digits and the expiry date. Your full card number goes to the processor and not to us.
What you run on our services: The servers, websites, domains, DNS records, mailboxes, files and settings you create, and the logs they produce.
Support and enquiries: Your conversations with us, with their attachments, and what you write in the contact, sales and Under attack forms: your name, email address, phone number, company, the page you sent it from, and the address and browser details your device sends.
Visits: The pages you open, your IP address, your browser and device, your screen size, language and time zone, the page that sent you, any campaign tags and ad click ID on the link, and an approximate location (country, region and city) worked out from your IP address. A random identifier in the _ct_sid cookie groups the pages of one visit. The _ct_vid cookie recognises a returning browser, and a one-way hash of your IP address, browser and language recognises a visitor whose browser has no such cookie. The _ct_attr cookie keeps the link or search that brought you here. When you sign up or sign in, we link the visit to your account.
Checks on forms: When you sign in, sign up, reset a password, place a free order or send a contact form, we check that a person is filling it in. The check is our own, called Wicket, and it runs on our servers. It reads your IP address, your browser and system, your screen size, time zone and language, your graphics hardware, your fonts and plugins, how a test image draws, how long the check took and how you ticked its box. It sets no cookie and keeps nothing in your browser. We keep daily counts for 400 days, by country, browser and system. We keep a record of each check for 90 days to train the check: your country, the kind of network, your browser and system family and one-way hashes that change every day, and never your IP address or your browser string. If you send a report with Having trouble?, we keep it for a year.
Mail from a free mailbox: To stop spam sent from free coritan.gg mailboxes, we check each message such a mailbox sends before it leaves, and keep a short record of it for 8 days: when and how it was sent, how many people it went to, the first 120 characters of its subject and the domains it links to. We never keep the message itself. Our staff read these records only when a mailbox is paused or held for its sending.

Why we use it

To provide the services you order and to bill for them.
To keep accounts and our network safe: sign-in checks, payment checks and abuse checks.
To answer your questions and your enquiries.
To count visits and see which pages people use.
To tell which links and campaigns bring sign ups and orders, and to measure our advertising on the platforms named under Who we share it with, if you accepted the cookies they need.
To meet legal duties, such as keeping accounting records.

We share personal data only with the companies that help us provide the services, and only what each one needs:

Payment processors, which take your payment and tell us whether it worked.
A delivery partner that carries the mail sent through our shared sending pool.
A domain registrar, when you register or transfer a domain, which needs the details you enter for the registrant.
Cloudflare Turnstile, only if our own check is not available and a form uses it in its place. It checks that a person is filling in the form.
Google Analytics, Google Ads, Meta, TikTok, Microsoft Advertising, Reddit and X, which measure visits and ads on the public site. They receive a cookie identifier only if you accepted their cookies, and your hashed email address after an order or a sign up only if you accepted advertising cookies. If you did not accept them, only Google Analytics and Google Ads receive page views and a count of orders and sign ups, with no cookie, identifier or personal data.
Hosting and network providers that run the machines, links and facilities our services use.
Authorities, when the law requires it.

How long we keep it

Personal data is stored securely and retained only for as long as necessary to fulfil the purposes for which it was collected or as required by applicable law. These are our standard periods:

Visits: We keep page views for 90 days and visits for 180 days.
Mail records: We keep the records of mail from free mailboxes for 8 days, and the per-message mail events of the mail platform for 90 days.
Logs: We keep audit logs and service events for 365 days, and the activity log of commands run on a server for 540 days.
Billing records: We keep email logs and payment attempts for 730 days. We keep invoices, payments and the credit ledger for as long as the law requires us to keep accounting records.
Everything else: We keep it until you delete it or close your account.

We may keep a record longer when we need it to answer a payment dispute or an abuse report, or when the law requires it.

Your choices and rights

You can ask us for a copy of your personal data, ask us to correct it or ask us to delete it. Write to privacy@coritan.com and say which account it is about.

Our staff delete an account for good when you ask. We can do it only when nothing live is left on it: every service ended, every invoice settled, no credit balance, no open refund request and no open payment dispute.

What we delete: Your sign-in details, API keys, sessions and second factor, your team, your sign-up mailboxes and their mail, your support conversations, your saved payment methods, and your email and analytics history.
What stays: Invoices, payments and the credit ledger, which the law requires us to keep. They stay under an account number that carries no name, email address or password. Records of payment disputes and the evidence we keep for abuse reports stay until their retention periods end.

After we delete an account, nobody can sign in to it.

Cookies and browser storage

The cookie policy lists the cookies and browser storage coritan.com uses, and says how to change your choice about analytics and advertising cookies. The data processing terms cover personal data that you keep on our services.

Contact

For data protection enquiries, contact: privacy@coritan.com