CORA Privacy Policy

1. Who we are

Data controller: Horizon Labs (“we”, “us”).

Privacy contact: contact@horizon-labs.io

This policy explains how we collect, use, store, and protect personal data when you register for CORA beta access, download the installer, or use CORA-related services operated by Horizon Labs.

2. What we collect

Registration and download (website)

• Email address — from email/password registration or Google sign-in.
• Account identifier — a unique user ID assigned by our identity service.
• Profile fields from Google — when you choose Google sign-in, we receive the information Google shares with us (typically email and basic profile fields required for authentication).
• Download audit data — platform selected, release version, beta terms version accepted, download session identifier, timestamp, and technical request metadata such as IP address and browser user-agent.

Product runtime and activation (CORA software)

• CORA runs locally in your environment. We do not receive your source code, repository contents, prompts, MCP queries, file names, repository paths, or indexed context through normal product operation.
• Online activation may send entitlement metadata only — for example license identifier, installation identifier, release version, image digest, client/runtime version, and timestamp — required to validate beta access.

We do not sell your personal data.

3. Why we use your data

• Provide and manage gated beta download access.
• Identify your account and record acceptance of beta terms.
• Communicate about the beta program (for example release updates, security notices, and support).
• Prevent abuse, secure our services, and maintain an audit trail of downloads.
• Validate entitlement when CORA activation is enabled.

Legal bases (EEA/UK): We rely on contract (providing beta access you request), consent (accepting beta terms and, where applicable, Google sign-in), and legitimate interests (security, fraud prevention, and service improvement), balanced against your rights.

4. Where data is stored

Registration and download audit data are processed and stored in the AWS EU Region. We configure our services to remain in that region. We do not intentionally transfer registration data outside the EEA unless required for a specific subprocessors’ global infrastructure, in which case appropriate safeguards apply (see Section 5).

5. Processors and subprocessors

We use service providers that process personal data on our behalf:

• Amazon Web Services (AWS) — cloud infrastructure in the AWS EU Region. AWS acts as a data processor under AWS’s data processing terms.
• Google — if you sign in with Google, Google processes your authentication according to Google’s privacy policy. Google acts as an independent controller for that sign-in flow.
• GitHub — release artifacts may be downloaded from GitHub; GitHub may process technical connection data according to its own policies when you download binaries.

We require processors to protect personal data and use it only to provide services to us.

6. Retention

• Account and email — kept for the duration of the beta program and a reasonable period afterward for support, security, and legal compliance, unless you request earlier deletion.
• Download audit records — kept for security and compliance; some session records expire automatically under our retention settings.
• Activation metadata — kept only as long as needed to validate entitlement and maintain audit records.

7. Your rights and requests

If you are in the EEA, UK, or another jurisdiction with similar rights, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data, subject to legal or security retention needs.
• Object to or restrict certain processing.
• Withdraw consent where processing is consent-based (without affecting prior lawful processing).
• Lodge a complaint with your local data protection authority.

How to submit a request

1. Email contact@horizon-labs.io from the address associated with your account, or clearly identify the account email.
2. State whether you are requesting access, correction, or deletion.
3. We will verify your identity and respond within the timeframe required by applicable law (typically within 30 days for GDPR requests).

Providing an email address is required to register and download CORA beta.

8. Security

We use technical and organizational measures appropriate to the risk, including encrypted transport (HTTPS), access controls, and least-privilege cloud configuration. No method of transmission or storage is completely secure; report concerns to contact@horizon-labs.io.

9. Changes

We may update this policy as the beta program evolves. We will post the revised version on this page and update the effective date. Material changes may also be communicated by email or on the download page.

10. Related documents

• Horizon Labs website privacy
• CORA beta terms — program terms accepted at registration.
• Register to download — beta registration page.