Privacy policy

Last updated 17 October 2026

Courage Horizon ("we") makes the Courage Horizon Hub, where a business's AI agents do jobs for it. This policy explains what we do with personal data when a business uses the Hub.

Two kinds of data, two roles

Your account. When you sign in to the Hub, we decide how your details are used. We are the controller of your name, email address, role and settings.
Your business's data. A business connects its own software to the Hub (its email, spreadsheets, accounts and so on), and its agents work with that data. It often includes details of the people the business works with. For this data we act only on the business's instructions, as its processor. If a business holds your details and you have a question about them, contact that business, and we will help it answer you.

What we collect

Account details: your name, email address, the businesses you belong to and your role in each, your notification choices, and when you signed in.
Connections: the business's sign-in to each service it connects, kept sealed (encrypted) so it cannot be read from our database, and the name of the account connected.
What agents do: each job an agent does, what it drafted, what was approved or turned down and by whom, emails sent and replies received, and tasks and their history. The business sees all of this in the Hub.
Data read from connected services: agents read the business's data live, each time they need it, and we do not keep a copy. We keep only an agent's own notes on each row it works through, such as when it last emailed someone. The exceptions are lists a business chooses to keep in the Hub, and pictures waiting for approval before they are posted, which we keep for up to 30 days. For comments on the business's social media posts we keep only their ids, for 14 days, so that an agent starts on each comment once; what a comment says is read live. So that a screen or a chart can be shown again without asking the service each time, what was read may be held in the Hub's memory for up to 60 minutes. It is never written to our database or disk, and it is cleared when the business disconnects the service.
What Hub Operations remembers: short notes a person in the business asked it to remember, in the words they confirmed, such as how they like to work or that a customer wants a call before a reminder. A note about one person is used only in their own conversation; a note about the business is used in everyone's, and owners and admins can see it. Every note can be read, changed and deleted under Business settings, and none is saved without the person seeing its exact words first. It never remembers anything about health, religion, ethnicity, sexuality, politics, union membership or criminal records. A note is put back to the person who added it after 12 months and deleted unless they keep it, and a person's own notes are deleted when they leave the business.
Job transcripts: the full record of an AI model's work on a job, kept for 90 days. After that only the job's summary and the Hub's own record of what was done remain.
Technical records: security and error logs, kept for a short time to keep the service safe and working.

Every kind of record the Hub keeps is listed at the end of this page.

How we use it

To provide the Hub to the business: the agents' jobs, approvals, notifications and the owner's dashboard.
To keep it secure, and to stop misuse.
To help when asked. Our staff can open a business to help with a problem. They can then see what the business sees, including what is waiting for approval. Each time is recorded in that business's own activity log, and staff cannot approve or change anything the business decides.
To improve the Hub, using how it is used (which screens, how often), never the content of a business's data.

We do not sell personal data. We do not use it for advertising. We do not use a business's data to train AI models.

AI

Agents use AI models to read and write. Text an agent works with is sent to the model provider the business chooses, only to do that job. The providers are listed below. They do not use this data to train their models. Nothing an agent writes is sent to anyone outside the business until a person has approved it, unless the business chose to let a particular job act without asking.

Who helps us, and where

Render: Hosts the Hub and its database. Frankfurt, Germany. Always.
Resend: Sends the Hub's own emails: sign-in links and notifications. Ireland. Always.
Amazon Bedrock: Runs the AI model agents use (Claude, through Amazon). the EU. Only for businesses whose text is read on this route.
OpenAI: Runs the AI model agents use (ChatGPT's models, from OpenAI). the EU. Only for businesses whose text is read on this route.
Anthropic: Runs the AI model agents use (Claude, from Anthropic). the United States. Only for businesses whose text is read on this route.
Stripe: Takes the Hub's monthly payment by Direct Debit and sends its invoices. It holds the bank details; we never see them. Ireland and the United States. Once a business subscribes.
Cloudflare: Points the Hub's web address at our host. No data passes through it. Worldwide. Always.
Your phone or browser's notification service (Apple, Google, Microsoft or Mozilla): Delivers phone notifications, encrypted so that it cannot read them. Worldwide. Only for people who switch on phone notifications.

Data leaves the UK and EU only if a business chooses an AI route outside them. That transfer is covered by the UK's International Data Transfer Addendum and the EU's Standard Contractual Clauses.

Services a business connects are the business's own: it connects them and can disconnect them at any time, and their own terms and privacy policies apply. Today a business can connect Microsoft 365, Zoho Mail, Google, Notion, Instagram, TikTok, Bing Webmaster Tools, GitHub, WordPress, WordPress.com, Xero, QuickBooks, Sage Accounting, Stripe and Square.

Claude and ChatGPT

Anyone in a business can connect Claude (from Anthropic) or ChatGPT (from OpenAI) to the Courage Horizon Hub and use it from there: see what is waiting, approve or turn down drafts, ask Hub Operations things and hand agents work. The assistant works as that person, in the one business they chose when connecting, and can do only what they can do in the Hub. Nothing goes out without approval, as anywhere in the Hub.

What the assistant reads from the Hub is then held by its company under that person's own account, under their terms, not ours. They are not our processors and we send them nothing ourselves. On a personal plan they may use chats to improve their models unless the person switches that off in the assistant's settings; their business plans do not. We advise businesses to use a business plan, or to switch training off.

We keep only what the connection needs: which assistant, who connected it to which business and when, and its keys as one-way fingerprints that cannot be used. A connection unused for 90 days stops working. The person, or an owner or admin, can disconnect it at any time in Business settings, and it stops at once; removing someone from a business disconnects theirs. The activity log says when something was done through an assistant.

Google user data

The Hub's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to do the jobs the business sets up in the Hub, and we do not use it for advertising or to train AI models.

When a business connects a Google account, the Courage Horizon Hub can read the files the business chooses from its Google Drive (spreadsheets, documents, slides, forms and PDF and Word files), update the spreadsheets among them, and read the Google Search Console figures for its websites. It reads them only when one of the business's agents or screens needs them. What it reads is held in memory for up to 60 minutes and is not copied into our database. The part an agent works on is sent to the business's AI model provider to do that job, and nowhere else. We do not sell Google data or share it with anyone else, and nobody at Courage Horizon reads it unless the business asks us to help with a problem, or the law requires it. Disconnecting Google in the Hub, or removing the Hub from the Google account's settings, ends our access at once.

How long we keep it

Account details: while you have an account, and up to 30 days after it closes. If you are no longer part of any business on the Hub, your sign-in and everything that was only yours, such as your notifications, are deleted after 30 days, unless you join one in the meantime.
A business's data in the Hub: while the business uses the Hub. When an owner closes the business, we keep its data for 30 days so they can reopen it, then delete it, and it leaves our backups within 7 days after that.
Connections: deleted as soon as the business disconnects, or when the provider tells us access was removed.
Job transcripts: 90 days. Pictures waiting for approval: up to 30 days. The ids of comments seen: 14 days. Data read from a connected service: in memory only, for up to 60 minutes.

Keeping it safe

Everything travels encrypted. Connection sign-ins are sealed with AES-256 encryption, each bound to its own business and connection. The database keeps each business's data apart so that one can never see another's, and we test that with every change we make. People sign in with single-use links sent by email.

Cookies

The Hub uses one cookie, to keep you signed in. It is needed for the Hub to work. We use no advertising or tracking cookies.

Your rights

You can ask us for a copy of your personal data, and to correct it, delete it, or limit or object to how we use it. Email us at hello@couragehorizon.com. If your details are in a business's data, contact that business first; we will help it answer.

A business's owner can download a copy of everything the Hub holds for it, and close it, at any time in Business settings, under Your data.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would like the chance to put it right first.

Children

The Hub is a service for businesses. It is not meant for anyone under 18.

Changes

We update this policy when the Hub changes. The date at the top shows the latest version. We tell businesses using the Hub about important changes, and ask an owner to agree to them, before they take effect.

Contact

Courage Horizon. Email hello@couragehorizon.com.

Every kind of record the Hub keeps

Your account

Your name and email address.
That you are signed in, on which device, until you sign out, and the business you are choosing while connecting Claude or ChatGPT.
How you sign in (by emailed link).
Which of our notices each person has read, so each opens over the page once.
Which businesses you belong to, and your role in each.
Invitations to join a business, and whether they were accepted.
Which agents each person may see, approve or change, where an owner or admin set it for them.
Notifications for you, and whether you have read them.
The address your phone or browser gave us for notifications.

Your business in the Hub

Each business's name, settings, colours and logo, its email signature, when it agreed to these terms, its monthly limit for AI use, and where it is with paying.
The id of each notice Stripe sends us about a business's payments, so each is acted on once.
Each amount of AI use reported to Stripe for a business's month, for its bill.
Notices we show at the top of the Hub, to every business or to one.
The exchange rate from US dollars to pounds each month, which prices AI use. It holds nothing about you or your business.
Which new or withdrawn AI models we have already been told about. It holds nothing about you or your business.
The email domain, or for a shared email service the address, each business's first week free was given to, so each has one.
Each agent's name, aim, set-up and rules, including agents an owner or admin removed, so what they did stays visible.
Which features are switched on for the business.
Connections the business asked us to add.
How the home screen is arranged.
The business's voice and writing rules, under About your business, which its agents follow.
Earlier versions of the voice and writing rules, with who changed them, so a change can be gone back to.
Earlier versions of each agent's set-up, so a change can be undone.
Where the business's data lives, for its Data page, and the columns of lists kept in the Hub.
The rows of lists the business keeps in the Hub.
Which agents may use which data.
How the business's data sources join up.
Things the business asked Hub Operations for that the Hub cannot do yet.
Each website the business publishes articles to: where articles go, the page details its site expects, its footer, its address and when articles go out.
The business's own email design, if it sets one: the layout, logo and signature of an email it sent or a template it uploaded, which its agents can send their emails in.

What agents do

The business's activity log: who did what, and when, and whether they did it through Claude or ChatGPT.
Everything an agent asked to do outside the Hub, what it would have sent, and who approved or turned it down.
Each job an agent did, its summary and what it cost.
The full record of the AI model's work on each job, deleted after the transcript period.
Emails agents sent and the replies to them: sender, subject, text and attachment names.
Your conversations with Hub Operations.
Changes Hub Operations proposed, and whether you confirmed them.
What the business writes in the Writing studio, or edits there from an agent's draft, with which words the AI wrote.
Earlier versions of each document in the Writing studio, with who changed it, so a change can be gone back to.
What Hub Operations was asked to remember, about how you like to work or how the business works, in the words the person confirmed.
An agent's own notes on each row it works through, such as when it last emailed someone, stored against a one-way fingerprint, not the row itself.
Which row each email an agent sent was about, so a reply reaches the right place.
Tasks for people and agents, their history, who they are for and who asked for them.
Stuck work we are alerted to so we can help.
Each approved article on its way to the business's website: when it goes, how far it got, its address and when it went live. Its words are kept with the approval.

Connections

Each copy of Claude or ChatGPT that asked to connect: its name and where it sends people back to after they sign in.
The Hub's address for Claude and ChatGPT. It holds nothing about you or your business.
Which assistant may use the Hub's address. It holds nothing about you or your business.
That you agreed to connect Claude or ChatGPT to a business, and when, until you disconnect it.
The short-lived keys Claude or ChatGPT holds to work as you in one business, as one-way fingerprints that cannot be used, deleted when you disconnect.
The longer-lived keys Claude or ChatGPT swaps for new short-lived ones, as one-way fingerprints, until a connection goes unused for its idle period or you disconnect.
A business's own key for an AI provider, if it gave one, kept sealed.
The business's sign-ins to services it connected, kept sealed, the account names, and settings for each, such as the account and tax rate for draft invoices.
Each browser the business connected: its name, who connected it, when it was last seen, and a one-way fingerprint of its key.

Kept for a short time

Sign-in links waiting to be used, and a Claude or ChatGPT connection being made, until they expire.
One-time proofs an assistant signs to identify itself, until they expire. It holds nothing about you.
A connection being made, or a file being chosen on the service's own site, until it finishes or expires.
Pictures waiting for approval before they are posted, and pictures of a web page an agent wants to send something from, until they are done or the hold period ends.
A code for connecting a browser, as a one-way fingerprint, until it is used or ten minutes pass.
One thing for a connected browser to do and what it saw, deleted as soon as the agent has it, and within an hour at most.
That a person has taken control of an agent's browser window, and which agent's, until it is handed back, or for 72 hours at most.
The latest picture of an agent's browser window while someone in the business watches it from the Hub, replaced by each new picture, never taken while a person has control of the window, and deleted within two minutes of the last person stopping watching, or when the window closes.
Which comments on the business's social media posts the Hub has seen, and whether it sent a private reply, by their ids only, not what they say.