Privacy policy

Last updated: 16 October 2026

CTOScore is a technical due-diligence and CTO assessment service provided by CloudOneSoftware LLC, Jersey City, New Jersey, USA ("we", "us"). This policy explains what we collect when you use CTOScore on the web, in the iOS and Android apps, or through its API, and what we do with it.

What we collect
Google user data
Microsoft and other platforms
How we use data
AI processing
Who we share it with
Retention and deletion
Security
Your rights
Cookies
Children
Changes and contact

1. What we collect

Account data: your name, email address, role and a salted password hash. We never store your password itself.
Workspace content: assessments, answers, scores, reports, CRM companies, contacts, events and notes that you and your team enter.
Client source code: only from repositories an administrator approved after recording the repository owner's written authorization. Files are read through the code host's API, analysed, and kept as a snapshot until the connection expires or is revoked.
Connection credentials: access tokens for code hosts and meeting platforms you connect. They are encrypted with AES-256-GCM before storage and are never shown again.
Meeting data: for meetings you schedule through CTOScore, the title, time, attendee email addresses and join link; and, only where you recorded the client's consent to transcription, the meeting transcript.
Billing data: your plan and Stripe customer and subscription identifiers. Card details go directly to Stripe; we never see or store them.
Operational data: request metadata such as path, status code, timing and IP address, used for security, abuse prevention and reliability.

2. Google user data

If you connect Google Meet, CTOScore asks Google for these permissions and uses them only as described:

Permission (scope)	What CTOScore does with it
`openid`, `email`	Reads your Google account email address to show which account is connected.
`calendar.events`	Creates a Google Calendar event, with the Meet link and the attendees you chose, when you schedule a meeting from CTOScore. Google Calendar then sends the invitations. CTOScore does not read, change or delete your other calendar events.
`meetings.space.created`	Creates the Google Meet space for that meeting with automatic transcription on, and afterwards reads the conference record, participant names and transcript entries of meetings CTOScore created. It cannot access any other Meet meetings.

We use Google user data only to provide these user-facing features: scheduling due-diligence meetings and turning the transcripts of those meetings into proposed questionnaire answers that a person reviews. We do not use Google user data for advertising, we do not sell it, and we do not use it to develop, improve or train generalized AI or machine-learning models. People at CloudOneSoftware LLC do not read it, except with your explicit permission for support, where needed for security or to comply with law.

Limited Use. CTOScore's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google at any time in CTOScore under Settings → Meetings & chat → Google Meet → Disconnect, which deletes the stored tokens. You can also remove CTOScore's access from your Google account at myaccount.google.com/permissions.

3. Microsoft and other platforms

The same rules apply to every platform you connect: we use its data only to provide the feature you asked for, we store its tokens encrypted, and disconnecting deletes them.

Microsoft Teams (Microsoft Graph): reads your basic profile; creates an Outlook calendar event with a Teams meeting when you schedule one; reads the online meeting and its transcript for meetings CTOScore scheduled. Transcript access requires your Microsoft 365 administrator's approval.
Zoom: reads your profile email; creates the meetings you schedule through CTOScore (with cloud recording on when you ask for a transcript); reads the recording file list of those meetings and downloads only the audio transcript. CTOScore does not download audio or video recordings.
Webex: reads your profile email; creates and reads the meetings you schedule through CTOScore; reads their transcripts.
GoTo Meeting: creates the meetings you schedule. CTOScore emails the invitation. Transcripts are only imported if you upload them.
Slack: posts meeting announcements to the one channel you chose when installing, using an incoming webhook. CTOScore cannot read Slack messages.
Discord: a bot with the Manage Events permission creates scheduled events in the server you chose. CTOScore cannot read Discord messages.
Code hosts (GitHub, GitLab, Bitbucket, GitBucket, Gitea, Azure DevOps, AWS CodeCommit): reads the repositories that were approved and, only after a second person approves, opens pull or merge requests.

4. How we use data

Only to provide and secure CTOScore: running assessments and scores, analysing approved code, producing reports, scheduling meetings and reminders, proposing answers from transcripts, billing, support, and preventing abuse. We do not sell personal data, share it for cross-context behavioural advertising, or use it for advertising of any kind.

5. AI processing

AI summaries and proposed answers from transcripts are generated by models running on Cloudflare Workers AI, which processes the data on our behalf. Outputs are drafts: nothing changes an answer or score until a person in your workspace accepts it, and every accepted proposal records its quote, speaker and time. We do not use your data, your clients' code or transcripts, or data received from Google or Microsoft, to train AI models.

We share data only with service providers that process it on our instructions to run CTOScore, with the platforms you choose to connect, when required by law, or in a merger or acquisition subject to this policy.

Provider	Purpose
Cloudflare, Inc.	Hosting, database (D1), file storage (R2), AI models (Workers AI), network security
Stripe, Inc.	Payments and subscriptions
Resend	Transactional email: reminders, invitations for Zoom and GoTo meetings, account messages
Supabase or Google Firebase	Database, only for workspaces configured to use them
Apple and Google app stores	Distributing the mobile apps; they do not receive your workspace data

7. Retention and deletion

Workspace content, transcripts and meeting records: kept while the workspace exists, deleted when it is deleted.
Code snapshots and repository credentials: deleted when the connection expires or is revoked.
Meeting-platform tokens: deleted when you disconnect the platform or delete your account.
Operational logs: kept for no longer than 30 days.
Billing records: Stripe keeps what tax and accounting law requires.

To delete your account or workspace yourself, use Settings → Delete on the web or in the app (step-by-step instructions). Deletion is immediate. If you can't sign in, email us from the address on the account and we will delete it within 30 days.

8. Security

Data is encrypted in transit (TLS) and at rest; credentials and tokens are additionally encrypted with AES-256-GCM. Sessions are RS256-signed, access is role-based, any access to or change in client code needs human approval, and every action is written to a tamper-evident audit log.

9. Your rights

Depending on where you live (for example under the GDPR, UK GDPR or California law), you can ask to access, correct, export or delete your personal data, or object to or restrict how we use it. Most of this you can do yourself in Settings; for anything else email support@ctoscore.com and we will answer within 30 days. We will not treat you differently for exercising these rights. If CTOScore holds data about you because a CTOScore customer added you (for example as a client contact or meeting attendee), we will pass your request to that customer, who controls that data, and help them respond.

10. Cookies

The web app uses one essential cookie to keep you signed in. We do not use advertising or third-party tracking cookies.

11. Children

CTOScore is a business service and is not directed to children. We do not knowingly collect data from anyone under 16.

12. Changes and contact

If we change this policy in a way that matters, we will update the date above and tell workspace owners by email before the change applies.

CloudOneSoftware LLC, Jersey City, NJ, USA · support@ctoscore.com

CTOScore is a product of CloudOneSoftware LLC, Jersey City, NJ. Privacy · Terms · Support