Privacy Policy

Who we are

Cortex is operated by Starwin Tech Private Limited (CIN U62099UT2025PTC019075), 1, Vasundhara Enclave, Jakhan, Rajpur Road, Dehradun, Uttarakhand, 248001, India. For the personal data in your own account we are the data controller (a “data fiduciary” under India’s Digital Personal Data Protection Act, 2023). For material an organization adds to Cortex for its company, we process it on that organization’s behalf, as described in our Data Processing Addendum.

Information we collect

Account information

Your name, email address, username, display name, password (stored only as a hash by our authentication provider) or Google sign-in identifiers, and, if you turn on two-factor sign-in, records of the browsers you have marked as trusted.

Content you choose to share

• Text, notes, documents and files you upload (PDF, DOCX, Markdown and similar)
• Voice recordings, their transcripts, and speech patterns derived from them; if you create a voice clone, the recordings used to build it
• AI chat exports and social platform exports you import
• Onboarding and questionnaire answers
• Feedback, corrections and ratings you give your clone

Your brain

From your content we derive structured knowledge, profile summaries, wiki pages, reasoning patterns, style examples and similar artifacts so your clone can answer in your voice. This stays tied to your account.

Queries and usage

When you, a teammate, or a visitor to your public clone asks it something, we log the question, the answer, retrieval traces and usage counts. We use your IP address for rate limiting and abuse prevention, and visitors to public clones pass a Cloudflare Turnstile bot check.

Connected accounts

If you connect another service, we receive the data that connection allows. Connections are read-only. OAuth tokens for direct connections are encrypted in our database with AES-256-GCM. See “Connectors and the provenance firewall” below.

Billing

Razorpay processes payments. We store your plan, subscription status and Razorpay customer and subscription identifiers. We never see or store full card numbers.

Analytics

We use PostHog, Microsoft Clarity, Google Analytics and Vercel Speed Insights to understand how the site is used and to find bugs. PostHog session recordings mask everything typed into form fields. If your browser sends a Do Not Track or Global Privacy Control signal, these tools are not loaded at all.

Google user data

If you connect Google Calendar, Cortex requests one sensitive scope, https://www.googleapis.com/auth/calendar.readonly. We read event titles, descriptions, start and end times, attendees and video-meeting links, and use them for one purpose: your daily brief and answers to your own questions about your schedule. The access is read-only; Cortex cannot create, change or delete events, or send anything on your behalf. Cortex does not request access to Gmail, Google Drive or Contacts.

We never sell Google user data, never use it for advertising, and never use it to train generalized AI or machine-learning models. People do not read it, except with your explicit consent for support, where required by law, or to investigate abuse or a security incident. You can disconnect Google at any time from Connections or from your Google Account permissions, and deleting your account removes the stored events.

Cortex’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Connectors and the provenance firewall

Cortex keeps what you said separate from what merely happened around you. Material from connected accounts, devices and ambient capture is marked private to your agent by default. It can help answer questions you ask, with attribution, but it does not shape your profile, identity or voice, it is never used by your public clone, and it is never used in answers to teammates in your organization.

Organizations and teammates

If you join an organization, other members of it can query your clone even when it is not public. Those answers draw only on your own material, never on your connected accounts or ambient capture. Questions asked of your clone inside the organization are logged, with secret-like text redacted, and you and the organization’s admins can see them. When you leave or are removed, teammates lose access to your clone and you lose access to theirs.

Company material an admin adds belongs to the organization. When the last member leaves, the organization and its company material are deleted.

How we use your information, and our lawful bases

We use personal data only to run Cortex. Where the GDPR or UK GDPR applies, these are our lawful bases:

• Performance of our contract with you: running your account, building and querying your brain, voice features, billing, and support.
• Consent: connecting third-party accounts, creating a voice clone, and making your clone public. You can withdraw consent at any time by disconnecting, deleting the voice clone, or switching public access off.
• Legitimate interests: securing the service, preventing abuse, rate limiting, and improving reliability through analytics. You can object at any time.
• Legal obligation: keeping billing and tax records, and responding to lawful requests.

Under India’s DPDP Act, we process your personal data on the basis of the consent you give when you create an account and when you choose to upload or connect each kind of material, and for the legitimate uses the Act permits.

We do not use your content to train AI models, ours or anyone else’s.

What we do not do

• We do not sell your personal information, Google user data or clone content, and we do not use it for targeted advertising.
• We do not make your clone public without your action. Public access is off until you turn it on in Settings.
• We do not share your private brain with other users except teammates in an organization you joined, as described above.

Who processes your data

These service providers process personal data on our behalf, only to run the parts of Cortex listed. This list matches what our code calls today; we update it before adding a new one.

• Supabase: database, authentication and file storage (Mumbai, India region)
• Vercel: application hosting and serverless functions (Mumbai, India region), and page performance metrics
• OpenAI: language models, embeddings, transcription and speech synthesis
• Anthropic: language models, used as a fallback when the primary model is unavailable
• ElevenLabs: voice cloning and speech synthesis, only if you create a voice clone
• Smallest.ai: voice cloning and speech synthesis, only if you create a voice clone
• Razorpay: payment processing and subscriptions
• Resend: account, security and billing emails
• Google: Google sign-in and read-only Google Calendar, only if you use them; Google Analytics for site usage
• Composio: read-only connections to third-party apps, only if you connect one through it
• Cloudflare: Turnstile bot check on public clones
• PostHog: product analytics and session recordings with form inputs masked
• Microsoft Clarity: site usage analytics
• FormSubmit: delivers waitlist form submissions to our inbox

Model providers: every OpenAI chat request is sent with storage switched off (store: false). We have not signed zero data retention agreements with OpenAI or Anthropic, so under their standard API terms they may keep request data for a limited period for abuse monitoring. Neither uses API data to train its models under those terms.

We may also disclose information if required by law or valid legal process, to protect the safety of our users or the public, or as part of a merger or acquisition, in which case this policy will continue to apply to your data and we will tell you.

Where your data is stored

Your account, brain and uploaded files are stored with Supabase in its Mumbai, India region, and our application runs on Vercel in Mumbai. Some service providers above, such as OpenAI, Anthropic, ElevenLabs, PostHog and Resend, process data in the United States or other countries. Where the GDPR or UK GDPR requires a transfer mechanism for data leaving the EEA or UK, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) offered in our providers’ data processing terms.

How long we keep it

• Your content and brain: until you delete it. You can reset your brain from Settings, which deletes its sources and everything derived from them, or ask us to remove a single source.
• Originals: voice recordings are deleted once transcribed, and the full original text of a source is deleted a day after it is processed. We keep the passages your clone searches and quotes, and what was extracted from them. Recordings made for a voice clone are kept until the voice is created, for at most 7 days.
• Account deletion: your account locks and your public clone goes offline immediately. 7 days later an automated job permanently destroys your content, chats, recordings, connected accounts, API keys and your cloned voice at our voice provider. You can cancel during those 7 days.
• What survives deletion: your username stays reserved so nobody inherits your public clone URL, and billing records are kept as financial records. Your email address is scrambled.
• Export links: download links to your recordings in a data export expire after 7 days.
• Backups: our database provider’s managed backups may hold deleted data for a limited period until they are overwritten.

Your rights

Most of these you can exercise yourself in Settings → Your data: export everything as one file, correct your brain, switch public access off, or delete your account. For anything else, email aashwin@makecortex.com from the address on your account. We respond within 30 days.

EEA, UK and Switzerland (GDPR)

You have the right to access, rectify, erase, restrict and port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting earlier processing. You can also complain to your local data protection authority.

India (DPDP Act, 2023)

As a data principal you have the right to a summary of the personal data we process and who we share it with, to correct, complete, update and erase it, to withdraw consent, to nominate someone to exercise your rights if you die or become incapacitated, and to have your grievances addressed. Withdrawing consent stops further processing but does not affect processing that already happened.

Grievance Officer. Write to aashwin@makecortex.com with “Grievance” in the subject, or by post to Starwin Tech Private Limited, 1, Vasundhara Enclave, Jakhan, Rajpur Road, Dehradun, Uttarakhand, 248001, India. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

California (CCPA/CPRA)

You have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and not to be discriminated against for exercising these rights. We do not sell personal information and do not share it for cross-context behavioural advertising.

Security

Data is encrypted in transit and at rest, each user’s data is isolated with row-level security, and your browser never holds database keys. The details, including what we do not do yet, are on our Security page. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

Children

Cortex is not for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.

Changes to this policy

When we make material changes we will post the updated policy here with a new effective date and email account holders before the change takes effect.

Contact

aashwin@makecortex.com, +91 99970 45800. Include the email address on your Cortex account so we can verify your identity.