Privacy policy

2 Purposes

We process personal data to: provide the services and keep you signed in; produce the response you asked for; enforce the rate limits and the acceptable-use rules; bill paid subscriptions; answer support requests; measure whether the site works; detect, investigate and prevent abuse and security incidents; meet our legal and accounting obligations; and improve our models where — and only where — the legal basis below permits it.

3 Legal bases under the GDPR

Where we rely on legitimate interests, we have carried out a balancing test and can describe it on request. You may object to that processing at any time — see 2.3.7.

4 Retention periods

When a period ends the data is deleted or irreversibly anonymised. Backups follow a [À REMPLIR PAR MATHIS : durée de rotation des sauvegardes, 35 jours par défaut] rotation and roll off on their own schedule.

5 Processors and recipients

Each processor is bound by a data-processing agreement under Article 28 GDPR. We do not authorise a processor to use your data for its own purposes. Beyond processors, we disclose data only where the law compels it, and we challenge a request we consider excessive.

6 International transfers

Where a processor is established outside the European Economic Area, the transfer relies on [À REMPLIR PAR MATHIS : mécanisme — décision d'adéquation, clauses contractuelles types, ou règles d'entreprise contraignantes], together with the supplementary measures required by the case law — typically encryption in transit and at rest, with keys held in the EEA.

A transfer impact assessment is carried out for each destination and reviewed [À REMPLIR PAR MATHIS : fréquence, annuelle par défaut]. You may obtain a copy of the applicable safeguard by writing to the Data Protection Officer.

7 Your rights

You have the right to access your data, to rectify it, to erase it, to restrict its processing, to object to it, and to receive it in a portable, machine-readable format. Where processing rests on consent, you may withdraw that consent at any time, without affecting the lawfulness of what was done before.

Exercise these rights from your account settings, or by writing to the Data Protection Officer at the address in 2.3.9. We answer within one month; where a request is complex we may extend that by two months and we will tell you within the first month.

In France you may also lodge a complaint with the CNIL; elsewhere in the European Union, with your national supervisory authority. We would rather you came to us first, and we will not treat a complaint as a reason to close your account.

You have the right not to be subject to a decision based solely on automated processing that produces a legal effect or a similarly significant effect. Cortex does not make such decisions about users' accounts. Where a model produces a recommendation that a human then acts on, the human is accountable for the decision — see the AI disclosure.

8 Cookies and local storage

The site sets cookies in three categories.

There is no advertising or retargeting cookie on this site, and no cookie placed by a third party for its own purposes. Refusing consent is as easy as giving it: the consent banner offers both choices at the same level. You can change your choice at any time from the "Cookie settings" link in the footer. Withdrawing consent does not affect the lawfulness of processing carried out before.

The application services store a session token in local storage. It is strictly necessary and is removed when you sign out.

9 Contact — Data Protection Officer

Data Protection Officer: [À REMPLIR PAR MATHIS : nom du DPO, ou « the Data Protection Officer of Cortex Foundation » si la fonction est assurée sans nommer de personne] Address: [À REMPLIR PAR MATHIS : adresse postale du DPO, ou celle du siège] E-mail: [À REMPLIR PAR MATHIS : adresse e-mail du DPO]

Put "GDPR request" in the subject line. We may ask for proof of identity where a request is made by someone other than the account holder, and we will ask for the minimum needed.

This policy is reviewed at least once a year. Material changes are announced on this page with a new "last updated" date.