Privacy Policy

Account Information:

• Email address
• Name and company name
• Password (hashed)
• Billing information (payment method, billing address)
• Phone number (optional)

Communication Data:

• Information you provide when contacting support
• Survey responses and feedback
• Early access signup information
• Newsletter subscription data

Configuration Data:

• Organization and agent settings plus policy configurations
• API keys and access tokens (encrypted)
• Webhook URLs and integration settings
• Role-based access control (RBAC) configurations

CortexHub evaluates every tool call on the gateway. What is persisted depends on your organization and agent privacy settings.

When you visit our website (cortexhub.ai), we automatically collect:

• IP address (anonymized after 90 days)
• Browser type and version
• Operating system and device information
• Pages visited, time spent on pages, and click paths
• Referrer URL (where you came from)
• Date and time of visits
• Geolocation data (country/city level, not precise location)

We use the following types of cookies:

Essential Cookies:

• Session cookies for authentication
• Security cookies for CSRF protection
• Load balancing cookies

Analytics Cookies:

• Google Analytics 4 (see Section 3.3 for details)
• Website usage tracking and conversion analytics
• A/B testing cookies (for optimizing user experience)

Marketing Cookies:

• HubSpot website tracking, for understanding visitor engagement and lead intelligence (see Section 3.4 for details)

Analytics and marketing cookies load only after you grant the matching consent in our cookie banner. You can control cookies through your browser settings and change or withdraw consent at any time. Note that disabling essential cookies may affect your ability to use certain features.

If you connect a CortexHub co-worker to a meeting (for example on Google Meet, Zoom, Microsoft Teams, or Webex), a meeting bot joins the call to capture and process it. For those meetings we collect:

• Meeting audio and video
• Participant names and email addresses
• Transcripts, speaker attribution, and meeting notes or summaries generated from the call

Meeting capture and transcription are provided through our meeting-bot sub-processor, and real-time voice is provided through our AI voice sub-processor (see the sub-processor list in Section 3.1). We delete the recording and transcript held on the meeting-bot sub-processor after they are ingested into CortexHub. You are responsible for obtaining any consent required in your jurisdiction before recording or transcribing a meeting, and the meeting bot is visible to participants when it joins.

To give your co-workers useful context, CortexHub builds a persistent memory ("Brain") derived from content you provide, such as chats, uploaded files, and meetings. This memory is stored on CortexHub-operated infrastructure and is scoped to your organization and the applicable member. You can review and delete memories, files, and their derived records from the product. Short numeric text embeddings used for search and recall are generated by our AI sub-processor; the underlying memory and vector store are not a third-party service.

We use the collected information for the following purposes:

2.1 To Provide and Improve the Services

• Enforce governance policies on every tool call through the gateway (permit, deny, modify, require approval)
• Store and refresh per-user OAuth credentials for connected toolkits
• Display audit trails, usage rollups, and policy decisions in the dashboard
• Track risk signals and manage approval workflows

2.2 To Communicate With You

• Send service announcements, security alerts, and system notifications
• Respond to your inquiries and support requests
• Send product updates and feature release notes (if opted in)
• Provide onboarding assistance and educational content

2.3 To Process Payments

• Process subscription fees and usage-based billing
• Generate invoices and maintain payment records
• Prevent fraud and unauthorized transactions

2.4 To Ensure Security and Compliance

• Monitor for security threats and suspicious activity
• Enforce our Terms of Service and Acceptable Use Policy
• Comply with legal obligations and respond to legal requests
• Conduct security audits and penetration testing

2.5 To Analyze and Improve

• Analyze usage patterns and product engagement (aggregated, anonymized)
• Improve guardrail detection and platform reliability
• Optimize performance, reliability, and scalability
• Develop new features based on customer needs

2.6 AI Model Providers and Your Content

CortexHub's AI features - co-workers, chat, meeting assistance, and related capabilities - are powered in part by third-party AI providers. To provide these features, we send relevant content to those providers, which may include:

• Prompts and instructions you or your agents submit
• Context retrieved from your Brain, files, and connected tools to answer a request
• Model responses generated for you
• Meeting audio and transcripts, where you use meeting or voice features

Our current AI providers are listed in the sub-processor list in Section 3.1 (today, OpenAI, Anthropic, and AWS Bedrock). We use these providers on business or enterprise terms under which your content is not used to train their models and is retained by them only as needed to deliver the service and meet their legal obligations. CortexHub does not use your Customer Data to train generalized or standalone AI models, and never sells it.

Important: We never train machine learning models on your specific Customer Data without explicit consent. Product analytics use aggregated, anonymized patterns only.

We do not sell your personal information. We never have, and we never will.

We may share your information in the following limited circumstances:

3.1 Service Providers and Sub-processors

We rely on a small set of trusted third-party providers ("sub-processors") to operate the Services. Each processes Customer Data or personal data only on our documented instructions, under a contract that requires appropriate security and confidentiality, and only for the purpose shown below. We conduct due diligence before onboarding a sub-processor and review them periodically.

Sub-processor list last reviewed September 25, 2026. This list may change as the Services evolve; we update it here and, for material changes, give notice as described in Section 10. To be notified of changes, email privacy@cortexhub.ai.

Document parsing and optical character recognition, and the memory and vector store that power your Brain, run on CortexHub-operated infrastructure inside our own cloud environment, not on a separate third-party service. The only exception is that short numeric text embeddings used for search and recall are generated by OpenAI.

We also use Google Analytics 4 and, for understanding visitor engagement and lead intelligence, HubSpot on our marketing website (see Sections 3.3 and 3.4), and Cookiebot to manage cookie consent. These operate on the marketing website rather than within the platform.

3.2 Legal Requirements

We may disclose your information if required by law or in response to:

• Subpoenas, court orders, or legal process
• Law enforcement requests (with valid legal authority)
• National security requirements
• Protection of our rights, property, or safety
• Prevention of fraud, illegal activity, or security threats

We will notify you of such requests unless prohibited by law or if notification would compromise an investigation.

3.3 Google Analytics

Our website uses Google Analytics 4 to analyze visitor behavior. Google Analytics collects:

• Anonymized IP addresses (last octet removed)
• Page views, session duration, and bounce rates
• Browser and device information
• Geographic location (country/city level)

Google's use of this data is governed by Google's Privacy Policy. You can opt out by installing the Google Analytics Opt-out Browser Add-on.

3.4 HubSpot Website Tracking

Our website uses HubSpot's website tracking to understand how visitors engage with our content and to support our sales and marketing. When you consent to marketing cookies, HubSpot may collect:

• IP address and inferred company or organization
• Pages visited, session activity, and referral source
• Browser and device information
• Approximate geographic location

The HubSpot tracking code loads only after you grant marketing consent in our cookie banner; if you decline, it is never loaded and no HubSpot cookie is set. HubSpot's use of this data is governed by HubSpot's Privacy Policy. You can withdraw consent at any time through our cookie banner.

3.5 Business Transfers

If CortexHub is involved in a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred to the acquiring entity. We will notify you via email and/or prominent notice on our website before your information becomes subject to a different privacy policy.

3.6 With Your Consent

We may share your information with third parties when you explicitly consent, such as:

• Authorizing integrations with third-party services (Slack, PagerDuty, etc.)
• Participating in case studies or testimonials
• Sharing anonymized data for research purposes

3.7 Google Workspace Connectors and Limited Use

When you connect a Google Workspace account (for example Gmail, Google Calendar, or Google Drive) to CortexHub, you authorize access to specific data through Google's OAuth consent screen. CortexHub requests only the scopes you approve on that screen, and uses the resulting access solely to provide the features you ask for through the gateway, such as governing, auditing, and enforcing policy on the tool calls your agents make to those Google services. You can review and revoke this access at any time from your Google Account permissions.

In line with those Limited Use requirements, for data accessed through Google Workspace scopes:

• We use Google user data only to provide and improve the user-facing features you request.
• We do not use Google user data for advertising.
• We do not sell Google user data.
• We do not use Google user data to train generalized or standalone artificial intelligence or machine learning models.
• We do not transfer Google user data except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger or acquisition with prior notice.
• We do not allow humans to read your Google user data unless you give consent for a specific request (such as support you initiate), it is necessary for security purposes such as investigating abuse, we are required to do so by law, or the data has been aggregated and anonymized.

We retain your information for as long as necessary to provide the Services and fulfill the purposes described in this policy:

4.1 Account Data

• Retained for the duration of your account plus 90 days after account deletion
• Billing records retained for 7 years for tax and accounting purposes

4.2 Governance & audit data

• Span retention (tool calls, policy decisions): 365 days
• Audit records & cryptographic receipts: 7 years
• Customer agreement: Extended span retention can be agreed by contract

4.3 Aggregated Analytics

• Anonymized, aggregated data may be retained indefinitely for product improvement
• This data cannot be linked back to individual users or accounts

4.4 Deletion Requests

You may request deletion of your data at any time by emailing privacy@cortexhub.ai. We will delete your data within 30 days of a valid deletion request, except where retention is required by law, security obligations, or resolution of disputes and enforcement of agreements.

We implement industry-standard security measures to protect your information:

5.1 Technical Safeguards

• Encryption: TLS 1.2+ for data in transit, AES-256 for data at rest
• Access Controls: Role-based access with principle of least privilege
• Authentication: Multi-factor authentication (MFA) required for all team members
• API Key Rotation: Regular rotation of access credentials
• Logging: All access to customer data is logged and monitored

5.2 Organizational Safeguards

• Background checks for employees with data access
• Security awareness training for all staff
• Confidentiality agreements with employees and contractors
• Incident response procedures and security playbooks
• Regular security audits and penetration testing

5.3 Infrastructure Security

• Enterprise-grade cloud infrastructure with SOC 2 aligned practices
• DDoS protection and WAF (Web Application Firewall)
• Regular vulnerability scanning and patching
• Network segmentation and firewall rules
• Automated backup and disaster recovery

5.4 Data Breach Notification

In the event of a data breach affecting your personal information, we will:

• Notify affected users without undue delay, and notify the relevant supervisory authority within 72 hours where required by GDPR
• Provide details about the breach, affected data, and remediation steps
• Notify relevant authorities as required by law
• Take immediate action to contain and remediate the breach

Important: No method of transmission over the Internet or electronic storage is 100% secure. While we use commercially reasonable efforts to protect your information, we cannot guarantee absolute security.

Depending on your location, you may have the following rights regarding your personal information:

6.1 GDPR Rights

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data
• Right to Restriction: Limit how we process your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for data processing at any time
• Right to Lodge a Complaint: File a complaint with your local data protection authority

6.2 California Privacy Rights (CCPA/CPRA)

• Right to Know: Request disclosure of data collection and sharing practices
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt out of "sale" of personal information (Note: We do not sell personal information)
• Right to Non-Discrimination: Not be discriminated against for exercising your rights

6.3 How to Exercise Your Rights

To exercise any of these rights, please:

• Email us at privacy@cortexhub.ai
• Access your account settings in the dashboard
• Contact our support team through the help center

We will respond to your request within 30 days. We may request additional information to verify your identity before processing your request.

6.4 Marketing Communications

You can opt out of marketing emails by:

• Clicking the "unsubscribe" link in any marketing email
• Updating your email preferences in your account settings
• Emailing hello@cortexhub.ai

Note: You cannot opt out of transactional emails (account notifications, security alerts, billing receipts) as these are necessary for the Services.

7.1 Hosting

CortexHub hosts its core platform and stores Customer Data in the European Union (Ireland), on enterprise-grade cloud infrastructure. We apply encryption in transit and at rest, access controls, and audit logging to protect Customer Data. Some of our sub-processors (see Section 3.1), including our AI, meeting, email, and payment providers, process data in the United States. Content-delivery edge nodes may process traffic metadata in other regions.

7.2 Cross-Border Transfers

If we transfer personal data across borders, we ensure adequate protection through:

• Standard contractual clauses approved by relevant authorities
• Other legally approved transfer mechanisms

7.3 Enterprise Deployment

Enterprise customers can discuss hosting and deployment preferences based on their compliance requirements. Contact sales@cortexhub.ai for details.

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately at privacy@cortexhub.ai, and we will take steps to delete such information.

Our Services may contain links to third-party websites or integrate with third-party services (e.g., Slack, PagerDuty). We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies.

When you authorize integrations with third-party services, you are granting those services access to certain data. Review the permissions carefully before authorizing.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify you via email or through a prominent notice on our website/dashboard
• Provide at least 30 days' notice before changes take effect

We encourage you to review this Privacy Policy periodically. Your continued use of the Services after changes become effective constitutes acceptance of the updated policy.

For customers subject to GDPR or other data protection regulations, we offer a Data Processing Agreement (DPA) that governs how we process personal data on your behalf.

The DPA includes:

• Details of data processing activities
• Data subject rights and how to exercise them
• Security measures and breach notification procedures
• Sub-processor list and approval process
• Standard contractual clauses (if applicable)

To execute a DPA, contact legal@cortexhub.ai.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: