English translation, provided for convenience. Only the French version is legally binding.
Privacy policy
What Cortex does with your data: what is stored, where, why, for how long, and how to erase it. Every statement on this page matches the code and the production configuration of Cortex.
Controller
The controller of your data is Benjamin Abensur, sole trader (entrepreneur individuel, EI), trading as Benabens, 8 rue du Général Ducrot, 67000 Strasbourg, France. Questions about your data: abensur.benjamin@gmail.com. There is no data protection officer; the publisher handles your requests directly.
What we process, why, and on what basis
For each processing, you will find the data concerned, its purpose, its legal basis under article 6 of the GDPR and how long it is kept.
Your account
You sign in with a Google account. Google handles the sign-in and gives Cortex your e-mail address and, when your Google profile provides them, your name and profile picture; Cortex stores them, along with the tokens Google returns so the sign-in can be renewed. There is no password. Your session is a signed cookie set by Cortex. Cortex sends you no newsletter and no advertising: you only get e-mails from the publisher about your contract (subscription, purchase, replies to your requests).
Legal basis: performance of the contract. Retention: as long as your account exists.
Your courses and files
Everything you import is stored on the server, in a space that belongs to your account: the files, the text extracted from them, the search index built from that text, the exams and exercises generated for you, the images of exam pages rendered for analysis, and the screenshots you attach to a weak point. Text extraction, indexing, search and page rendering run on the Cortex server: no third-party search or text-recognition service receives your files.
Legal basis: performance of the contract. Retention: until you delete them, or delete your account.
Requests sent to the AI model
To generate a question, an exercise or an exam, correct an answer or analyse a weak point, Cortex sends to Anthropic, through its API, the excerpts of your material relevant to the request, your question or your answer, the note and screenshot of a weak point, the text of a conversation when you ask Cortex to look for weak points in it and, for exam analysis, images of exam pages. This data is processed in the United States to produce the response. Anthropic does not use it to train its models and deletes it automatically within 30 days, unless it is flagged for a breach of its usage policy (kept for up to 2 years) or the law requires it to be kept. The responses come back to your space and are stored there. Cortex does not train any model on your files and does not share them with anyone else.
Legal basis: performance of the contract.
Credits, limits and costs
Cortex records your credit transactions, the number of your generations and assists per day and, for each model call, your user id, the course, the token counts and the cost.
Legal basis: performance of the contract to keep your credit balance; the publisher's legitimate interest in controlling costs and preventing abuse for the counters and cost tracking. Retention: as long as your account exists. When the account is deleted, cost tracking is anonymised (kept without any link to you) and the rest is erased.
Payments and invoicing
Payments are handled by Stripe, on its own pages: Cortex never sees your card details. Cortex keeps your Stripe customer id, the plan or pack you bought, the credits granted, the payment events sent by Stripe, the references of your invoices, and the version and date of the terms you accepted and the date of your request for immediate access.
Legal basis: performance of the contract, and the legal obligation to keep accounts for invoices. Retention: in the Cortex database, until your account is deleted. Invoices and payment records, kept in Stripe on the publisher's behalf, are retained for 10 years (article L123-22 of the French Commercial Code): deleting your account does not erase them.
The proof that you accepted the terms, of your express requests before purchase and of your withdrawal requests is kept for 5 years after the account is deleted, detached from your identity (random identifier, no e-mail address), so that the contract can be established in case of a dispute. Legal basis: the publisher's legitimate interest in defending legal claims.
Technical logs and security
The server logs record each model call (provider, model, duration, token counts), errors, the steps of generations, and incoming requests with your user id and IP address. Railway keeps them for 7 days (Railway log retention).
Legal basis: the publisher's legitimate interest in keeping the service secure and working.
This website
This website sets no cookies and uses no analytics or advertising trackers. It is hosted by Vercel, which processes your IP address to serve the pages. It loads its fonts from Google Fonts and, on the home page, its scripts from cdnjs (Cloudflare): these services also see your IP address when the page loads.
Legal basis: the publisher's legitimate interest in displaying its website.
Your messages to us
When you write to us, we keep your e-mail address and your message to reply. Legal basis: the publisher's legitimate interest in answering your requests, or performance of the contract when they concern it. Retention: 3 years after your last message.
Who receives your data
Your data is not sold, rented or used for advertising. It is only passed to the providers below, each for its own task, and to authorities that request it where the law provides for it.
- Railway Corporation, United States, processor: hosting of the application, the database, your files and the logs, and storage of the backups, which Railway entrusts to Tigris (Railway's policy).
- Anthropic (Anthropic Ireland, Limited, Ireland, which relies on Anthropic PBC, United States), processor: AI model (Anthropic's policy).
- Stripe (Stripe Payments Europe, Limited, Ireland, and Stripe, LLC, United States): payment. Stripe processes payment data to carry out the payment and, as an independent controller, for its own obligations, such as fraud prevention and its regulatory obligations (Stripe's policy).
- Resend (Plus Five Five, Inc., United States), processor: sending the e-mails about your contract, such as the acknowledgement of a withdrawal (Resend's policy).
- Vercel Inc., United States, processor: hosting of this website (Vercel's policy).
- Google: sign-in with Google, as controller of your Google account, and the fonts of this website (Google's policy).
- Cloudflare, Inc., United States: delivery of the home page scripts (cdnjs).
Transfers outside the European Union
Your data is hosted outside the European Union: the application and its database run on Railway in the us-west2 region (California, United States), and requests to the AI model are processed in the United States by Anthropic. The backups are stored in Amsterdam. Each transfer relies on a safeguard provided by the GDPR, either the company's certification under the EU–U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023), or the standard contractual clauses adopted by the Commission:
- Railway: Railway Corporation is certified under the Data Privacy Framework; its data processing agreement also provides for the standard contractual clauses.
- Anthropic: Anthropic is not certified under the Data Privacy Framework: the transfer relies on the standard contractual clauses in its data processing agreement.
- Stripe: Stripe, LLC is certified under the Data Privacy Framework, and Stripe's data protection agreement provides for the standard contractual clauses.
- Resend: the transfer relies on the standard contractual clauses in the data processing agreement of Resend (Plus Five Five, Inc.).
- Vercel: Vercel Inc. is certified under the Data Privacy Framework.
- Google: Google LLC is certified under the Data Privacy Framework.
- Cloudflare: Cloudflare, Inc. is certified under the Data Privacy Framework.
If you are in Switzerland, these transfers rely on the equivalent safeguards recognised by the Swiss Federal Act on Data Protection (nFADP).
Backups
Every day at 3:00 UTC, Cortex backs up its database and your files (a Postgres dump and an archive of the storage volume) to a Railway Buckets storage space, located in Amsterdam (Netherlands) and provided by Railway on Tigris infrastructure. Backups are kept for 14 days, then deleted.
Retention periods
- Account, courses and files: as long as your account exists.
- Backups: 14 days.
- Server logs: 7 days.
- Requests to the AI model, at Anthropic: 30 days (up to 2 years for content flagged for a breach of its usage policy).
- Credits and counters: as long as your account exists; cost tracking is then anonymised.
- Invoices and payment records: 10 years, even after your account is deleted.
- Proof of acceptance of the terms, of express requests and of withdrawals: 5 years after the account is deleted, detached from your identity.
- E-mail exchanges: 3 years after your last message.
Deleting and exporting your data
In the app you can delete an imported source (the file and its indexed text), a generated exam (its questions and its PDF), a weak point (the note and its screenshot) or a whole course with all its data. Deletion is immediate. Cortex erases nothing on its own.
To delete your account and everything in it, use "Delete my account" in My account, or write to abensur.benjamin@gmail.com. Your data is erased immediately from the database and the files, and disappears from the backups within 14 days, when the last backup that contains it expires. Only the anonymised cost tracking remains, along with the contractual proof detached from your identity and the invoices and payment records kept in Stripe (see above). If you have a Pro subscription, deleting your account ends it (section 7 of the terms).
You can also take your data with you: "Export my data" in My account gives you an archive with your profile, your courses and all their data, your credit history and the files you imported.
Your rights
The GDPR applies because the controller is established in France. You can ask for access to your data, its rectification, its erasure, the restriction of its processing and its portability, and object to processing based on legitimate interest. You can also set instructions for what happens to your data after your death (article 85 of the French Data Protection Act). Write to abensur.benjamin@gmail.com, preferably from your account's address; we reply within one month.
You can lodge a complaint with the CNIL, the French data protection authority (cnil.fr). If you are in Switzerland, the Swiss Federal Act on Data Protection (nFADP) applies as well, and you can turn to the Federal Data Protection and Information Commissioner (FDPIC).
Your e-mail address is required to create an account: without it, Cortex cannot provide the service. No decision producing legal effects concerning you, or similarly significantly affecting you, is taken solely by automated processing: the corrections and grades produced by the AI are study aids, with no effect on your official results.
Cookies
The app sets a single cookie: your session cookie, strictly necessary to keep you signed in, which therefore does not require your consent. This website sets none. Stripe's payment pages set their own cookies, under Stripe's responsibility.
Minors
Cortex sets no minimum age. If you are under 15, the processing of your data requires consent given jointly by you and by the holder or holders of parental authority (article 45 of the French Data Protection Act): create and use your account with their agreement. A holder of parental authority can write to us at abensur.benjamin@gmail.com to see, correct or delete the data of a minor under 15. Purchases are reserved for adults, or for minors who have the agreement of their legal representative.
Changes
When this policy changes, the date below is updated. If a change affects how your data is used, you are told by e-mail before it applies.