Privacy Policy
Cortex is a marketing platform that lets businesses connect their own marketing and commerce accounts and manage their marketing in one place. This policy explains what we collect, why, and how it is handled.
1 · Information we collect
- Account information. Name, email address, and password (stored hashed) when you create a Cortex account.
- Connected platform data. When you connect an account (for example Meta, TikTok, Google, or Shopify) through that platform's official authorization (OAuth) flow, Cortex accesses the data you authorize, such as pages, posts, engagement metrics, ad campaigns and their performance, product catalogs, orders, and customer records. Cortex only receives what the platform permits for the permissions you approve, and you can disconnect at any time.
- Content you provide. Documents, links, text, and media you upload so Cortex can build your business profile and operate your marketing.
- Usage data. Basic logs of how the product is used (pages visited, actions taken) to operate and improve the service.
2 · How we use information
- To provide the product: displaying your marketing data, publishing content you schedule, creating and managing ad campaigns you configure, and producing analytics and insights.
- To build your business profile from the materials and accounts you connect. AI models process this data to generate profiles, insights, and recommendations inside the product.
- To maintain security, prevent abuse, and comply with legal obligations.
We do not sell your data, and we never use one customer's identifiable data to serve another customer. To improve Cortex 1's features, models, and services, we may use aggregated, de-identified information, patterns of what performs, never data that identifies you, your business, or your customers. You can opt out of this use at any time by emailing management@exodia1.com. Where a connected platform's terms restrict such use, those terms prevail.
3 · Platform data terms
Data received from connected platforms is used only to provide and improve user-facing features of Cortex, in line with each platform's developer policies (including the Meta Platform Terms, TikTok Developer Terms, Google API Services User Data Policy including its Limited Use requirements, and Shopify API Terms). Data obtained through these APIs is never transferred to data brokers and never used for advertising databases or credit eligibility.
4 · Storage and processors
Cortex shares the information needed for the feature you use with the following providers. A provider used only by an optional or configured feature receives data when that feature runs.
- Anthropic. Business profiles, supplied text, documents and images, connected-account facts, conversation history and relevant customer messages are sent to its models to read your business, draft replies and plans, and produce recommendations. Its web search may receive queries about your business and sources.
- OpenAI. The same relevant text, documents, images, account facts and conversation context may be sent for model calls and the second-provider fallback. OpenAI also receives image-generation prompts and reference images, images and product details for image descriptions, text for spoken briefs, and microphone audio and delegated business answers during voice conversations. Its web search may receive business-related queries.
- BytePlus. When configured for image generation, it receives the creative brief and chosen reference images. When video generation is explicitly enabled and configured, it receives the approved brief, reference images or videos and sound instructions to generate the requested video. Video generation is otherwise disabled.
- Vercel. Our host receives requests, account and business information handled by the app, and operational logs to serve Cortex and run its server functions.
- Supabase. Our database and file storage hold account and business records, connected-platform credentials and data, messages, uploaded and generated files, and action and payment receipts. Media shared for publication or generation may use public file URLs so the chosen platform or creative provider can fetch it.
- Connected platforms: Meta (Facebook and Instagram), Shopify, TikTok, Google, Snapchat and LinkedIn. These platforms receive authorization and account identifiers, permitted reads, and the content, media, product or customer changes, ad creative, budgets and targeting needed for actions you request or rules you arm. Each platform receives the information needed for its own connection and supported actions, not every feature of Cortex.
- Jina AI and websites you ask Cortex to read. Jina's website reader receives public source URLs to retrieve their content. Cortex may also request those pages or media directly from their hosts to read the sources you provide.
- X and Google YouTube. When their public-listening access is configured, they receive the brand, competitor or creator search terms you set so Cortex can read matching public posts, videos and comments.
- WorkOS. When you approve an external AI tool connection, its authorization service receives your email, the authorization request and the approved business access grant to complete that connection. The tool you authorize receives the business reads allowed by that grant.
- Notification delivery. If you opt in, Resend receives your account email address, a generic event name and a signed-in Cortex link to send email notifications. Your browser push service (Google, Mozilla, Apple or Microsoft, according to your browser) receives an encrypted generic event notification and an opaque Cortex link. Push endpoints and keys are stored encrypted in Cortex. Customer messages, order amounts and business content are not included in these external notifications.
- Paymob. When you start an available checkout, it receives your billing name, email, phone and address details, the purchase amount and currency, and the checkout reference to process payment. Card entry takes place on Paymob's hosted checkout; Cortex stores the resulting payment and purchase receipts.
Connected-platform access tokens are stored to maintain your connections and used for the reads and actions you authorize.
5 · Retention and deletion
Data is retained while your account is active. You may disconnect a platform or withdraw permissions in its settings. Deleting your account in Cortex stops sign-in and new automation immediately. Your data is retained for a 30-day restore period, then queued for erasure of owned files and records. You can restore during that period; former sessions remain revoked and automation stays off until you enable it. Erasure can be delayed by an outage or retry. Financial payment and usage receipts retain their existing amounts and provider references with the account link removed; checkout credentials are erased. You may also request deletion by emailing management@exodia1.com.
Notification delivery receipts and queued event identifiers are kept for 90 days to prevent duplicate sends. Deleting the account or business removes its scoped notification records. Browser delivery can be stopped from Notifications; email delivery is opt-in and can be switched off there.
6 · Cookies
Cortex uses essential cookies for sign-in sessions. We do not run third-party advertising cookies on the product.
7 · Your rights
You may request access to, correction of, or deletion of your personal data, and you may withdraw platform permissions at any time from the platform's own settings or from inside Cortex.
8 · Changes
We will post any changes to this policy on this page with an updated effective date.
9 · Contact
E1 Solutions (Exodia 1) · New Cairo, Egypt · management@exodia1.com