Legal

Privacy Policy

Last updated: October 16, 2026

Who we are

Cortox ("Cortox", "we", "us") is operated by Cortox LTD, 71-75 Shelton Street, Covent Garden, London, UK WC2H 9JQ. This policy explains what information we collect through the Cortox application, why we collect it, and how you can control it.

Information we collect

  • Account information — your name and email address, used to sign you in and identify your account.
  • Business data you provide — the customer, product, proposal, task and transaction records you create in Cortox in order to use the product.
  • Billing information — your subscription plan and payment status. Payments are processed by Stripe; Cortox does not receive or store your card number.
  • Communications — emails Cortox sends you (sign-in codes, notifications, proposal links) are delivered through our email provider, Resend.
  • Uploaded images — product/customer images you upload are stored with our media provider, Cloudinary.
  • AI assistant activity — questions you ask Cortox's AI assistant, and the business data needed to answer them, are sent to our AI provider (Anthropic) to generate a response.

How we use your information

We use the information above to:

  • Provide, maintain and secure the Cortox application;
  • Let you and your team manage your own customers, products and proposals;
  • Process subscription payments and send billing-related notices;
  • Respond to support requests you send us; and
  • Improve Cortox's features, including its AI assistant.

We do not sell your personal information.

Where your data is processed

Cortox is hosted on Railway, Vercel and Supabase. Your data may be processed by these infrastructure providers, and by the third-party services above (Stripe, Resend, Cloudinary, Anthropic, and Google if you use Google Sign-In), solely to provide the Cortox service to you.

Data retention

We keep your account and business data for as long as your account is active. If you delete your account, your data is removed in line with our account-deletion process, except where we are required to retain certain records (for example, billing records) for legal or accounting purposes.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to certain processing. You can manage most of this yourself from within Cortox (including a self-service account deletion option), or contact us using the details below and we will assist you.

Cookies

Cortox uses three categories of cookies and similar local storage:

  • Necessary: needed to keep you signed in and to remember your preferences (such as light/dark mode and your cookie choice). These are always on.
  • Analytics: Google Analytics (via Firebase) helps us understand how the site and app are used, such as which pages are visited and which buttons are clicked.
  • Marketing: Google Ads (Google), Metricool, the Meta Pixel (Meta Platforms) and the LinkedIn Insight Tag (LinkedIn) help us measure the reach of our marketing and social media campaigns and the results of our ads on Google, Facebook, Instagram and LinkedIn. In this category we also keep a first-party cookie for up to 30 days recording which campaign or website referred you to us, so that if you create an account we can see which of our campaigns worked.

Analytics and marketing cookies are only set if you allow them. You can change your choice at any time from the "Cookie settings" link at the bottom of every page. Advertising cookies (Google Ads, Meta Pixel, LinkedIn Insight Tag) are part of the Marketing category.

If you allow Marketing cookies, the Meta Pixel and LinkedIn Insight Tag also tell those services when an account is created or a subscription is started, so we can see which of our ads led to a sign-up or purchase. None of these tools run on the public proposal pages that customers open from a link we send on a business's behalf.

We use Google Consent Mode. Until you allow Analytics cookies, Google Analytics still receives basic signals (such as a page being visited) without setting or reading any cookies on your device; Google uses these to estimate overall usage in aggregate.

Where you signed up from. When you arrive through a campaign or ad link, the campaign details in that link (for example its utm_ tags or an ad click ID) are carried to the sign-up page in the link's address. Nothing is stored on your device for this. If you create an account, we record on that account which campaign link you arrived from. This does not depend on your cookie choice and is not used to follow you around.

Visit counts. We use Vercel Web Analytics to count visits and page views. It does not use cookies or store anything on your device, so it runs whatever you chose in the cookie banner. It does not run on the public proposal pages.

Children

Cortox is a business tool and is not directed at, or intended for use by, children.

Changes to this policy

We may update this policy from time to time as Cortox evolves. We will update the "Last updated" date above when we do. This policy is provided for transparency about our current practices and does not itself constitute legal advice.

Contact us

Questions about this policy or your data can be sent to support@cortox.ai or to Cortox LTD, 71-75 Shelton Street, Covent Garden, London, UK WC2H 9JQ.