Privacy Policy

1. Introduction

Cortex9 ("we," "our," or "us") operates the Cortex9 platform at cortex9.com. This Privacy Policy explains how we collect, use, disclose, store, and safeguard your information when you use our platform, including when you connect Google services.

By accessing or using Cortex9, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the platform.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Name and email address (via Google OAuth, or email sign-up)
• Profile photo (if provided by your Google account)
• Organization and role information you choose to provide

2.2 Project and Business Data

To provide our services, we process data you give us, including:

• Website URLs and domain information
• Business descriptions, positioning, goals
• Content, spreadsheets, and documents you upload
• Task, project, and outreach-prospect data

2.3 Third-Party Integration Data

When you connect a third-party service (Google Analytics, Search Console, Gmail, Google Business Profile, YouTube, WordPress, Meta, and others), we access data from those services on your behalf, using OAuth scopes or API credentials that you explicitly authorise. We store the minimum credential necessary to keep the connection working; see section 5 for storage details. YouTube is the exception: you give us your channel link, and we read the channel's public statistics (subscribers, views, latest videos) with our own API key, so connecting YouTube asks for no Google permission.

2.4 Usage Data

We automatically collect log and usage data:

• IP address, browser type, pages visited, features used. Page visits and general usage are counted with Google Analytics (see sections 6 and 9).
• Free website scan (cortex9.com/scan.html): the website address submitted for scanning and the time of the request, collected from visitors with no account
• Device metadata
• AI-request telemetry (model, input/output token counts, estimated cost) for spend attribution and internal capacity planning. Prompt and response text are not retained long-term for analytics purposes.

3. Our Use of Google User Data

Cortex9 uses Google OAuth to access specific Google services on your behalf. Signing in with Google asks only for your name, email address and profile picture. Each data source asks for its own permission, in its own Google window, when you click Connect for that source, and we request only the scope that source needs.

Scope	Purpose (and nothing else)
userinfo.email	Identify the Google account you sign in with or connect, so we can show it back to you and use it as the sender of emails you send through Gmail.
userinfo.profile	Your name and profile picture, received when you sign in with Google and shown on your account. Requested only at sign-in, never by a data connection.
analytics.readonly	Read-only access to Google Analytics 4 properties you select. Populates dashboards and the Executive Report, and is analysed by our AI providers (Google Gemini, Anthropic Claude, and xAI Grok in strategy reviews and knowledge audits) to produce your insights. We do not write to, modify, or delete any analytics data.
webmasters.readonly	Read-only access to Google Search Console data for sites you verify. Used for keyword, page and performance insights, and analysed by our AI providers (Google Gemini, Anthropic Claude, and xAI Grok in strategy reviews and knowledge audits). The SEO Generator, the content-writing engine we use, can also read the Search Console rows of a site set up in it, and uses them only for that same site's content plan and site audit, which you see in Cortex9 (see section 6). If you choose “Use my striking-distance keywords” in Link Gap, up to six of your search terms are looked up through DataForSEO.
business.manage	Read reviews on Google Business Profile locations you select and post replies. Google Gemini analyses the reviews to draft replies, and a reply is posted only when you approve it. A short summary of each review check (number of reviews, average rating, how many are unreplied) is saved in your project's agent notes, which our AI providers and Mem0 can read (see section 6). We never edit your listing.
gmail.send	Send emails from your Gmail that a person on your team wrote or approved inside Cortex9 (see 3.1). We use the narrowest Gmail scope available — we do not request gmail.readonly, gmail.modify, or full Gmail access. We do not read, list, label, delete, or index the contents of your mailbox.

3.1 Gmail-Specific Disclosures

gmail.send is classified by Google as a sensitive scope — we request no restricted scopes at all — and we still apply the strictest limits to it:

• Cortex9 sends email from your Gmail in only two ways. A person on your team clicks Send on one email in Cortex9. Or a person approves a follow-up sequence for one recipient, and Cortex9 then sends that sequence's emails (at most five) on the schedule it sets. Before approving, they can open every email in the sequence and read it in full. Sequences are off unless an administrator turns them on.
• There is no bulk send and no “approve all”: every recipient needs a person's approval. A sequence sends at most 50 emails a day, only during the hours you set, and stops for a recipient who replies or unsubscribes.
• Every email is checked before it is sent against your unsubscribe list, your do-not-contact list and banned words. If one of those lists cannot be read, the email is not sent.
• Emails you send by hand are plain text with no tracking. Sequence emails carry an unsubscribe link and record when the recipient opens the email or clicks a link in it.
• Cortex9 keeps a copy of each outreach email and follow-up it sends in your project's Sent log, so you can see what went out. It is deleted when you delete the project.
• We never read your Gmail. Reply capture is off by default; when it is off, replies to emails you send by hand go to your Gmail and Cortex9 never sees them.
• When you turn reply capture on, and always for sequences so that a reply stops the next email, each email carries a reply address on Cortex9's reply domain. Replies to it are received by our email provider, Resend, and saved in your project for its members to see: the sender's address, the subject and up to 8,000 characters of text. By default we also email you a copy of each reply; you can turn that off.
• If an administrator turns on reply sorting (off by default), Anthropic's Claude reads each captured reply to sort it and may draft an answer for you to approve. We replace a captured reply's text after 90 days and delete the reply after 365 days.
• You can revoke Gmail access at any time at myaccount.google.com/permissions. Cortex9 cannot send from your account after that.

4. How We Use Your Information

We use the collected information to:

• Provide, maintain, and improve the Cortex9 platform
• Generate AI-powered insights, strategies, content drafts, and outreach emails
• Process your data through our AI agents for competitive analysis, SEO tracking, content generation, publishing, and growth scoring
• Facilitate team collaboration and project management
• Send service-related communications (account, billing, security, product updates)
• Secure the platform and investigate abuse

5. Data Storage, Security & Token Handling

5.1 Where data is stored

Your data is stored in Supabase (hosted on AWS in the EU region), with the following protections:

• TLS/SSL encryption in transit for all traffic
• Encryption at rest for the Supabase Postgres database
• Row-level security policies limiting row access to the owning user and explicitly permitted collaborators
• Role-based access controls (RBAC) for the product UI
• Google refresh tokens and our own service keys stay on our servers. Your browser uses a short-lived Google access token during your session, and the publishing keys your team saves for WordPress, Meta and the SEO Generator are kept in your project record and used from the browser

5.2 OAuth tokens

OAuth tokens are handled as follows:

• Short-lived access tokens (typically 1-hour TTL) are held in memory during your session. They are not written to browser local storage.
• Long-lived refresh tokens (for example, the Gmail gmail.send refresh token) are kept in a separate, locked table in our Supabase database, not in your project record. Only our servers can read them; you, your collaborators and your browser cannot. Your browser never receives a refresh token.
• Disconnecting a Google source in Cortex9 deletes its stored token from our database. Your Google account keeps listing Cortex9 until you remove it at myaccount.google.com/permissions; removing it there cancels every connection that Google account made to Cortex9.
• When you delete a project, its stored tokens are deleted with it. For other providers (Meta and others), you can additionally revoke access in that provider's settings.

5.3 Security limits

No method of transmission or storage is 100% secure. While we apply industry-standard protections, we cannot guarantee absolute security. Promptly report suspected incidents to support@cortex9.com.

6. Data Sharing & Sub-Processors

We do not sell your personal information. We share data only with the following categories of parties and only as necessary:

• Sub-processors we rely on to run the service:
  • Supabase — database + authentication (EU region)
  • Vercel — application hosting
  • Google Analytics — statistics on how our website and app are used: the pages you visit (the page address without sign-in codes or other private values), your browser and device type, and your approximate location. We do not use it for advertising.
  • Anthropic — AI model inference (Claude). Anthropic's commercial terms bar training on our data.
  • Google Cloud — OAuth, the Google API calls you authorise, and Gemini API inference, including live voice. On the paid Gemini API, Google does not use prompts or responses to improve its products.
  • xAI — AI model inference (Grok): a second opinion in strategy and quarterly reviews, which includes your Google Analytics and Search Console figures; checking the notes our agents keep, when you turn on Knowledge Audit (these notes can include figures from your Google Analytics, Search Console and Business Profile); searches of public web pages and X posts about competitors; and outreach drafts when you choose Grok for the Outreach agent. xAI's API terms bar training on API data without our permission.
  • Resend — our service emails: team invitations, reports you ask us to email, account and system alerts, and access requests. Report emails include your Google Analytics and Search Console figures and go only to you or the report address you save. When reply capture is on, Resend also receives replies to your outreach and sends you a copy. Your outreach emails are not sent through Resend; they go out from your own Gmail.
  • DataForSEO — SEO data for the domains and search terms you submit, including up to six of your Search Console search terms when you choose “Use my striking-distance keywords” in Link Gap.
  • SEO Generator — the content-writing engine we use to plan and write website content. It receives the business details you add to Cortex9. For a site set up in both, it can also read that site's Search Console rows (pages, search terms, clicks, impressions, click rate, position) and uses them only for that same site: to weigh its content plan and to check its site audit, which you see in Cortex9.
  • Services on our own private server, hosted by Hetzner in the EU: Mem0 (agent memory), n8n (automation) and DSPy (prompt tuning). Mem0 stores notes our agents write, which can include figures from your Google Analytics, Search Console and Business Profile, and sends that text to Anthropic to pick out the key facts. DSPy sends only run details (which agent ran, your website's domain, how many notes and documents it used, and the names of its data sources), never Google data, to Google Gemini or Anthropic.
• Team members you add to a project, scoped by the role you assign them
• Legal requirements when required by law, regulation, or legal process

7. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data and tokens
• Object to or restrict processing of your data
• Data portability
• Withdraw consent at any time

To exercise these rights, contact us at support@cortex9.com. We acknowledge requests within 5 business days and complete them within 30 days (or the shorter timeframe required by applicable law, e.g. GDPR).

8. Data Retention & Deletion

We retain your data for as long as your account is active or as required to provide the service you requested. When you delete a project, associated project data is removed (including OAuth refresh tokens stored for that project). When you delete your Cortex9 account, we delete your account record and associated personal data within 30 days, subject to any minimal retention we are legally required to perform (for example, for billing or audit).

9. Cookies & Local Storage

Cortex9 uses essential cookies and browser local storage for authentication, session management, and user-preference storage. We also use Google Analytics, which sets first-party analytics cookies (named _ga) to count visits and returning visitors. We do not use advertising or cross-site tracking cookies. Local storage writes are stripped of OAuth credentials before persistence.

10. Children's Privacy

Cortex9 is intended for business use and is not directed at anyone under 16. We do not knowingly collect personal information from children. If we learn we have, we will delete it.

11. International Data Transfers

Your data may be transferred to and processed in jurisdictions different from yours. We rely on the Standard Contractual Clauses or equivalent safeguards when data leaves the European Economic Area.

12. Changes to This Policy

We may update this Privacy Policy. Material changes will be announced in-product and reflected in the "Last updated" date above. We will not retroactively apply less-protective changes to data collected under an earlier version without your consent.

13. Contact

• All requests — support, privacy, security, data deletion: support@cortex9.com
• Website: cortex9.com

← Back to Cortex9