In short:
- We never sell your personal data or your content.
- We use your content, and the responses models give you, to train or improve our models only if you opt in, and you can withdraw at any time.
- You can export or delete your data whenever you wish, in the console or by asking us.
- Analytics and advertising cookies load only if you say yes.
- In the managed cloud, your data is stored in India. Steps on the Kortecx engine run on GPU capacity outside India, and a step you send to a model provider you chose goes where that provider runs.
1. Who We Are & Scope
Kortecx Private Limited ("Kortecx," "we," "us," or "our") is a company incorporated in India. This Privacy Policy explains how we collect, use, keep, share, and protect personal data in connection with the Kortecx agentic runtime, offered as a managed cloud service (the "managed cloud"), this website, kortecx.com, and our communications with you (together, the "Services").
We act in two roles, and the role decides whose instructions govern the data:
- As a controller (a "Data Fiduciary" under India's DPDP Act) for account, billing, website, waitlist, consent, and communications data, and for any data you allow us to use to improve our models (Section 5).
- As a processor (a "Data Processor" under DPDP, a "service provider" under CCPA/CPRA) for Customer Content and Outputs we process for an organization that uses the managed cloud. That organization's instructions, its own privacy notice, and our agreement with it, including our Data Processing Addendum ("DPA") once it is signed, govern that processing. If you use the Services through your employer, contact your employer first about Customer Content.
This Policy is written to meet our obligations under the laws that apply to us, including India's Digital Personal Data Protection Act, 2023 and its Rules ("DPDP"), the EU General Data Protection Regulation ("GDPR"), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA ("CCPA"), Brazil's LGPD, and other comparable laws. Where those laws give you more rights than this Policy describes, the law prevails.
Kortecx is in preview: features and limits may change, and we will update this Policy, with its date, when they change what we do with personal data.
2. Definitions
- "Customer Content" — the prompts, files, instructions, tool results, and run records you or your organization submit to or create in the managed cloud.
- "Outputs" — the responses a model generates for you and the results of the work the runtime carries out, whether the model is the Kortecx engine or a model provider you connected.
- "The Kortecx engine" — our own models, which we run on GPU capacity from infrastructure providers outside India.
- "Your model provider" — a third-party model provider from our approved list that you connect to the Services with your own key.
- "Personal data" — information about an identified or identifiable person ("personal information" under CCPA).
3. Information We Collect
We collect only what we need for the purposes in Section 4:
- Account information: name, work email, organization, role, and your sign-in details.
- Customer Content and Outputs: what you submit to the managed cloud, the responses models return, and the record of each run (what ran, when, and how it ended).
- Usage and operational data: which features are used, request metadata, counts, durations, error codes, and performance measurements.
- Billing data: plan, billed usage, invoices, and tax details; when you pay by card, payment details from the payment provider. We never receive or store full payment card numbers.
- Device and log data: network address, browser, device type, language, time zone, and security event logs.
- Communications: messages you send us for support, sales, security reports, or a privacy request, and our replies.
- Waitlist and contact requests: when you ask for a place on the waitlist from the home page, the words of your request, your email address, when you sent it, and whether you ticked "Send me occasional news"; when you write to us from the contact page, your name if you give it, your email address, and your message.
- Consent records: each choice you make in the cookie banner, kept as proof of your consent (Section 17).
- Website visits: our host records each request to the website (the network address, the page, the time, and the browser) for security and operations. With your consent only, Google Analytics, Google Ads, the LinkedIn Insight Tag, and the X pixel also collect information about your visit (Section 17).
We do not ask for, and you should not submit, special categories of personal data (such as health, biometric, or genetic data), government identity numbers, or payment card numbers, except where a signed agreement with us provides for it (see Section 15 for health data).
4. How We Use Information
We use personal data to:
- provide, operate, and support the Services, including running the work you ask the runtime to do;
- authenticate users, secure the Services, and detect, investigate, and prevent fraud, abuse, and security incidents;
- bill for the Services and keep the records tax and company law require;
- answer your waitlist and contact requests, and tell you when the Services are open to you;
- send service, security, and legal notices, and, only if you ask for it, our newsletter, which Substack sends for us;
- keep the Services reliable and fast, using usage and operational data that does not contain your content;
- with your consent only, train and improve our models and processes (Section 5);
- with your consent only, count visits to the website and measure and show our advertising (Section 17);
- meet legal and regulatory obligations, and establish, exercise, or defend legal claims.
We do not use Customer Content or Outputs to build advertising profiles, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects (Section 11).
5. Training & Improving Our Models — Only With Your Consent
Off by default. We do not use Customer Content or Outputs to train, evaluate, or improve the Kortecx engine or our processes unless you opt in. This is true whether the Output came from the Kortecx engine or from your model provider. Opting in is a separate choice from accepting our terms, and nothing is ever pre-selected for you. The Services offer no way to opt in today, so none of your content is used this way; when they do, opting in works as this Section describes.
- Who decides. You decide for your own account. In an organization's workspace, an administrator authorized by the organization decides for the workspace. We record who opted in, when, for what, and under which version of this Policy.
- What you choose. Your consent names its scope: which Customer Content and Outputs may be used, and for which purpose (training, evaluation, or improving our processes). We use nothing outside that scope.
- What we do first. Before data you opted in is used, we remove the credentials, keys, and secrets we detect, and direct identifiers the purpose does not need.
- Your model provider's terms. We use an Output from your model provider only where that provider's terms allow it to be used for this purpose.
- Never in scope. Health information, payment card data, and data an organization's agreement with us excludes are never covered by an opt-in. Nothing the website collects is used to train a model.
- Withdraw at any time. You can withdraw consent at any time, as easily as you gave it, by writing to us at hello@kortecx.com. From then on we do not use that data in any new training or evaluation, and we delete our training copies of it promptly, and within 90 days. A model trained before you withdrew is not retrained.
- Feedback is not consent. Rating a response or reporting a problem does not opt you in. If we ever want to use a response you rated to improve our models, we ask at that moment, and only a yes counts.
Without your opt-in, we use only operational data that contains none of your content (such as counts, durations, and error codes) to run, secure, and improve the reliability of the Services. Withdrawing or refusing consent never changes the Services you receive, their price, or their quality.
6. Your Data, Your Control: Keep, Export, Delete
- It stays yours. You own your Customer Content and, as far as the law allows, your Outputs. We keep them for as long as your account is active.
- Export at any time. You can export your Customer Content and Outputs at any time, from the console where it offers an export, or by asking us. We provide it in a structured, commonly used, machine-readable format.
- Delete at any time. You can delete individual items in the console where it offers deletion, and runs, workspaces or your whole account by asking us. Deleted data leaves our live systems promptly, and our backups within 90 days, unless the law or a legal hold requires us to keep it, or it is needed to resolve a dispute, enforce our agreements, or investigate a security incident. Then we keep only what is needed, only for as long as it is needed, and we confirm a deletion in writing if you ask.
- Waitlist and website data. Ask us at hello@kortecx.com and we delete your waitlist request, your messages, and your consent choices, other than the consent record itself (Section 13).
7. We Never Sell Your Data; You May License Your Own
We do not sell your personal data or your Customer Content, and we do not license it to anyone for their own purposes. The one exception is website advertising cookies you allow, which CCPA treats as "sharing" (Section 17).
Your data is yours to license. You may sell or license your own Customer Content and Outputs to anyone you choose: you can export them at any time (Section 6). We take no part in such a sale, and we run no marketplace for data. There is no setting for this in the Services today; if you want us to deliver your data to a purchaser directly, that happens only on your written instruction, and it is off unless you give one:
- your instruction names the data, the purchaser, and the purpose, and you agree the price and terms with the purchaser;
- we transfer only what your instruction names, to that purchaser alone, and record the transfer;
- you can withdraw the instruction at any time for any transfer not yet made; data already transferred is governed by your agreement with the purchaser;
- you must have the right to license the data, including a lawful basis and any consent needed for personal data of other people it contains;
- in an organization's workspace, only an administrator authorized by the organization can give the instruction.
8. Legal Bases for Processing
Under GDPR and the UK GDPR, each use has a legal basis; under DPDP we process personal data with your consent or for a legitimate use the Act allows:
| Use | GDPR / UK GDPR | DPDP |
|---|---|---|
| Providing the Services and support | Contract | Consent, or the purpose you gave the data for |
| Security, fraud, and abuse prevention | Legitimate interests | Legitimate use |
| Billing, tax, and legal records | Legal obligation | Compliance with law |
| Answering waitlist and contact requests | Legitimate interests, or steps before a contract | The purpose you gave the data for |
| Reliability, from data without your content | Legitimate interests | Legitimate use |
| Training and improving our models | Consent | Consent |
| Website analytics and advertising | Consent | Consent |
| Licensing your data to a purchaser | Consent and your instruction | Consent |
Where we rely on legitimate interests, we have weighed them against your rights, and you can object (Section 14). Where we rely on consent, you can withdraw it at any time, without affecting what was lawful before.
10. Your Model Provider
A step that uses your model provider sends that provider the Customer Content the step needs, under your account with the provider and its terms. The provider processes it as its terms say, including any retention for abuse monitoring, and in the places where it operates. Kortecx does not control how a provider processes data sent to it. Read your provider's terms and, where it offers them, choose its options for not training on your data and for keeping no data. Connect a provider's business or API offering: some providers' free tiers use what you send to train their models.
11. Automated Decision-Making
The runtime carries out automated reasoning and actions on your behalf. Kortecx does not use them to make decisions about you with legal or similarly significant effects. If you use the Services for work that may have such effects on others (for example, in hiring, credit, insurance, healthcare, or legal matters), you are responsible for the human review, transparency, and contestability that apply to you, including under GDPR Article 22 and the EU AI Act.
12. Security
We protect personal data with administrative, technical, and physical safeguards suited to the risk, including encryption in transit and at rest, access limited to the people and systems that need it, separate credentials for each system with only the permissions it needs, security logging, and a written process for responding to incidents. Our staff access Customer Content only to give support you ask for, to investigate misuse or a security incident, or when the law requires it. The runtime can hold a step you mark as needing approval until it is approved, and refuses actions outside what you granted. Our Trust Center describes these practices, and what we do not claim.
If a personal-data breach affects you, we notify you and the authorities as the law requires: under GDPR, the supervisory authority within 72 hours of becoming aware of it where it is likely to put you at risk; under DPDP, the Data Protection Board of India and each affected person without delay. We report cyber incidents to CERT-In as Indian law requires. Customers are notified without undue delay. No system is perfectly secure; tell us at hello@kortecx.com if you find a weakness.
13. Retention
We keep personal data only as long as the purpose needs it, then delete or anonymize it:
| Data | How long we keep it |
|---|---|
| Customer Content and Outputs | Until you delete them; after an account closes, 30 days to export, then deleted promptly from live systems, and from backups within 90 days |
| Data you opted in to model training | Until you withdraw consent or delete it; our training copies are deleted promptly after withdrawal, and within 90 days |
| Account information | While the account is open, and up to 90 days after it closes |
| Billing and tax records | 8 years, as Indian company and tax law requires |
| Waitlist requests | 24 months after your last request, then deleted automatically, or sooner if you ask |
| The newsletter's list (on Substack) | Until you unsubscribe, which every issue lets you do |
| Contact and support messages | Up to 24 months after the last message |
| Consent records | 5 years after the choice, as proof of consent; they hold no name, address, or network address |
| Website request logs kept by our host | Only as long as needed for security and operations |
| Google Analytics events (with consent) | Up to 14 months |
| Security logs | As long as Indian law requires, and as long as needed to investigate an incident |
Data that has been anonymized so that it can no longer be linked to a person is not personal data, and we may keep it.
14. Your Rights
Depending on where you live, you have these rights, and we honour them wherever you live where we can:
- Everyone: to know what we hold about you and how we use it; to have it corrected, completed, or updated; to have it deleted; to receive it in a portable format; and to withdraw consent at any time.
- EU, EEA, and UK (GDPR): also to restrict or object to processing, to not be subject to a decision based solely on automated processing, and to complain to your supervisory authority.
- India (DPDP): also to have a grievance answered by us, to nominate a person to exercise your rights if you die or become incapable, and, if our answer does not resolve your grievance, to complain to the Data Protection Board of India.
- California and other US states: also to know the categories of data we collect, use, and disclose; to opt out of the sale or sharing of personal information and of targeted advertising; to limit the use of sensitive personal information; to appoint an authorized agent; and not to be treated differently for using any of these rights. We do not sell personal information; to opt out of sharing, use Cookie settings or send a Global Privacy Control signal.
- Brazil (LGPD) and elsewhere: the rights your local law gives you.
To use a right, or to raise a grievance, write to hello@kortecx.com. We may ask you to confirm your identity, and we answer within the time the law sets: one month under GDPR (extendable by two months for complex requests), 45 days under CCPA (extendable by 45 days), and no later than 90 days under DPDP. If we decline a request, we say why; you can appeal by replying to our answer, and we decide an appeal within 60 days. Using these rights is free, unless a request is manifestly unfounded or excessive.
15. Health Information (HIPAA)
The Services are not designed to hold protected health information ("PHI") under the US Health Insurance Portability and Accountability Act ("HIPAA"). Do not submit PHI unless you and Kortecx have signed a Business Associate Agreement. We do not claim HIPAA compliance.
16. International Transfers & Data Residency
In the managed cloud, your data is stored in India. A step that runs on the Kortecx engine is processed on GPU capacity that our infrastructure providers operate outside India, and a step that uses your model provider is processed where that provider runs. Kortecx is not offered for you to run on your own hardware. The website's waitlist and its consent records are stored in Mumbai, India. The mail that carries your request is sent from Mumbai to our mailbox, which GoDaddy hosts and which may be outside India.
Where personal data leaves the country it was collected in (for example, for a step on the Kortecx engine), we use a lawful transfer mechanism: for data from the EU and EEA, the European Commission's Standard Contractual Clauses; for the UK, the International Data Transfer Addendum; and equivalent safeguards elsewhere, with supplementary measures where they are needed. DPDP allows transfers outside India except to countries the Government of India restricts, and we follow any such restriction. Google, LinkedIn, and X may process what their tags collect outside India, under their own terms, and only if you allowed it. Substack, which sends our newsletter, is in the United States.
18. Children
The Services are for adults acting for a business, research, or educational organization, and are not directed to anyone under 18. We do not knowingly collect personal data from children; if we learn that we have, we delete it promptly. A parent or guardian who believes a child has given us personal data can write to hello@kortecx.com.
19. Changes to This Policy
We may update this Policy. The date at the top says when it last changed. We tell customers about a material change at least 30 days before it takes effect, through the Services or by email, and we never apply a change that reduces your rights to data collected before it without your consent. A change to what a cookie category does is asked again in the banner. We keep each earlier version of this Policy and send it to you on request.
20. Contact & Grievances
Kortecx Private Limited is responsible for your personal data under this Policy. For a question, a request under this Policy, a grievance under DPDP, our Data Processing Addendum (being prepared), or a security report, write to hello@kortecx.com. We acknowledge each request and answer within the times in Section 14.
If you are in the EU, EEA, or UK, you can also complain to your data protection supervisory authority. If you are in India and our answer to a grievance does not resolve it, you can complain to the Data Protection Board of India.