Trust Center

1. Our Commitments

• Your data is yours. You own your content and the outputs generated for you. We never sell it.
• Training only with your consent. We use your content, and the responses models give you, to train or improve our models only if you opt in. You can withdraw at any time, and feedback is not consent.
• Keep, export, delete. You can export or delete your data whenever you wish, in the console or by asking us; deleted data leaves our live systems promptly and our backups within 90 days.
• Stored in India. In the managed cloud, your data is stored in India. Steps on the Kortecx engine run on GPU capacity outside India, and a step you send to a model provider you chose goes where that provider runs.
• Cookies only with consent. Analytics and advertising load only if you say yes, and we record each choice as proof.
• No claims we cannot show. We list a certification only after an independent auditor has issued it.

2. Where Your Data Is

The managed cloud stores your data in India. Its steps run on the Kortecx engine, our own models, which we run on GPU capacity that our infrastructure providers operate outside India, unless you choose a model provider for a step. Kortecx is not offered for you to run on your own hardware or in your own cloud.

When a step uses a model provider you connected, that step's input and output go to the provider and are processed where it runs, under its terms and for as long as it keeps them. Several major providers process requests outside India even when they store data in India, and keep requests for a period to check for abuse. Choose a provider's business or API offering and its retention options to suit your data.

3. AI & Your Data

• Off by default. Training, evaluating, or improving our models or processes with your content or outputs needs your opt-in, separate from accepting our terms. An organization's workspace is decided by an administrator it authorizes. The Services offer no way to opt in today, so none of your content is used this way.
• Recorded. Each opt-in is recorded with who gave it, when, its scope, and the version of the policy it was given under; so is each withdrawal.
• Withdrawn means stopped. After you withdraw, your data is in no new training or evaluation, and our training copies of it are deleted promptly, and within 90 days. A model trained before you withdrew is not retrained.
• Provider outputs. We use an output from your model provider only where that provider's terms allow it.
• Never in scope. Health information, payment card data, and anything the website collects.
• Licensing your own data. You may sell or license your data to anyone you choose. We take no part and run no marketplace for data; we deliver data to a purchaser only on your written instruction.

4. Security Practices

• Encryption in transit and at rest.
• Access limited to the people and systems that need it, each system with its own credentials and only the permissions it needs. The website's server, for example, may send mail and write to its two tables, and nothing else; it reads its credentials from its environment and never writes them to code, logs, or answers.
• Our staff access customer content only to give support you ask for, to investigate misuse or a security incident, or when the law requires it.
• The runtime can hold a step you mark as needing approval until it is approved, and refuses actions outside what you granted.
• A written process for responding to incidents.

Incidents. If a breach affects personal data, we notify customers without undue delay, and the authorities as the law requires: the Data Protection Board of India and each affected person under DPDP, the supervisory authority within 72 hours under GDPR, and CERT-In under Indian law.

5. Compliance & Certifications

Laws we follow. Our practices are designed to meet our obligations under India's Digital Personal Data Protection Act, 2023 and its Rules, the EU GDPR, the UK GDPR, the California Consumer Privacy Act as amended by the CPRA, Brazil's LGPD, and India's Information Technology Act, 2000. Our Privacy Policy says how, and what your rights are.

Certifications. Kortecx does not hold a SOC 2 report, an ISO/IEC 27001 certificate, or any other certification or attestation today. We will list one here only after an independent auditor has issued it, and not before.

Health data. We do not sign Business Associate Agreements under the US HIPAA today, so the Services must not be used for protected health information.

6. Sub-processors

These providers process personal data for this website. Google, LinkedIn, and X act under their own terms for what their tags collect, and only if you allowed it.

The managed cloud's sub-processors, among them the providers whose GPU capacity runs the Kortecx engine outside India, are listed on request: ask at hello@kortecx.com. Customers receive notice before one is added.

7. Agreements & Documents

• Privacy Policy and Terms of Use.
• Data Processing Addendum: being prepared, with the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum where they are needed. Ask at hello@kortecx.com.
• Security questionnaires from customers: we answer them; ask at hello@kortecx.com.

8. Reporting a Vulnerability

Report a security vulnerability to hello@kortecx.com, as our security.txt file says. Tell us what you found and how to reproduce it, and give us reasonable time to fix it before you make it public.

We do not pursue legal action against research done in good faith that follows this policy: it does not access, change, or keep other people's data beyond what is needed to show the problem, does not degrade the Services, and does not use social engineering or physical access.

9. Contact

Kortecx Private Limited. For privacy, security, or compliance questions, write to hello@kortecx.com.