Privacy policy

CORTEX is a software studio run by Israel Waks and Berel Green, based in Florida, USA. We decide how the information described on this page is used, which under privacy law makes us its controller.

Reach us any time at info@cortexbuilt.com. If you need written contact details for a formal privacy request, ask and we will send them.

• The Bottleneck Session: the AI intake chat. We receive whatever you type into it: your description of the problem in your business, and then your name and phone or email if you choose to give them at the end. Nothing from the chat is collected before you send your first message.
• The contact form on the home page, and the fallback form on the build page: these send nothing to our servers. They open your own email app with a message pre-filled, and nothing leaves your device until you press send there. Whatever you send arrives with us as an ordinary email.
• Server and CDN logs: Vercel, who host and serve this site, record the standard technical data every web server records: IP address, browser user agent, the page requested, and the time. We use it to keep the site running and to spot abuse.
• Page views: we count reads of each page twice over, and neither count can identify you. Vercel Web Analytics loads on every page and records the page you opened, where you arrived from, and coarse technical facts like country, browser and device type. Separately, we keep our own tally in the database described below. For each page shown we store the path you opened, the website you arrived from if any, whether the screen was a phone, tablet or desktop, the country, the time, and, only if you accepted the cookie described further down, the random visitor id from that cookie. We store no IP address and no browser user-agent string in either count. If you did not accept, the id is simply blank and your visit is indis­tinguishable from anyone else's, exactly as it was before. Neither count follows you to other sites. Both tell us a page was read; only the id tells us that two reads came from the same browser, and never who is using it.
• Abuse protection: to rate-limit the chat endpoints we hold a short-lived counter in memory, keyed on your IP address. It is never written to disk, never logged, and disappears when the server process recycles.

We do not ask for payment details, government ID, health information, or any other sensitive category of data. Please don't type any of it into the chat.

One reason: to answer you. We read what you send, work out what we would build, and follow up about your enquiry. In legal terms that is our legitimate interest in responding to someone who asked us to, and steps taken at your request before entering into a contract.

We do not sell it, rent it, or use it for advertising or profiling.

Four companies handle any of this for us. Here is the whole list, and what each one actually gets.

• Anthropic: the AI chat is powered by Claude. Every message you type in the chat, and every reply, is sent to Anthropic's API so the reply can be generated. Anthropic processes it as our service provider under its commercial API terms; Anthropic states that it does not train its models on inputs or outputs submitted through that API by default.
• Supabase:when you give a name and a contact at the end of the chat, that lead is written to a Postgres database Supabase hosts for us. The row holds your name, the contact you gave, our summary of the problem, what we would build for it, and the full text of the conversation. That row is where a lead actually lives: a separate CORTEX dashboard reads the same table, so anyone who runs that dashboard for us sees the same rows we do. The same database also holds the page-view tally described above, in its own table, which contains nothing that could be traced to a person. Supabase stores both as our service provider and does nothing else with them.
• Telegram:the same lead is also sent as a message into a private group the two founders share, so one of us sees it on a phone rather than only when someone opens the dashboard. That message carries the same details as the database row, including the conversation. It sits in that group's history until it is deleted, on Telegram's servers and on the phones signed into it.
• Vercel:hosts and serves this site, holds the request logs described above, and provides the page-view counting described above.

One more delivery route exists in the code and is switched off: a lead can also be forwarded to one other system of ours over a signed connection. It is not configured today, so nothing is forwarded anywhere. We name it because the wiring is there and we would rather tell you now than start using it quietly. If it is switched on, we update this page.

Beyond that, nobody: no data brokers, no advertisers, no ad networks, and nobody paying us for it. We will disclose information only where a law or a valid legal order requires it.

These providers operate internationally, so your information may be processed outside your own country, including in the United States.

The Bottleneck Session is not a person and not a scripted form. It is Claude, Anthropic's model, following a brief we wrote. That means the words you type are processed by Anthropic to produce each reply, under Anthropic's API terms, before any human at CORTEX reads them.

Our server does not log the content of your messages. If the chat fails mid-answer we swallow the error rather than record it, precisely because the error could carry what you wrote.

This site sets one cookie, and only if you say yes to it first. It is called cx_vid, it holds a random string of letters and numbers generated in your own browser, and it exists for exactly one reason: so that when you come back we can tell it is the same browser and not count you as a brand new person all over again. It lasts twelve months.

That random string is not derived from anything about you. It is not your name, your address, your email or your device. It is a number picked at random the first time you agree, and it means nothing anywhere except inside our own visit counter. We never attach it to anything you type into the chat or the contact form, and we never send it anywhere else.

Until you choose, no cookie is set. Decline and none is ever set: your visit still counts, just as one anonymous read with no id on it, exactly the way every visit was counted before this cookie existed. You can change your mind at any time, as described below.

There is still no tracking pixel, no advertising tag, no session recording, and nothing that follows you from this site to any other one. We do not sell or share what we collect, and no ad network receives any part of it.

One thing that is not ours: the live client previews. Opening one loads that company's own website inside a frame on this page, and their site can set its own cookies and storage while it is open, exactly as it would if you typed their address into your browser. Those are theirs and we neither read them nor receive anything from inside that frame, and nothing loads at all until you choose to open the preview.

Besides that cookie we keep up to three small entries in your browser's own storage, none of which is ever sent to our server. sky-mode remembers whether you picked the day or night sky. cx-cookie-choice remembers whether you accepted or declined the cookie above, so we stop asking. cortex-analytics-opt-out appears only if you turn counting off entirely, as described below. Each holds a single word, stays on your device, and contains nothing personal. Clear your browser storage and all three are gone, along with the cookie.

Changing your mind about the cookie. Whatever you chose, you can undo it. Clearing this site's cookies and storage in your browser removes cx_vid along with the record of your answer, and the question is simply asked again the next time you visit. Declining does not reduce anything about the site: nothing is gated behind it, and no feature stops working.

Not being counted at all. Declining the cookie stops the id, not the anonymous tally. If you would rather this site did not count your visits in any form, open cortexbuilt.com/?analytics=off once and this browser stops sending page views. Open cortexbuilt.com/?analytics=on to undo it. We also honour Global Privacy Control and Do Not Track automatically, so if your browser already sends either signal there is nothing for you to do. The setting lives in this browser only, and the counting has no idea who you are, which is also why we cannot switch it off for you from our end.

A lead is not a passing message. It is a row in a database, and it stays there until someone removes it. Here is where each piece sits and how long it lasts.

• Chat transcript and lead: stored as a row in the Supabase database described above, as a message in the founders' private Telegram group, and in whatever email thread or notes the follow-up creates. It persists in each of those: nothing expires it automatically, and we have set no retention period, so it stays until it is deleted by hand. We keep it while we are talking and for as long as you are a prospective or current client. Ask us to delete it and we remove the row, the Telegram message and the follow-up records with it.
• Email you send us: kept in the founders' inbox like any other email.
• Server and CDN logs: retained by Vercel on its own schedule, typically a short rolling window.
• Page-view counts: the Vercel side is held as aggregate statistics on its own schedule, with nothing in it that points at you. Our own tally is one row per page shown, kept indefinitely so we can compare one month against another. Those rows hold no address and no browser string, so if you declined the cookie there is genuinely nothing in them to find or remove. If you accepted, the rows from your browser carry that random id, and it is the one thing here we can look up. You do not have to ask us to remove it: the button just below deletes every row carrying your id immediately, without going through us. Prefer to email? Write to info@cortexbuilt.com and we will do it by hand.
• Rate-limit counters: minutes, in memory only, then gone.

Wherever you live, we will honour these: ask what we hold about you, get a copy of it, have it corrected, have it deleted, or tell us to stop using it.

If you are in the UK or the EU, the UK GDPR and the GDPR give you those rights formally, plus the right to object to processing based on legitimate interests, the right to data portability, and the right to complain to your national data protection authority.

If you are in California, the CCPA and CPRA give you the right to know, delete, and correct, and the right not to be treated worse for asking. We do not sell or share personal information as those laws define it, so there is no opt-out to click.

To use any of them, email info@cortexbuilt.com. Mention roughly when you used the chat so we can find the right record. We aim to respond within 30 days, and we never charge for it.

This site is for business owners. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has sent us something, email info@cortexbuilt.com and we will delete it.

API keys and database credentials live only on the server and never reach your browser, the site is served over HTTPS, and message content is not logged. No site is perfectly secure, though, and a stored lead is only as private as the accounts that can open the dashboard holding it and the phones signed into the Telegram group it is sent to, so treat the chat the way you would treat an email, and leave secrets out of it.

If how any of this works changes, we update this page and move the date at the top. Material changes get spelled out here rather than slipped in.

Questions, corrections, or a deletion request go to the same place: info@cortexbuilt.com.

Our website terms of use are on the terms page.