Privacy policy

CORTEX is a software studio run by Israel Waks and Berel Green, based in Florida, USA. We decide how the information described on this page is used, which under privacy law makes us its controller.

Reach us any time at info@cortexbuilt.com. If you need written contact details for a formal privacy request, ask and we will send them.

• The Bottleneck Session — the AI intake chat. We receive whatever you type into it: your description of the problem in your business, and then your name and phone or email if you choose to give them at the end. Nothing from the chat is collected before you send your first message.
• The contact form on the home page, and the fallback form on the build page — these send nothing to our servers. They open your own email app with a message pre-filled, and nothing leaves your device until you press send there. Whatever you send arrives with us as an ordinary email.
• Server and CDN logs — Vercel, who host and serve this site, record the standard technical data every web server records: IP address, browser user agent, the page requested, and the time. We use it to keep the site running and to spot abuse.
• Page views — we count reads of each page using Vercel Web Analytics, which loads on every page and records the page you opened, where you arrived from, and coarse technical facts like country, browser and device type. It sets no cookies and puts nothing in your browser. It is enough to tell us that a page was read; it is not enough to tell us who read it, and it does not follow you to other sites.
• Abuse protection — to rate-limit the chat endpoints we hold a short-lived counter in memory, keyed on your IP address. It is never written to disk, never logged, and disappears when the server process recycles.

We do not ask for payment details, government ID, health information, or any other sensitive category of data — please don't type any of it into the chat.

One reason: to answer you. We read what you send, work out what we would build, and follow up about your enquiry. In legal terms that is our legitimate interest in responding to someone who asked us to, and steps taken at your request before entering into a contract.

We do not sell it, rent it, or use it for advertising or profiling.

Four companies handle any of this for us. Here is the whole list, and what each one actually gets.

• Anthropic — the AI chat is powered by Claude. Every message you type in the chat, and every reply, is sent to Anthropic's API so the reply can be generated. Anthropic processes it as our service provider under its commercial API terms; Anthropic states that it does not train its models on inputs or outputs submitted through that API by default.
• Supabase — when you give a name and a contact at the end of the chat, that lead is written to a Postgres database Supabase hosts for us. The row holds your name, the contact you gave, our summary of the problem, what we would build for it, and the full text of the conversation. That row is where a lead actually lives: a separate CORTEX dashboard reads the same table, so anyone who runs that dashboard for us sees the same rows we do. Supabase stores it as our service provider and does nothing else with it.
• Telegram— the same lead is also sent as a message into a private group the two founders share, so one of us sees it on a phone rather than only when someone opens the dashboard. That message carries the same details as the database row, including the conversation. It sits in that group's history until it is deleted, on Telegram's servers and on the phones signed into it.
• Vercel — hosts and serves this site, holds the request logs described above, and provides the page-view counting described above.

One more delivery route exists in the code and is switched off: a lead can also be forwarded to one other system of ours over a signed connection. It is not configured today, so nothing is forwarded anywhere. We name it because the wiring is there and we would rather tell you now than start using it quietly — if it is switched on, we update this page.

Beyond that, nobody: no data brokers, no advertisers, no ad networks, and nobody paying us for it. We will disclose information only where a law or a valid legal order requires it.

These providers operate internationally, so your information may be processed outside your own country, including in the United States.

The Bottleneck Session is not a person and not a scripted form — it is Claude, Anthropic's model, following a brief we wrote. That means the words you type are processed by Anthropic to produce each reply, under Anthropic's API terms, before any human at CORTEX reads them.

Our server does not log the content of your messages. If the chat fails mid-answer we swallow the error rather than record it, precisely because the error could carry what you wrote.

This site sets no cookies. There is no tracking pixel, no advertising tag, no session recording, and nothing that follows you from here to somewhere else. The page-view counting described above is cookieless too — so there is no cookie banner for you to dismiss.

One thing that is not ours: the live client previews. Opening one loads that company's own website inside a frame on this page, and their site can set its own cookies and storage while it is open, exactly as it would if you typed their address into your browser. Those are theirs and we neither read them nor receive anything from inside that frame — and nothing loads at all until you choose to open the preview.

The only thing we put in your browser is a single localStorage entry named sky-mode, written when you use the day/night toggle so the site remembers which sky you prefer. It holds one word, never leaves your device, is never sent to our server, and contains nothing personal. Clear your browser storage and it is gone.

A lead is not a passing message — it is a row in a database, and it stays there until someone removes it. Here is where each piece sits and how long it lasts.

• Chat transcript and lead — stored as a row in the Supabase database described above, as a message in the founders' private Telegram group, and in whatever email thread or notes the follow-up creates. It persists in each of those: nothing expires it automatically, and we have set no retention period, so it stays until it is deleted by hand. We keep it while we are talking and for as long as you are a prospective or current client. Ask us to delete it and we remove the row, the Telegram message and the follow-up records with it.
• Email you send us — kept in the founders' inbox like any other email.
• Server and CDN logs — retained by Vercel on its own schedule, typically a short rolling window.
• Page-view counts — held by Vercel as aggregate statistics on its own schedule. They are not tied to you, so there is nothing in them to pull out or delete on request.
• Rate-limit counters — minutes, in memory only, then gone.

Wherever you live, we will honour these: ask what we hold about you, get a copy of it, have it corrected, have it deleted, or tell us to stop using it.

If you are in the UK or the EU, the UK GDPR and the GDPR give you those rights formally, plus the right to object to processing based on legitimate interests, the right to data portability, and the right to complain to your national data protection authority.

If you are in California, the CCPA and CPRA give you the right to know, delete, and correct, and the right not to be treated worse for asking. We do not sell or share personal information as those laws define it, so there is no opt-out to click.

To use any of them, email info@cortexbuilt.com. Mention roughly when you used the chat so we can find the right record. We aim to respond within 30 days, and we never charge for it.

This site is for business owners. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has sent us something, email info@cortexbuilt.com and we will delete it.

API keys and database credentials live only on the server and never reach your browser, the site is served over HTTPS, and message content is not logged. No site is perfectly secure, though, and a stored lead is only as private as the accounts that can open the dashboard holding it and the phones signed into the Telegram group it is sent to — so treat the chat the way you would treat an email, and leave secrets out of it.

If how any of this works changes, we update this page and move the date at the top. Material changes get spelled out here rather than slipped in.

Questions, corrections, or a deletion request go to the same place: info@cortexbuilt.com.

Our website terms of use are on the terms page.