Privacy Policy

At Cortex (operated by Elvee Limited), we respect your privacy and are committed to protecting personal data. This Privacy Policy explains what information we collect, how it is processed, and your privacy rights under applicable data protection laws, including the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

We collect information directly from you and automatically through your use of the platform: • Account Information: Name, email address, password hash, and two-factor authentication configuration. • App Store Metadata: Public app identifiers, bundle IDs, keyword rankings, metadata diffs, and store reviews for applications you choose to track or benchmark. • Store Integration Credentials: When you connect App Store Connect or Google Play Developer Console, API keys or tokens are encrypted using AES-256-GCM before storage. • Usage & Diagnostics: Anonymized request logs, browser type, operating system, and interaction telemetry to monitor system health and prevent fraudulent abuse.

We use your information strictly for legitimate business purposes: • Delivering real-time keyword tracking, rank change detection, and competitor intelligence. • Authenticating your identity and maintaining session security across devices. • Processing subscription payments and sending transactional service notifications. • Detecting, investigating, and mitigating malicious activity, brute-force attempts, or IDOR probes. • Improving platform algorithms, query speed, and data accuracy.

We enforce stringent technical and organizational measures to safeguard your information: • Encryption: All data in transit is encrypted using modern TLS 1.3. Credentials and sensitive store keys are encrypted at rest using AES-256-GCM. • Tenant Isolation: Every database query enforces strict organization boundary scoping to prevent unauthorized cross-tenant data access. • Authentication: We support multi-factor authentication (TOTP) and rate-limited perimeter authentication. • Infrastructure: Our systems are hosted in ISO 27001 and SOC 2 Type II certified cloud facilities with automated backups.

We do not sell, rent, or monetize your personal data. We share necessary data only with vetted subprocessors bound by strict confidentiality: • Payment Infrastructure: Stripe and RevenueCat for secure billing. • Cloud & Storage: Cloudflare and enterprise database providers for hosting and encrypted asset storage. • Transactional Communications: Zoho ZeptoMail for delivery of one-time codes and essential account notifications. • Storefront APIs: Official Apple App Store Connect and Google Play APIs for retrieving app metadata authorized by you.

We retain account information for as long as your account remains active or as required by law. If you close your account, your personal data and connected store keys are permanently purged within thirty (30) days, except where retention is required for legal compliance or tax reporting.

Depending on your jurisdiction, you have statutory privacy rights including: • Access: Request a copy of the personal data we hold about you. • Rectification: Update or correct inaccurate or incomplete account details. • Erasure: Request the complete deletion of your account and associated personal data. • Restriction & Objection: Object to or restrict specific processing of your information. • Portability: Export your app data and keyword lists in standard machine-readable formats. To exercise any of these rights, email privacy@cortex.dev or contact support.

We use strictly necessary cookies and local storage tokens solely to maintain authenticated sessions and preserve your interface preferences (such as light or dark theme). We do not deploy third-party advertising tracking cookies or ad networks.

We may revise this Privacy Policy periodically to reflect operational, legal, or regulatory updates. When material revisions occur, we will notify you through the platform interface or via your registered email address prior to changes taking effect.

For any inquiries, requests, or concerns regarding your privacy or data processing practices, please contact us at: • Email: privacy@cortex.dev or legal@elvee.app • Controller: Elvee Limited, Data Protection Officer