Privacy Policy

Cortality, Inc. ("Cortality", "we", "us") makes website analytics software. This policy explains how we handle personal information as a controller (the party that decides why and how it is used) for:

• people who visit cortality.com, including the Leak check at cortality.com/leak;
• people who sign in to the Cortality dashboard at app.cortality.com, are invited to it, or receive our emails;
• people who contact us or whose business does business with us.

California categories. In the last 12 months we collected: identifiers (name, email address, account and session IDs); internet or network activity (how you use our website and dashboard); approximate geolocation (city or country); commercial information (your plan and payment status); and professional information (your company and role). Sources: you, your organization (when it invites you), your device and browser, and Google (if you use Google sign-in). We disclosed each category only to the service providers in section 5, for the business purposes in this table.

Apart from your account sign-in credentials, which we use only to let you sign in, we do not collect sensitive personal information (such as health, financial account, government ID or precise location data) about you, and we do not use personal information to make decisions that have legal or similarly significant effects on you.

• Contract: your account, sign-in, the Service you or your employer ordered, billing, and emailing your Leak result because you asked for it.
• Consent: measuring your visit to cortality.com with our own tag. You can withdraw consent at any time from "Privacy choices".
• Legitimate interests: securing the Service, keeping business records, and replying to business contacts. You can object at any time.
• Legal obligation: tax and accounting records.

You must give an email address to have an account. Everything else is optional; if you don't give it, the related feature (such as receiving your Leak result by email) isn't available.

cortality.com sets no cookies and uses no advertising or third-party analytics tags. Our own Cortality tag may keep one visit's unsent data in your browser's storage for up to 7 days so it is not lost if a tab closes, and we store your privacy choice in your browser so we remember it.

app.cortality.com uses only cookies needed to run the dashboard:

The dashboard also stores display preferences (such as light or dark theme) in your browser. We serve our website fonts ourselves.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use it for advertising at all. We disclose it only to:

• Service providers that process it for us under contract: Amazon Web Services (hosting, storage, delivery and notifications, in the USA); Resend (sending email); Google (Google sign-in, if you choose it); Have I Been Pwned (when you set a password we check it against known breaches by sending only the first 5 characters of its one-way hash, never the password or your email); and the AI model providers listed on our Subprocessors list, which analyze page images and text for reports.
• Paddle, our reseller and the merchant of record for our orders, which processes your payment and billing details as an independent controller under its own privacy policy.
• Your organization. If you use a company account, the account's owners and admins can see your name, email and role.
• Legal and safety. When the law requires it, or to protect the rights, safety and security of Cortality, our customers or others.
• Business transfers. To a successor if Cortality is involved in a merger, acquisition or sale of assets, subject to this policy.

Cortality keeps the data it collects for as long as it serves the purpose it was collected for:

EEA, UK and Switzerland. Once the purpose has ended (for example, 3 years after an account closes, or when you withdraw consent), we delete or irreversibly anonymize the data that identifies you and keep only records that are no longer personal data.

You can ask us to close your account and access at any time. Where a law that applies to you gives you a right to have personal information deleted, we honor it (see section 7).

Depending on where you live, you may have the right to: know what personal information we hold about you and get a copy; correct it; have it deleted; object to or restrict how we use it; take it to another service (portability); and withdraw consent you gave. California residents have the right to know, delete and correct, and to not be discriminated against for using these rights; we do not sell or share personal information, so there is nothing to opt out of. Residents of other US states with privacy laws have similar rights.

• To make a request, email team@cortality.com from the address on your account, or tell us which address the request is about. We may ask you to confirm you control that address. An authorized agent may make a request with your written permission. We answer within 30 days (45 days where California law allows, and we tell you if we need the extra time).
• Exceptions. We may keep information where the law allows, for example to complete a transaction, for security, for legal claims, or to keep records the law requires, and we will tell you which exception applies.
• Email. Every product email has a one-click unsubscribe link, and you can choose which emails you get in dashboard Settings. Account and security emails are sent while you have an account.
• Appeals and complaints. If we decline a request, you can appeal by replying to our answer. If we deny your appeal, you can contact your state Attorney General. In the EEA, UK or Switzerland you can also complain to your data protection authority.

Our customers install the Cortality tag on their websites to see how visitors use their pages. For that data, the website's owner is the controller and Cortality acts only on its instructions. The tag records interactions such as scrolling, clicks and page renders, masks what you type into forms before anything leaves your browser, and sets no cookies. It does not ask for or record your name or contact details. Each visit gets a random ID; if the site turns it on, a random visitor ID kept in your browser links your visits to that one site. This information can still be personal data, and it is protected as such. The details are in our Data practices.

Because visits are not linked to a name or email address, we usually cannot find data about a particular person unless you can give us an identifier such as the visitor ID. If you have a question or request about a website's use of Cortality, contact that website's owner, who decides how its data is used. You may also write to us at team@cortality.com and we will help the website's owner respond.

Cortality is based in the United States and stores data in Amazon Web Services' US East (N. Virginia) region. We collect your information directly in the US, where privacy laws may differ from yours. Uploads may pass through delivery-network edge locations outside the US without being stored there. When our customers send us personal data from the EEA, UK or Switzerland, the transfer is covered by the Standard Contractual Clauses in our DPA.

We encrypt data in transit and at rest, hash passwords, keep databases on private networks, and limit internal access. Our Security overview has the details. No system is perfectly secure; if a breach affects your personal information, we will notify you and authorities as the law requires.

Cortality is a business service. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. Our Terms forbid installing the tag on sites directed to children. If you believe a child has given us personal information, contact us and we will address it.

We will post any changes here with a new effective date. If a change materially affects how we use personal information we already hold, we will email account holders before it takes effect.

Questions or requests about privacy: team@cortality.com.