Privacy Policy

Who we are

Cortex is an App Store Optimization workspace operated by Elvee Limited, Office 2 Tweed House, Park Lane, Swanley BR8 8DT, United Kingdom ("Elvee", "we", "us"). Elvee is the data controller for the personal data described in this policy. For data in the store and advertising accounts you connect, you are the controller and Elvee processes it on your behalf under the data processing section of our Terms. It explains what we collect, why, who we share it with, how long we keep it, and your rights under UK and EU data protection law (UK GDPR and GDPR) and, where they apply, US state privacy laws such as the CCPA.

Information we collect

We collect the following information when you use Cortex:

• Account details: your email address, name, avatar, locale, time zone and currency preference, and a bcrypt hash of your password. If you sign in with Google or Apple, we receive the account identifier and the name and email address that provider shares with us.
• Onboarding answers: the goals, role and referral source you choose when you set up your workspace.
• Security data: your two-factor authentication secret (encrypted) and hashed recovery codes, and for each signed-in session the device name and type, IP address, sign-in time and, on mobile, a push notification token.
• Workspace data: the apps, markets, keywords, competitors, alerts, metadata drafts and settings you create, plus team members and invitations.
• Connected account data: when you connect App Store Connect, Google Play, Apple Search Ads, Google Ads or AppsFlyer, we store the credentials you provide (encrypted) and the data we retrieve with them, such as listings, reviews, campaigns, keywords, spend, installs and revenue.
• AI assistant content: the questions you ask the in-app assistant, its answers, and files you attach.
• Support requests: messages and attachments you send to our support team.
• API keys: when you create a key for the API or an AI client over MCP, we store only a one-way hash of it and a short hint so you can recognise it.
• Public store data: app listings, rankings, charts and reviews that are publicly available on the Apple App Store and Google Play.
• Logs and diagnostics: server request logs (including IP address and the endpoint called) and error reports used to keep the service secure and working.

How we use your information

We use your information to:

• Provide Cortex: track keywords and rankings, compare competitors, summarise reviews, show advertising and revenue performance, and generate metadata for the apps you manage.
• Act on your instructions in connected accounts: when you or an AI client you authorise asks Cortex to, we publish metadata or release notes to the stores and create or change Apple Search Ads and Google Ads campaigns, ad groups, keywords, bids and budgets.
• Authenticate you, keep sessions secure and detect abuse such as brute-force attempts.
• Send transactional email and push notifications, such as sign-in codes, invitations and the alerts you configure.
• Manage subscriptions and trials.
• Diagnose errors and improve the reliability and accuracy of the service.

Our legal bases are performing our contract with you, our legitimate interests in running a secure and reliable service, and compliance with legal obligations. We do not use your data for advertising, and we do not sell it.

AI features

Cortex's AI features (the assistant, metadata and keyword suggestions, review summaries and reply drafts) are powered by Anthropic's Claude models. To produce a result we send Anthropic the relevant content: your assistant messages and the workspace data the assistant looks up, app metadata, keywords and store reviews. Anthropic processes this content to return the result and, under its commercial terms, does not use it to train its models. AI output can be wrong; review it before you publish or act on it.

How we protect your data

We use technical and organisational measures appropriate to the risk:

• Encryption: data in transit is protected with TLS. Store and advertising credentials are encrypted with AES-256-GCM or held in Google Cloud Secret Manager, and two-factor secrets are encrypted at rest.
• Hashing: passwords and recovery codes are stored as bcrypt hashes, and API keys as SHA-256 hashes; we cannot read them back.
• Access control: every request is checked against your organisation and role, so one workspace cannot read another's data.
• Account security: optional two-factor authentication (TOTP) and rate-limited sign-in.
• No system is completely secure. If a breach affects your personal data, we will notify you and the relevant regulator as the law requires.

Who we share data with

We share data only with service providers that help us run Cortex, under contracts that limit how they may use it, and with the platforms you connect:

• Anthropic: AI processing, as described in section 4.
• Google Cloud: secret storage for connected-account credentials.
• Cloudflare: file storage for support attachments and archived server logs.
• Sentry: error monitoring. Reports exclude cookies, request bodies and user details.
• Zoho ZeptoMail: delivery of transactional email.
• Firebase Cloud Messaging (Google): delivery of push notifications to the mobile app.
• RevenueCat: subscription management.
• Google and Apple sign-in: when you choose to sign in with them.
• The platforms you connect: Apple (App Store Connect, Apple Search Ads), Google (Google Play, Google Ads) and AppsFlyer, which receive our requests on your behalf under your credentials.

We may also disclose data if the law requires it, or to a successor if Elvee's business is sold or merged. Some providers process data outside the UK and EEA; where they do, we rely on adequacy decisions or standard contractual clauses.

How long we keep data

We keep data while your account is active and as follows:

• Account deletion: when you delete your account, we deactivate it immediately and sign out every session. Workspace data, including connected-account credentials, is kept so the service stays consistent for any team you belonged to. Disconnect your store and advertising accounts before deleting if you want their credentials removed, and you can ask us to erase your personal data at any time (see section 8).
• Disconnecting an account: removing a connection erases its stored credentials straight away.
• Store reviews: kept for up to 400 days.
• Server logs: kept for 7 days on our servers and 90 days in archive storage.
• Sessions: expire after 30 days without renewal.
• Archived organisations: permanently deleted 30 days after they are archived.
• We keep some records longer when the law requires it, for example for tax or accounting.

Your rights

Depending on where you live, you can:

• Access the personal data we hold about you and receive a copy in a portable format.
• Correct inaccurate details; most can be changed in your profile settings.
• Erase your personal data.
• Restrict or object to certain processing.
• Withdraw consent where we rely on it, and disconnect any linked store or advertising account at any time.

To exercise these rights, email [email protected]. We respond within one month. If you are unhappy with our response, you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

Cookies and local storage

Cortex uses only strictly necessary cookies and browser storage: secure, HTTP-only cookies that keep you signed in and complete sign-in and two-factor steps, cookies that remember your language, sidebar and assistant panel state, and browser storage for your theme, unsaved drafts and in-progress setup steps. We do not use advertising or third-party analytics cookies, so no consent banner is needed.

Children

Cortex is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.

Changes to this policy

We may update this policy as Cortex changes. We will post the new version here with a new date and, for material changes, notify you in the app or by email before they take effect.

Contact

Questions or requests about your privacy:

• Email: [email protected]
• Post: Elvee Limited, Office 2 Tweed House, Park Lane, Swanley BR8 8DT, United Kingdom