Privacy policy
Last updated November 9, 2026
- We collect account and workspace details, assistant setups, billing records, and limited service-usage metadata.
- When someone chats with an assistant, their messages are sent to our AI provider (Anthropic) to write a reply.
- We don't sell your data, and we don't use it for advertising.
- You can delete your account and everything in it at any time.
Who we are
Cortex Mods ("we", "us") lets businesses build AI assistants and put them on their own websites. This policy covers two groups of people: owners, who create a Cortex Mods account, and visitors, who chat with an owner's assistant on the owner's website, on a Cortex Mods chat page, or on our sample demo sites.
What we collect from owners
| What | Why |
|---|---|
| Email address | To log you in, send confirmation codes and password reset links, and contact you about your account. |
| Password | Stored only as a scrambled one-way hash. We can't see or recover it. |
| Your assistants | Everything you put in them: name, job, personality, skills, info about your business, and rules. |
| Websites you list | So your assistant only works on the sites you choose. |
| Billing records | Subscription status and amount. Card details are handled by Stripe; we never see or store your card number. |
| Workspace membership | The account email and role of each person an owner or operator adds to a workspace, so we can control access. |
| Service usage and audit records | Model names, token counts, costs, and metadata about workspace or assistant changes. These records do not include chat or setup content. |
| A login cookie | One cookie that keeps you logged in. We don't use advertising or tracking cookies. |
| Waitlist requests | Your email and the connection you asked about, so we can send one notice if it becomes available. You can unsubscribe or ask us to delete it at any time. |
What happens when a visitor chats
A visitor's messages, together with the assistant's setup, are sent to Anthropic, our AI provider, so it can write a reply. Each question and the assistant's reply are saved for 30 days so the business owner can see what customers ask and improve the assistant; after that they're deleted automatically, and owners can delete them sooner. We also briefly keep the visitor's internet (IP) address in memory to stop abuse, such as someone sending thousands of messages. The chat bubble itself stores nothing on the visitor's device.
If a business turns on "Leave a message", a visitor can choose to leave their name, an email address or phone number, and a note. We email that to the business owner so they can get back to the visitor, and keep it for 30 days.
Visitors: please don't share passwords, card numbers, or health details in a chat. The assistant doesn't need them, and it's an AI, not a person.
Owners are responsible for telling their own website visitors that the chat uses an AI service, for example in their own privacy policy.
Companies that help us run the service
| Company | What they do for us |
|---|---|
| Anthropic | AI model that writes the assistant's replies. |
| Stripe | Payments and subscriptions. |
| Resend | Sends our emails (codes, reset links, notifications). |
| Fly.io | Hosts our servers and database. |
They only get what they need to do that job. We don't sell or rent personal information to anyone.
How long we keep things
- Your account and assistants: until you delete them.
- Customer questions and replies, and messages customers leave for a business: 30 days.
- Waitlist requests: until you unsubscribe or ask us to delete them.
- Login sessions: up to 30 days. Confirmation codes and reset links: minutes, then they're useless.
- Billing records: as long as the law requires us to keep them, even after you delete your account.
- Content-free usage and audit records: retained for service accounting and security. Account deletion removes the workspace and account-linked content, but pseudonymous record IDs and change metadata may remain.
- Backups: copies of our database are kept for a short time to recover from accidents, then deleted.
Your choices
- Change or delete any assistant at any time from your shelf.
- Delete your whole account from your account menu. This removes your assistants and takes them off every website.
- Ask us what we have about you, or ask us to correct it, by emailing us.
Security
Passwords are hashed, login cookies can't be read by scripts, one-time links and codes are stored only in scrambled form, and connections to the live service are encrypted. The current SQLite database does not encrypt assistant or visitor-message content at the field level; access is restricted by account and workspace permissions. No system is perfectly secure, so if something goes wrong that affects your data, we'll tell you.
Children
Cortex Mods accounts are for businesses and adults. We don't knowingly collect information from children under 13.
Changes
If we change this policy in a way that matters, we'll update the date above and let account holders know by email.
Questions? Email agent@cortexmods.com.