Privacy Policy

A short version

Cortal does complex work for local Vancouver businesses, in the tools they already use, and checks it. Cortal is currently in a private beta with no public self-serve signup. We use the information needed to operate the website, sign in the people we invite, do the work they ask for, protect the service, and understand whether it is working.

We do not sell personal information. This policy describes the current product and may change as Cortal develops. If you have a question, contact us at tom@cortal.ai.

Information we receive

Depending on how you interact with Cortal, we may receive:

• Information you choose to send us. For example, your name, email address, and the contents of a message when you contact us. If you book a call, the scheduling service may collect information under its own policy.
• Website and diagnostic information. The public site uses Vercel Analytics and Speed Insights for usage and performance signals. Our deployments may also use Sentry for error monitoring and Honeycomb for server-side telemetry when enabled. These systems can receive technical information such as browser, device, request, page, and error context.
• Account information. People invited to Cortal sign in with Google through Clerk, our sign-in provider. This gives us an email address and can include a name or profile image, depending on the account and permissions.
• The work you give Cortal. Messages, files, emails and text messages you send your assistant, and the results and records it produces. This can include information about other people, such as your customers.
• Logins and connected accounts. Logins you save for your assistant are stored encrypted. If you connect Gmail, ChatGPT or Claude, Cortal uses that connection to do the work you ask for.
• Payment information. Stripe handles cards and invoices. We keep your Stripe customer number, not your card.

How we use information

We use information to:

• operate, maintain, and secure the website and product;
• sign in the people we invite and keep each account separate;
• do the work you ask for, using the connections and logins you give it;
• diagnose failures, measure reliability, and improve the service; and
• respond to questions, support requests, or security concerns.

Cortal does not use connected-service access to take unrelated actions. The permissions and boundaries of a connection are part of the product's operating controls.

When information is shared

We share information with the service providers that run Cortal: Vercel (hosting and site telemetry), Supabase (database and files), Clerk (sign-in), Fly.io (the computers your assistants run on), Browserbase (their web browsers), Google Cloud (the key that protects saved logins), Resend (email), LoopMessage (text messages, when you text your assistant), Stripe (payments), the AI model companies that process your work, and Sentry and Honeycomb on our public site when enabled. They process information to provide services to us and under their own terms and policies.

When you connect a service or give your assistant a login, Cortal exchanges information with that service as needed to do the work you asked for. We may also disclose information when reasonably necessary to comply with law, protect people or the service, investigate abuse, or enforce our agreements.

Retention, security, and location

We keep your information while you have an account, and delete it when you ask. See “Deleting your account” below. We keep security and operational logs for as long as our providers retain them, and information that the law requires us to keep.

We use reasonable technical and organizational safeguards, but no internet service can promise absolute security. Cortal and its service providers may process information in countries other than where you live.

Deleting your account

You can delete your account yourself, in Settings under Delete account. We email you a code to confirm it is you. Your access ends right away, and everything else usually goes within minutes:

• your assistants and the computers and web browser profiles they used;
• your files, emails, messages and records of work;
• your saved logins, Cortal's connections to your other accounts, and your sign-in; and
• your plan, which is cancelled at once, if you're the only person on the account.

Some things outlast a delete:

• Copies in our database backups clear within 8 days. Deleted disks at Fly.io clear within 24 hours, and their automatic snapshots follow Fly.io's retention.
• We keep a note that a delete happened, with no name or address on it.
• Stripe keeps past invoices as its own financial records.
• Copies held by our email, text and AI providers, and in logs, last for those providers' own retention periods. Emails already delivered stay in the mailboxes they reached.
• Accounts your assistant opened on other websites stay open until you close them. We list them for you when the delete finishes. Your own ChatGPT, Claude and Google accounts are untouched. We also won't give your Cortal email address to anyone else.

If someone on a team deletes their account, their sign-in, connections, messages and assistants go, and the business's work records stay with the business.

Your choices

• You can choose not to send us information through the public site.
• You can choose not to connect a third-party service to Cortal.
• You can end a connection in Settings, or through that provider.
• You can ask us to review, correct, or delete information associated with you, even without an account, by contacting tom@cortal.ai.

We may need to verify a request before acting on it. Some information may need to be retained for security, legal, or record-keeping reasons.

Children and changes

Cortal is intended for business users and is not directed to children. We will update this page when our practices change and will update the effective date when we do.

Contact

Questions about this policy or Cortal's handling of information can be sent to tom@cortal.ai.