Privacy Policy

Cortal is building software that helps teams run AI-assisted work with clearer boundaries, evidence, and outcomes. Cortal is currently in a private beta with no public self-serve signup. We use the information needed to operate the website, authenticate invited operators, provide requested product functionality, protect the service, and understand whether it is working.

We do not sell personal information. This policy describes the current product and may change as Cortal develops. If you have a question, contact us at tom@cortal.ai.

Depending on how you interact with Cortal, we may receive:

• Information you choose to send us. For example, your name, email address, and the contents of a message when you contact us. If you book a call, the scheduling service may collect information under its own policy.
• Website and diagnostic information. The public site uses Vercel Analytics and Speed Insights for usage and performance signals. Our deployments may also use Sentry for error monitoring and Honeycomb for server-side telemetry when enabled. These systems can receive technical information such as browser, device, request, page, and error context.
• Account information. Invited Cortal operators may sign in with Google through Supabase Auth. This can provide account identifiers such as an email address, name, or profile image, depending on the account and permissions.
• Connected-service information. If an operator intentionally connects another service, Cortal may process the information and actions available through the permissions granted for that connection. The product currently includes connectors such as Google, Slack, and HubSpot in its private operating surface.

We use information to:

• operate, maintain, and secure the website and product;
• authenticate invited operators and enforce access boundaries;
• perform the work an operator has requested through an authorized connection;
• diagnose failures, measure reliability, and improve the service; and
• respond to questions, support requests, or security concerns.

Cortal does not use connected-service access to take unrelated actions. The permissions and boundaries of a connection are part of the product's operating controls.

We share information with service providers that help us operate Cortal, such as Vercel for hosting and site telemetry, Supabase for authentication and hosted application data, Sentry for error monitoring, and Honeycomb when server telemetry is enabled. Those providers process information to provide services to us and under their own terms and policies.

When an operator connects a third-party service, Cortal exchanges information with that service as needed to perform the authorized workflow. We may also disclose information when reasonably necessary to comply with law, protect people or the service, investigate abuse, or enforce our agreements.

We keep information for as long as it is needed for the purposes described here, to maintain security and operational records, or to meet legal obligations. The retention period depends on the type of information and the context in which it was created.

We use reasonable technical and organizational safeguards, but no internet service can promise absolute security. Cortal and its service providers may process information in countries other than where you live.

• You can choose not to send us information through the public site.
• You can choose not to connect a third-party service to Cortal.
• You can revoke a connected provider's authorization through that provider.
• You can ask us to review, correct, or delete information associated with you by contacting tom@cortal.ai.

We may need to verify a request before acting on it. Some information may need to be retained for security, legal, or record-keeping reasons.

Cortal is intended for business users and is not directed to children. We will update this page when our practices change and will update the effective date when we do.

Questions about this policy or Cortal's handling of information can be sent to tom@cortal.ai.