Privacy policy

Who is responsible

Кортексълушънс ЕООД (CorteXolutions), company ID 204972183, Plovdiv, Bulgaria (full registered address in the Commercial Register). Corteal is our brand. Contact: hello@corteal.com. See also the legal notice.

Pilot request form

This is the only form on corteal.com. If you send it, we store:

• Name
• Work email
• Company
• Role (optional)
• The products you are interested in (optional)
• What you want us to try it on (free text)
• Company size (optional)
• How you heard about us (optional)

We also store the time of the request, the page you sent it from, your browser’s user agent text and a scrambled code made from your IP address with a secret salt. We do not store the IP address itself. The code is only used to limit spam and repeat sends. Requests that look like bots are dropped and not stored.

Why. To read your request, reply by email and agree the scope of a pilot with you. Legal basis. Steps you ask for before a contract (Art. 6(1)(b) GDPR). For the spam code, our interest in keeping the form working (Art. 6(1)(f)). Name, work email, company and the task are needed to answer you. The rest is optional.

Where. In a SQLite database on a volume at Fly.io in Frankfurt, Germany. Only we can open it, behind a login. Fly.io keeps daily snapshots of the volume for a few days.

How long. Up to 12 months after our last contact with you. If a pilot starts, we keep what the pilot needs for as long as it runs and for as long as the law requires records of it. You can ask us to delete your request at any time.

Alerts about new requests

The forms service can send us a short alert when a request arrives, to a chat tool (Discord, Slack or Telegram) or by email. An alert has the company name, your role and company size if you gave them, and a link to our login page. It has no name, no email address and none of your message. Discord, Slack and Telegram are US-based services. Beyond the alerts, nothing leaves our own systems unless a section below says so.

Lead management in our CRM

The forms service copies each pilot request and each Cal.com booking into our own CRM, an installation of the open-source software Twenty that we run ourselves at Fly.io in Frankfurt (its own app, database and cache). For a pilot request it holds your name, work email, company, role and the text of your request. For a booking it holds your name, email, the time and any note you added. It also holds our notes on the conversation. Only the founders can open it. We use it only to manage leads and answer you. The legal basis and retention are the same as for the request itself above: up to 12 months after our last contact with you, and you can ask us to delete your entry at any time. A hosted CRM (Attio) is also supported by the code but is switched off. We will update this page before we use it.

The “Book a demo” buttons open our scheduling page on Cal.com, a US-based scheduling service. When you book, Cal.com receives your name, email, the time you pick and any note you add, and sends you a confirmation email. Cal.com acts as our processor for these bookings. It states that it processes data in the United States, says it takes part in the EU-U.S. Data Privacy Framework, and uses the EU Standard Contractual Clauses for transfers that framework does not cover. It keeps booking data while our account is active and deletes it after closure, normally within 90 days. If we pick a video tool for the call, such as Google Meet or Zoom, it receives the meeting details. Our forms service also gets a notice of each booking, which it copies into our CRM described above. We use it only to hold the call and follow up. Legal basis: steps you ask for before a contract (Art. 6(1)(b) GDPR). Just opening the link sends no booking data to Cal.com, but Cal.com sees your IP address and request details when its page loads. Cal.com’s privacy policy and data processing agreement.

Hosting and Fly.io

This site, the demo apps and the forms service run on Fly.io in the Frankfurt region (fra). Fly.io handles your IP address and request details when it delivers a page, and keeps short-lived operating logs.

Fly.io, Inc. is a US company. In its own privacy statement it says it complies with the EU-U.S. Data Privacy Framework and that it acts as a processor for the data in customers’ apps. Fly.io offers every customer a data processing agreement, which includes the EU Standard Contractual Clauses for any transfer the Data Privacy Framework does not cover. Our data is stored in Frankfurt. A US provider can still be subject to US law, and we cannot rule out access requests from US authorities. Fly.io’s documents: privacy statement, Data Privacy Framework policy.

Analytics

On corteal.com we use PostHog’s EU cloud to see which pages are read and which buttons are used. It works without cookies. The code is set up to:

• keep everything in memory, so it sets no cookies and writes nothing to local storage
• forget you when you close or reload the page
• respect the “Do Not Track” browser setting
• record no sessions, no screen video and no surveys

It records page views, clicks on links and buttons (their text and where on the page they are), and a few named events: opening a demo, downloading the sample report, clicking a pilot or demo button, and sending the pilot form. For the pilot form event it records only the products you ticked and the company size. It never records your name, email or message. It does not record what you type. PostHog receives your IP address as part of the request, as any server does. Your browser also loads a small script from PostHog’s EU servers (eu-assets.i.posthog.com).

Because nothing is stored on your device, we cannot tell that a visit today and a visit tomorrow come from the same person. We do not identify visitors. Legal basis. Our interest in knowing whether the site works (Art. 6(1)(f) GDPR). You can object at any time by emailing us, or turn on “Do Not Track” in your browser. Analytics only runs if the site was built with an analytics key. If we remove the key, none of this runs.

What your browser stores

No cookies. If you pick Light or Dark with the theme button, your browser keeps that choice in local storage under the name cx-theme, so the next page looks the same. It stays on your device and is not sent to us. Choosing System removes it.

Fonts and other third parties

Fonts are served from our own server. The site makes no requests to Google Fonts or a content delivery network. Videos and images are hosted by us. No ads, no social media buttons and no embedded maps. The email link on this site opens your email program. Beyond Fly.io, PostHog and the alert tools above, we use no other third party on this site.

Demo apps

read.corteal.com, watch.corteal.com and verify.corteal.com are demos with sample data. They run on Fly.io in Frankfurt too, load their fonts from their own server and set no cookies. They contain the same analytics code but are built without an analytics key, so they send nothing to PostHog today.

Read upload form. The “Your document” tab lets you choose files and enter an email address, the columns you need, your current tool and an NDA checkbox. Previews of your files are made in your browser. Right now the send button is not connected to a server: it sends nothing and tells you to email the files to us instead. Your files stay on your device until you choose to email them. If you email us files, we use them only for your request, keep them as long as the pilot needs and delete them on request.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit its use, to hand it over in a usable format, or to stop using it where we rely on our own interest. Email hello@corteal.com. We reply within one month. We do not sell personal data. We make no decisions about you by automated means.

Complaints

You can complain to the Bulgarian data protection authority, the Commission for Personal Data Protection (Комисия за защита на личните данни, КЗЛД), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg. You can also complain to the authority in the EU country where you live or work.

Changes

If we change how we handle data, we change this page and its date.