CortadThis Privacy Policy forms part of the Cortad Terms of Service. It describes how Planless Inc., a Delaware corporation operating under the name Cortad ("Company," "we," "us"), collects, uses, discloses and retains data in connection with the website at cortad.com, the Cortad connector, software development kits and application programming interfaces, and related services (together, the "Service"). Capitalized terms not defined here have the meaning given in the Terms of Service.
1. Roles
1.1 Controller. Company is the controller (or, under the California Consumer Privacy Act, the business) for Account Data, Billing Data, Security Data and Website Data described in Section 3.
1.2 Processor. For Customer Content, including Repository Content, Run Data and Production Data, Company acts as Customer's processor or service provider and processes it on Customer's documented instructions, which consist of the Terms of Service, this Policy, Customer's configuration of the Service, and any Order Form. Customer is responsible for having a lawful basis for that processing and for any notice to, or consent from, its own end users.
1.3 Improvement Records. Where Customer has chosen Help Improve Cortad, Company uses Improvement Records described in Section 3.6 for its own purpose of improving the Service, as authorized in Section 5 of the Terms of Service.
2. Purpose limitation
Company processes data only to provide, maintain, secure and support the Service for the account under which it was submitted; to improve the Service as described in Sections 3.6 and 5.3; to operate billing and the account relationship; to prevent abuse and investigate incidents; and to comply with law. Company does not process personal data for any other purpose.
3. Data collected
3.1 Account Data. Email address, display name, sign-in method and organization, used to authenticate and administer accounts and to communicate with Customer.
3.2 Repository Content. Files of the repository Customer connects, as selected by the Cortad connector on Customer's machine. The connector excludes files ignored by the repository's version control, environment files, private keys, credentials and data files before upload. Company derives from Repository Content the information needed to test Customer's application.
3.3 Run Data. Test conversations with Customer's application and their results, including findings. Customer's application runs on Customer's own machine, and calls to Customer's model provider are made with Customer's own credentials. Company does not store Customer's model-provider credentials.
3.4 Production Data. Where Customer installs a Cortad software development kit or connects a trace source, the model requests and responses of Customer's application, conversation identifiers and timing, and any metadata Customer attaches. Production Data may contain personal data of Customer's end users. Before Production Data leaves Customer's process, the software development kit masks recognizable secrets and identifiers, such as access tokens, email addresses and payment card numbers; Company applies the same masking again on receipt. Message content is encrypted under a key specific to Customer's account and retained for the period of Customer's plan stated on Company's pricing page, after which it is deleted. Customer may delete any conversation at any time.
3.5 Billing Data. Plan, usage counts, model identifiers, token totals and charges. Payment card details are collected and held by Company's payment processor and are not received by Company.
3.6 Improvement Records. Where Customer has chosen Help Improve Cortad, records derived from Customer's use of the Service, including Production Data, such as feedback on findings and their outcomes, and statistics describing that use. Improvement Records exclude source code, the text of messages written by Customer's end users, credentials, and any data in a special category under applicable law. Company removes direct identifiers of Customer and of Customer's end users before an Improvement Record is used outside Customer's account. Where Customer has chosen Privacy Mode, no Improvement Record is created from Customer's account.
3.7 Aggregate Statistics. Counts and rates computed across many customers, from which no customer, end user or individual record can be identified. Aggregate Statistics are not personal data and are not Customer Content.
3.8 Security Data. Sign-in events, consent records, administrative actions and network request metadata, used to secure the Service, prevent abuse, investigate incidents, and demonstrate that a change was authorized.
3.9 Website Data. As described in the Cookie Policy: the page viewed, a named feature interaction, timing and scroll engagement, referring origin, campaign parameters, coarse device and browser category, and a pseudonymous session or device identifier. Website Data never includes the content of a form field, source code, prompt or transcript text, or a credential.
4. Sources
Company receives data from Customer and its Authorized Users; from the Cortad connector and software development kits Customer runs; from trace sources, source-code hosts and identity providers Customer connects; from Company's infrastructure providers in the ordinary course of operating the Service; and from visitors to Company's website. Company does not purchase personal data.
5. Use and disclosure
5.1 Company uses data as described in Sections 2 and 3. Company does not sell personal information, does not share personal information for cross-context behavioral advertising, and does not use Customer Content to train any model offered to third parties.
5.2 Company discloses data only to Subprocessors that host, secure, authenticate, bill for or otherwise operate the Service on Company's behalf under written obligations no less protective than this Policy; to professional advisers under a duty of confidentiality; to a successor in a merger, acquisition or sale of assets that assumes this Policy; and where required by law or legal process, in which case Company will notify Customer where legally permitted. Company does not disclose one customer's Customer Content or Improvement Records to another customer.
5.3 Company's current list of Subprocessors, with each Subprocessor's function and location, is maintained at trust.cortad.com. Company will update that list before a new Subprocessor begins processing Customer Content. Customer may object to a new Subprocessor on reasonable data protection grounds by notice within thirty days, and if the parties cannot resolve the objection, Customer may terminate the affected Service and receive a refund of prepaid fees for the remainder of the term.
5.4 Where Customer's configuration directs a request to a provider of Customer's choosing, including Customer's own model provider, that provider processes the request under Customer's agreement with it and is not Company's Subprocessor for that traffic.
6. Choices
6.1 Data Sharing. Each account chooses between Help Improve Cortad and Privacy Mode. Company records the choice, its date and time, and the wording presented. A choice may be changed at any time at cortad.com/data. After a change to Privacy Mode, Company stops creating Improvement Records from the account at once and stops using existing Improvement Records from the account within five business days. Aggregate Statistics already computed cannot be separated and are not affected.
6.2 Website Data. Analytics choices are made as described in the Cookie Policy. Company honors Global Privacy Control signals.
7. Legal bases
Where the General Data Protection Regulation, the United Kingdom General Data Protection Regulation or the Swiss Federal Act on Data Protection applies, Company processes personal data as controller to perform its contract with Customer; for its legitimate interests in operating, securing and improving a business-to-business service, which Company has assessed against the interests of the individuals concerned; to comply with legal obligations; and, for optional website analytics and for Help Improve Cortad where required, on the basis of consent, which may be withdrawn at any time without affecting processing before withdrawal. Help Improve Cortad is not preselected for accounts in the European Economic Area, the United Kingdom or Switzerland.
8. Retention
8.1 Account Data and Billing Data are retained for the life of the account and afterwards as required for tax, accounting, dispute resolution and other legal obligations.
8.2 Repository Content and Run Data are retained for the life of the account unless Customer deletes them earlier.
8.3 Production Data message content is retained as described in Section 3.4. Improvement Records derived from it are retained as described in Section 8.4. Evaluations of Production Data, and the counts, timings and outcomes of production conversations, are retained for the life of the account unless Customer deletes them earlier.
8.4 Improvement Records are retained while they remain useful to improve the Service and are deleted or reduced to Aggregate Statistics when they no longer are.
8.5 Website Data event records held by Company are deleted no later than one hundred eighty days after collection.
8.6 Security Data is retained for the period required by Company's security and legal obligations.
8.7 On closure of an account, Company deletes the account's Customer Content within thirty days, except where retention is required by law. Data in backups is deleted in the ordinary rotation of those backups.
9. Security
9.1 Company encrypts data in transit using TLS and at rest using its infrastructure providers' encryption. Production Data message content is additionally encrypted under a key specific to the account, and deleting that key renders the content unrecoverable.
9.2 Every record is bound to the account under which it was created and is not accessible from another account. Access by Company personnel is limited to those who need it to operate, secure or support the Service, and is subject to confidentiality obligations.
9.3 Session cookies are host-only, HttpOnly and Secure. Account creation by password requires server-side bot verification.
9.4 Company will notify Customer without undue delay, and in any event within seventy-two hours, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Content, and will provide the information Customer reasonably requires to meet its own obligations.
9.5 Additional information on Company's security controls is available at trust.cortad.com. Suspected vulnerabilities may be reported to [email protected].
10. International transfers
Data is processed in the United States and in other countries where Company or its Subprocessors operate. Where a transfer of personal data from the European Economic Area, the United Kingdom or Switzerland requires a safeguard, Company relies on the European Commission's Standard Contractual Clauses, the United Kingdom International Data Transfer Addendum, or another lawful transfer mechanism, which are incorporated by reference where required.
11. Individual rights
Subject to applicable law, an individual may request access to, correction of, deletion of, or a copy of their personal data; object to or restrict processing; withdraw consent; and complain to a supervisory authority. California residents may also request to know the categories of personal information collected and may not be discriminated against for exercising a right. Requests may be sent to the address in Section 14 and will be verified before being honored. Where Company processes the data as Customer's processor, Company will refer the request to Customer and assist Customer in responding.
12. Children
The Service is not directed to individuals under eighteen. Customer is responsible for compliance with any law governing the data of children who use Customer's own application.
13. Changes
Company may revise this Policy. A revision is identified by a new date at the top of this page and, where it materially expands the use of Customer Content or personal data, by notice to Customer before it takes effect.
14. Contact
Planless Inc., operating as Cortad. [email protected].