Legal

Privacy policy

Effective October 28, 2026

1. Who we are

Cortex ("Cortex", "we", "us") is building a shared AI workspace for research labs. This policy covers our website at cortexspaces.com, the contact form on it and the interactive demo at cortexspaces.com/start/ and cortexspaces.com/physics-lab/ (together, the "Site"). For any privacy question, email contact@cortexspaces.com.

The Cortex product itself, which will connect to a lab's real files, isn't covered here. Labs that use it will get their own agreement explaining how their data is handled.

2. What we collect

When you contact us

The contact form asks for your name, email address, your lab or institution (optional), your role (optional) and your message. When you send it, we also receive the country your request came from and the type of browser you used, which our hosting provider adds automatically. If you email us directly, we receive whatever you include in your email.

When you use the demo

The demo has no accounts and no live AI. Its labs, people, files and answers are illustrative, and the steps that look like connecting Google Drive, GitHub, OneDrive or lab computers are simulated. No access to any of your accounts is requested or granted.

Your browser stores a few settings on your own device so the demo remembers them, such as your chosen theme and presenter settings. You can remove them at any time by clearing your browser's site data. They are not sent to us.

Live sync between devices. When you create or join a demo lab, the demo keeps every device with the same join code in sync. Because the demo has no Cortex server, it sends what happens in the lab, such as the names you choose, your lab's name and university, the questions you type and the actions you take, through third-party public relay services (currently ntfy.sh and the public MQTT brokers run by EMQX and HiveMQ). These channels are public: they are not end-to-end encrypted, and anyone who knows or guesses a join code could see the messages for that lab. We don't keep copies of these messages, but the relay operators handle them under their own policies. Please only enter example information in the demo.

Technical information

Like any website, the Site is delivered by servers that see your IP address, browser type and the pages you request. Our hosting provider, Cloudflare, processes this to deliver the Site and protect it from abuse. We don't use advertising cookies or third-party analytics trackers, and the Site sets no cookies of its own. Cloudflare may set cookies that are strictly necessary for security, for example if we turn on its bot check for the contact form.

3. How we use it

• To read and reply to your message, and to follow up about Cortex when you've asked us to (for example, about a pilot for your lab).
• To understand what researchers need, so we can improve the demo and the product.
• To keep the Site secure and filter out spam and abuse.
• To meet legal obligations.

If you're in the European Economic Area or the UK, we rely on our legitimate interest in answering inquiries and running the Site, on taking steps you asked for before any agreement, and on your consent where we ask for it.

We won't add you to a mailing list unless you ask us to.

4. Who we share it with

We share information only with service providers who help us run the Site and our email, and only as needed for that work:

• Cloudflare hosts the Site, runs the contact form and protects the Site from abuse.
• Resend delivers contact-form messages to our inbox.
• Zoho hosts our company email, where your messages are kept.
• Public relay services (ntfy.sh, EMQX, HiveMQ) carry demo activity between devices, as described above.

We don't sell your personal information or share it for cross-context advertising. We may disclose information if the law requires it, to protect the rights and safety of Cortex or others, or as part of a merger, acquisition or similar transaction, in which case this policy will continue to apply to it.

5. Where it's processed

Our service providers may process information in the United States and other countries. Where the law requires it, we rely on appropriate safeguards for those transfers, such as the European Commission's standard contractual clauses.

6. How long we keep it

We keep contact messages and our email conversations for as long as we need them to respond to you and stay in touch about Cortex, and delete them when they're no longer needed or when you ask us to. Settings the demo saves in your browser stay there until you clear them.

7. Your choices and rights

You can ask us to access, correct, delete or send you a copy of the personal information we hold about you, or object to how we use it. Email contact@cortexspaces.com and we'll respond within 30 days. Depending on where you live, you may also have the right to complain to your local data protection authority. We won't treat you differently for using any of these rights.

8. Security

The Site is served only over encrypted HTTPS connections, and we limit access to messages you send us to the Cortex team. No system is perfectly secure, so please don't send sensitive information, such as unpublished research data or health information, through the contact form or the demo.

9. Children

The Site is meant for researchers and professionals and isn't directed to children under 16. We don't knowingly collect their information.

10. Changes

We'll update this policy as Cortex grows, and change the date at the top when we do. If a change is significant, we'll make it clear on the Site.

11. Contact

Questions or requests about privacy: contact@cortexspaces.com.