Privacy Policy & Data Protection

Cortex ("we," "us," "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our platform. We comply with applicable data protection regulations including the Information Technology Act, 2000 (India), the Digital Personal Data Protection Act, 2023 (India), and the General Data Protection Regulation (GDPR) where applicable.

1. Information We Collect

1.1 Information You Provide

• Account Information: Full name, email address, password (hashed, never stored in plaintext), and selected subscription tier.
• Trading Plan Data: Risk parameters, trading rules, preferred instruments, trading hours, and strategy configurations you create.
• Journal Entries: Trade notes, emotional state tags, setup quality assessments, and plan compliance records.
• Community Content: Posts, comments, setups, and other content you share in community features.
• Support Communications: Messages and attachments you send to our support team.

1.2 Information from Broker Connections

• Account Data: Account balance, equity, margin levels, and account identifiers.
• Trade History: Past and open trades including symbols, entry/exit prices, volumes, and timestamps.
• Position Data: Current open positions, unrealized P&L, and risk exposure.
• API Credentials: Broker API keys and tokens (encrypted with AES-256 before storage).

1.3 Automatically Collected Information

• Device & Browser Info: Browser type, operating system, device type, screen resolution.
• Usage Data: Pages viewed, features used, session duration, click patterns.
• IP Address: Used for security monitoring, rate limiting, and approximate geolocation (country level).
• Cookies: Authentication tokens (httpOnly, secure), theme preferences, and essential session cookies. We do not use third-party advertising cookies.

2. How We Use Your Information

• Service Delivery: To provide trading plan management, journal features, analytics, AI copilot, revenge detection, and community features.
• AI Processing: Your trading data is processed by our AI engine (powered by Anthropic Claude) to generate risk assessments, compliance checks, and personalized insights. AI interactions are not used to train external AI models.
• Security: To detect unauthorized access, prevent fraud, and protect platform integrity.
• Communication: To send service notifications, security alerts, billing confirmations, and (with your consent) product updates.
• Improvement: Aggregated, anonymized usage data helps us improve features and performance. Individual trading data is never shared externally.

3. Data Storage and Security

3.1 Infrastructure

Your data is stored on Supabase (built on PostgreSQL), hosted on secure cloud infrastructure with SOC 2 Type II compliance. All database connections use TLS 1.3 encryption. Data at rest is encrypted using AES-256.

3.2 Access Controls

• Row-Level Security (RLS): Every database query is scoped to your user ID. You can only access your own data — this is enforced at the database level, not just the application layer.
• Authentication: Managed by Supabase Auth with secure session tokens, PKCE flow, and automatic token refresh.
• API Security: All API routes require authentication. Webhook endpoints use cryptographic signature verification.
• Employee Access: Internal access to production data is restricted to essential personnel only, with audit logging on all access events.

3.3 Broker Credential Protection

Broker API keys and tokens are encrypted with AES-256 before storage and are never logged, cached in plaintext, or exposed through any API response. When you disconnect a broker, credentials are permanently deleted within 24 hours.

3.4 Payment Security

Payment processing is handled entirely by Stripe. We never store, process, or have access to your full credit card number. Stripe is PCI DSS Level 1 certified. We only store your Stripe Customer ID for subscription management.

4. Data Sharing and Third Parties

We do NOT sell your personal or trading data. Period.

We share data only with these categories of service providers, solely to operate the platform:

5. Your Rights

You have the following rights regarding your data:

• Access: Request a copy of all personal data we hold about you.
• Correction: Update inaccurate or incomplete personal information through your Settings page.
• Deletion: Delete your account and all associated data at any time from Settings > Danger Zone. Data is permanently removed within 30 days.
• Data Portability: Export your trading data in standard formats (CSV/JSON) before account deletion.
• Withdraw Consent: Opt out of non-essential communications at any time through notification preferences.
• Restrict Processing: Request that we limit processing of your data in certain circumstances.
• Object: Object to processing of your data for specific purposes.

To exercise any of these rights, email us at privacy@nexara-cortex-ai.com or use the self-service options in your Settings page. We will respond within 30 days.

6. Data Retention

• Active Accounts: Data is retained for the duration of your account plus 30 days after deletion.
• Trading Data: Retained while your account is active. Deleted within 30 days of account closure.
• AI Conversation Logs: Retained for 90 days for service quality, then automatically purged.
• Payment Records: Retained for 7 years as required by tax and financial regulations.
• Server Logs: IP addresses and request logs are auto-deleted after 30 days.
• Backup Retention: Encrypted backups are retained for 30 days and then permanently destroyed.

7. Cookies and Tracking

We use only essential cookies required for the Service to function. These include authentication session tokens (httpOnly, Secure, SameSite=Lax), theme preference (light/dark mode stored in localStorage), and feature flag cache.

We do NOT use advertising cookies, tracking pixels, or third-party analytics that profile individual users. We do not participate in cross-site tracking or ad networks.

8. International Data Transfers

Our primary infrastructure is hosted in regions that comply with applicable data protection laws. When data is transferred across borders (e.g., to cloud service providers), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where required by GDPR, and adherence to India's Digital Personal Data Protection Act, 2023.

9. Children's Privacy

Cortex is not intended for use by anyone under 18 years of age. We do not knowingly collect personal data from minors. If we discover that we have inadvertently collected data from a minor, we will delete it immediately and terminate the associated account.

10. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users within 72 hours via email and in-app notification. We will also notify the relevant supervisory authority as required by applicable law. Notifications will include the nature of the breach, data potentially affected, remediation steps taken, and recommended actions for users.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email and in-app notification at least 30 days before taking effect. The "Last updated" date at the top reflects the most recent revision. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related questions, data requests, or concerns: