Privacy Policy

The controller of personal data is Mateusz Popielarz, operating under the Cortify Labs brand (cortifylabs.com) — the "Controller".

For any matter regarding personal data protection, you can contact the Controller at: [email protected].

Depending on how you use our services, we process the following categories of data:

• Forms (demo, reserve a spot, contact): full name, email address, and optionally company name, phone number and industry/use case.
• AI assistant (chat widget): the content of messages sent during a conversation and technical metadata (session identifier, page URL, language, time zone, browser information). Please do not enter sensitive data into the chat.
• Analytics and ad measurement: pseudonymised data about site usage and whether a visit from a Google ad led to an enquiry, collected by Google Analytics and Google Ads. Without consent the Google tag sets no cookies or identifiers and sends only anonymised signals (Google Consent Mode).
• Product analytics (PostHog): events on the site such as page views, clicks, and opening or submitting a form (without its content). Without consent PostHog runs without cookies or browser storage and recognises visits by a hash computed on its side. After consent it uses cookies and records the session, with form field contents always hidden. The admin panel and login pages are excluded from analytics.
• Technical data: IP address, server logs and security events, needed to operate and protect the service.

• Handling form enquiries and responding — Art. 6(1)(b) GDPR (pre-contractual steps) and Art. 6(1)(f) GDPR (legitimate interest in communicating with interested parties).
• Providing the AI assistant and generating answers — Art. 6(1)(b) and (f) GDPR (operating and improving the service).
• Analytics and traffic measurement: with cookies and session recordings — Art. 6(1)(a) GDPR (consent given in the cookie banner); aggregate measurement without cookies (PostHog cookieless mode, Google Consent Mode signals) — Art. 6(1)(f) GDPR (legitimate interest in site statistics and improvement).
• Security, abuse prevention and pursuing claims — Art. 6(1)(f) GDPR.
• Compliance with legal obligations (e.g. tax, responding to authorities) — Art. 6(1)(c) GDPR.

Data may be entrusted to trusted providers acting on our instructions under data processing agreements, including:

• Railway Corp. — hosting of the website, dashboard and API, PostgreSQL database and cache;
• Cloudflare, Inc. — CDN, file storage (R2) and DNS;
• Resend, Inc. — email delivery (notifications, conversation summaries);
• Microsoft Ireland Operations Ltd. (Microsoft Azure) — AI services (Azure OpenAI and Azure AI Foundry): generating assistant responses, embeddings and re-ranking of document search results, voice message transcription, and analysis of uploaded documents; processed in the EU region (Sweden);
• Langfuse GmbH — monitoring of AI assistant quality, performance and costs (conversation traces for diagnostics);
• Functional Software, Inc. (Sentry) — application error and performance monitoring (technical crash reports); data stored in the USA;
• ipapi — IP geolocation (country/city) for conversation analytics;
• Google Ireland Ltd. — Google Analytics and Google Ads (cookies and identifiers only after consent is given);
• PostHog Inc. — product analytics and session recordings on this site; data stored in the EU (PostHog EU Cloud).

Some providers are located outside the European Economic Area (mainly in the USA). Such transfers rely on the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR) together with additional technical and organisational safeguards. A copy of the safeguards used is available on request.

• Form data (leads): up to 24 months from the last contact, or until consent is withdrawn / an objection is raised.
• AI assistant conversations: up to 12 months, after which they are deleted or anonymised.
• Analytics data: according to Google Analytics and PostHog retention settings.
• Technical logs and security events: up to 90 days.
• Data needed to establish, exercise or defend legal claims — until the applicable limitation periods expire.

Under the GDPR you have the following rights:

• right of access to your data and to obtain a copy (Art. 15);
• right to rectification (Art. 16);
• right to erasure — the "right to be forgotten" (Art. 17);
• right to restriction of processing (Art. 18);
• right to data portability (Art. 20);
• right to object to processing based on legitimate interest (Art. 21);
• right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• right to lodge a complaint with the supervisory authority (in Poland: the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw).

The site uses cookies and similar technologies. Google cookies (Google Analytics, Google Ads measurement) and PostHog cookies (product analytics, session recordings) are set only after consent is given in the banner. Without consent PostHog measures traffic without cookies. Details are described in the Cookie Policy available at /cookies.

The AI assistant generates answers based on language models and the provided documents. We do not make automated decisions producing legal effects or similarly significantly affecting users (Art. 22 GDPR). Assistant responses are informational and may contain errors.

We apply appropriate technical and organisational measures to keep data secure, including transport encryption (TLS), access control, tenant data isolation and data minimisation.

This policy may be updated due to changes in the service or the law. The current version is always available on this page with the date of the last update. For privacy matters please contact: [email protected].