Privacy Policy

Who we are

Cortex Labs Limited (company number 16496755) is registered in England and Wales. Our registered address is 167-169 Great Portland Street, London, W1W 5PF.

We are registered with the Information Commissioner's Office (ICO) as a data controller. ICO registration number: ZC132254.

For any privacy-related questions, contact us at: dpo@cortex-labs.ai

What this policy covers

This policy explains how Cortex Labs collects and uses personal data in connection with:

• Our website at cortex-labs.ai
• Our commercial and supplier relationships
• Our marketing and newsletter communications
• Our employment and contractor engagements

This policy does not cover personal data processed by our platform (Arc and Vantage) on behalf of clients. That processing is governed by the Data Processing Agreement between Cortex Labs and the relevant client.

What we collect and why

Website analytics

We use Vercel Analytics to understand how the site is used. This service collects aggregated, anonymised data only, including page views, approximate geographic location (country and region level), device type, browser, and page performance metrics.

Vercel Analytics does not set cookies, does not collect IP addresses, and does not track individuals across sessions or websites. No personal data is processed.

Analytics data is retained for 12 months. Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA) processes this data on our behalf.

Google Fonts

The Inter typeface used on this site is loaded via Google Fonts. When your browser requests a font file, Google receives your IP address and browser information as part of a standard web request. Google's privacy policy applies: policies.google.com/privacy

Email enquiries

If you contact us by email, we receive your email address and the contents of your message. We use this information solely to respond to your enquiry. We do not add you to any mailing list or share your details with third parties without your consent.

We retain email correspondence for no longer than three years unless there is a legal or contractual reason to retain it for longer.

Client and supplier contacts

When you engage with us as a client or supplier, we hold your name, business email address, telephone number, job title, and organisation name. We use this to manage our commercial relationship with you.

Our lawful basis is legitimate interests — we have a legitimate interest in managing the business relationships necessary to operate our company.

We retain this data for the duration of our relationship and for three years afterwards.

Newsletter subscribers and prospects

If you sign up to receive communications from us, we hold your name, business email address, and a record of your consent. We use this to send you our newsletter and relevant updates about Cortex Labs.

Our lawful basis is consent. You can withdraw consent at any time by clicking the unsubscribe link in any email we send, or by contacting us at dpo@cortex-labs.ai. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

We retain subscriber data until consent is withdrawn. We review inactive subscribers annually.

Staff, contractors, and founders

We process HR and payroll data for founders, employees, and contractors as necessary to fulfil our employment and engagement obligations. Our lawful basis is contract and legal obligation.

Who we share data with

We do not sell personal data. We share data only where necessary:

• Our accountant — processes payroll data on our behalf under a data processing arrangement
• HMRC — we share payroll data as required by law
• Resend — processes email addresses and names to deliver our newsletter on our behalf
• Google LLC — we use Google Workspace for email and document storage; Google processes data as a processor under their standard terms
• Vercel Inc — processes anonymised analytics data as described above

All third parties are required to handle data in accordance with UK GDPR.

International transfers

Some of our service providers, including Vercel and Resend, may process data outside the United Kingdom. Where this occurs, appropriate safeguards are in place in accordance with UK GDPR Chapter V, including standard contractual clauses.

Cookies

This website does not set any cookies. No consent banner is required.

Your rights

Under UK data protection law, you have the right to:

• Access the personal data we hold about you
• Correct any inaccurate data
• Request erasure of your data in certain circumstances
• Object to processing based on legitimate interests
• Withdraw consent where processing is consent-based
• Receive your data in a structured, machine-readable format
• Lodge a complaint with the ICO at ico.org.uk

To exercise any of these rights, contact us at dpo@cortex-labs.ai. We will respond within one calendar month.

Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. Cortex Labs holds Cyber Essentials Plus certification.

Changes to this policy

We review this policy annually and following any material change to our processing activities. The date at the top of this page reflects the most recent review.