Privacy policy

KORTEXYA SAS, 2 T Chemin des Juifs, 57070 Mey, France, is the data controller for Agentic Design. Send privacy questions and rights requests to contact@kortexya.com. See the legal notice for full company details.

• Account data: email address, name if provided, authentication identifiers, and account preferences.
• Subscription data: plan, billing status, Stripe customer and subscription references, and transaction metadata. We do not receive your full card number.
• Product data: learning progress, saved projects, workshop activity, evaluations, prompts, or audit material you choose to store.
• Referral data: who invited whom and reward status when an invitation or referral link is used, so we can grant rewards.
• Support data: messages and contact details used when asking for help.
• Technical data: IP address, browser and device details, timestamps, security events, and server logs needed to operate and protect the service.
• Usage analytics: page views, coarse performance measurements, and bounded product-event properties for aggregate reports. Analytics is cookieless and stores no personal identifiers. Search text, prompts, AI output, API keys, raw errors, and stack traces are not intentionally sent to analytics.

Text submitted to an AI-powered tool is sent to the model provider selected for the request. Managed requests may be processed by Anthropic or OpenRouter and the provider identified in the product. OpenRouter routes must deny provider data collection and support zero data retention; a request fails if no compliant route is available. Direct provider processing remains subject to that provider’s terms. Do not submit confidential or personal data unless authorised.

Your own provider key is kept in account-scoped browser session storage and sent with the request when needed. Agentic Design does not intentionally save it in the database or application logs. Signing out, switching accounts, closing the browser session, or removing it in Settings clears the browser copy.

• To create and secure your account and provide the requested service (performance of our contract).
• To process subscriptions, keep financial records, and meet tax and accounting duties (contract and legal obligations).
• To prevent abuse, diagnose failures, and improve reliability (legitimate interests in operating a secure service).
• To answer support requests (contract and legitimate interests).
• To send optional communications only after opt-in. Cookieless analytics does not rely on consent.

Providers used as needed may include Supabase (authentication and data), Stripe (payments), self-hosted Plausible (cookieless analytics), Resend (transactional email), OVHcloud (hosting), and Anthropic or OpenRouter (AI inference). Their policies apply when they act as independent controllers; otherwise they follow contractual instructions.

If you sign in with Google or GitHub, that provider authenticates you and shares your name, email address, and avatar. We use this limited profile only to create and identify your account; the provider’s policy governs data it retains.

Some providers may process data outside the European Economic Area. Where required, we rely on an adequacy decision or approved contractual safeguards. Contact us for details relevant to your data.

Account and stored product data is retained for the life of the account; technical and security logs for up to 12 months; support correspondence for up to three years after closure; and invoices, transactions, and accounting evidence for up to 10 years where French law requires it. A documented incident, dispute, or legal hold may extend retention only for that purpose.

Full billing and payment-webhook records are retained for up to 90 days for reconciliation and disputes, then reduced to amounts, dates, and reference identifiers. Underlying invoices remain subject to the 10-year legal retention period.

Delete your account in Settings, or email contact@kortexya.com from your account address. After identity verification, account and product records are deleted or irreversibly anonymised except for required limited records. Encrypted backups are isolated and expire within 90 days. The same deletion instruction and legal exceptions are passed to providers.

Agentic Design uses essential authentication and security cookies, local storage for non-secret preferences, and account-scoped session storage for an optional API key. Self-hosted Plausible uses no cookies or personal identifiers and is not used for behavioural advertising. Under CNIL guidance this measurement needs no consent banner. We do not intentionally use third-party advertising cookies.

Depending on your location, you may have rights to access, correct, delete, restrict, or transfer personal data; object to legitimate-interest processing; and withdraw consent at any time. You may complain to the CNIL or your local authority. Exercising a right is free unless a request is manifestly unfounded or excessive.

Export your data and delete your account in Settings, or exercise any right by emailing contact@kortexya.com from your account address.

We update the date above when this policy changes. If a change materially affects our use of account data, we will provide appropriate notice in the service or by email.