PRIVACY POLICY (GDPR)
for the CORTEX application and the websites www.getcortex.cz and getcortex.online
1. Data Controller
The controller of personal data is Daniel Gavalec, a self-employed individual (sole trader), with registered office at Urxova 707/14, 637 00 Brno-Komín, Czech Republic, ID No. (IČO): 03094146, not a VAT payer (the "Controller", "we"). Contact for all questions and for exercising your rights: info@getcortex.cz. The Controller has not appointed a data protection officer (there is no obligation to do so).
Data you enter about your clients and business partners (Invoicing module) are processed by us as a processor on your behalf; you are the controller (Article 7 of the Terms and Conditions).
2. What Data We Process, Why and on What Legal Basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account: e-mail, username, password (only as a secure hash), language, time zone, profile picture | Running the account, sign-in, service e-mails | performance of a contract, Art. 6(1)(b) |
| Google sign-in (optional): Google account identifier, e-mail, name and profile picture | Sign-in without a password | performance of a contract, Art. 6(1)(b) |
| Content you enter: tasks, goals, habits, plans, time entries, notes, vision board, mind maps, personal contract (incl. signature), personal finance, calendar, uploaded images | Providing the app's features | performance of a contract, Art. 6(1)(b) |
| Journal, health and energy, supplements (optional modules): records of sleep, energy, mood, supplements you take and journal entries – these may reveal information about your health | Showing your records and overviews to you only | explicit consent, Art. 9(2)(a), given by switching the module on and entering the data |
| Invoicing (optional): your billing details (name, company ID, VAT ID, address, bank account), your documents; your clients' data (here we act as processor) | Issuing and sending documents on your instruction | performance of a contract, Art. 6(1)(b) |
| Community: buddies, alliances, shared goals, alliance chat messages, reports and blocks | Community features, moderation | performance of a contract, Art. 6(1)(b); moderation: legitimate interest, Art. 6(1)(f) |
| Voluntary support: Stripe customer and subscription identifiers, status, currency, period, supporter-since date, public thank-you preference (we never receive card details) | Managing the Support, supporter badge, accounting | performance of a contract, (b); accounting and tax obligations, (c) |
| Notifications: notification settings, browser push subscription (push service address and encryption keys), log of e-mails sent (type, status, time – no content) | Delivering reminders and notifications, one-click unsubscribe | performance of a contract, (b); legitimate interest, (f) |
| API and calendar: API access tokens (hash, name, scopes and last use only), private calendar link (ICS) | Connecting tools you choose | performance of a contract, (b) |
| Technical and security data: IP address and browser of signed-in sessions, failed sign-in attempts, server logs (time, request path, status, user ID – no content), audit log of administrative actions; application error records (error type, screen, version, browser, user ID and your optional message under “Report this error” – no content, deleted after 30 days) | Security, abuse prevention, troubleshooting | legitimate interest, Art. 6(1)(f) |
| Website analytics (www.getcortex.cz and getcortex.online only, not the app): Google Analytics 4 | Measuring website traffic | consent, Art. 6(1)(a) (cookie bar) |
| Communication with us: content of e-mails | Handling your question, complaint or request | legitimate interest, (f); performance of a contract, (b) |
We use health data and journal entries only to show them to you. We do not share them with other users and do not use them for profiling or advertising. You can withdraw your consent at any time by deleting the records, switching the module off or deleting your account.
We do not sell any data, show no ads and use no advertising or remarketing tools. We do not make automated decisions with legal effects; game elements (experience, levels, badges) are calculated only for your own display.
3. What Other Users See
- Buddies see your username, profile picture and only the statistics you explicitly share with them (e.g. streak, active days, level, focus time).
- Alliance members see your name, picture, level, your contributions to alliance challenges and your messages in its chat.
- The leaderboard includes only you, your buddies and the members of your alliance; there is no global leaderboard.
- A shared goal is visible to its members, including progress.
- The supporter badge is shown to your buddies and alliance members; a public thank-you only if you switch it on.
We never show your e-mail to other users. The content of other modules (tasks, journal, finance, invoices…) is visible to you only.
4. Recipients and Processors
| Recipient | Role | Location / safeguards |
|---|---|---|
| Hetzner Online GmbH | Server and database hosting | Germany (EU), Nuremberg data centre |
| Stripe Payments Europe, Ltd. | Processing voluntary support payments | Ireland (EU); transfers to the USA under the EU-US Data Privacy Framework / standard contractual clauses |
| Resend (Plus Five Five, Inc.) | Delivering the app's e-mails | USA; standard contractual clauses / EU-US Data Privacy Framework |
| Google Ireland Limited | Google sign-in (if you use it); Google Analytics on the website (with consent only); YouTube player in the Focus music module (only when you start the music) | Ireland (EU); transfers to the USA under the EU-US Data Privacy Framework |
| Browser push services (Google, Mozilla, Apple, Microsoft) | Delivering push notifications to your device, if you enable them | notification content is encrypted (Web Push) |
| Czech Ministry of Finance (ARES), Czech National Bank | Company lookup by company ID, exchange rates | Czech Republic; we send only the company ID entered or a date – no data about you |
| AI apps and AI providers you choose yourself (e.g. Anthropic, OpenAI) | AI connectors (MCP) and the in-app AI assistant – only on your instruction | depends on the provider you choose; it processes data under its own terms |
We also make data available to other users as described in Section 3, and to public authorities where the law requires it.
AI connectors and the AI assistant: if you connect an AI app to the Service (e.g. Claude or ChatGPT through an MCP connector) or use the AI assistant with your own API key, we share data from your account (such as tasks, goals, time and invoices) only with the AI provider you chose yourself and only on your instruction – by connecting the app, within the permissions you grant it, or by sending a message to the assistant. You decide the permissions and can disconnect at any time in Settings → API & agents. We store your API key for the AI assistant encrypted and never display it; the AI provider processes the data it receives under its own terms. Legal basis: performance of a contract, Art. 6(1)(b).
5. How Long We Keep Data
- Account and all content: for as long as the account exists.
- Account deletion: you request it in Settings, confirm it via an e-mail link, and after a 7-day period (during which you can cancel) the account with all data, uploaded files and documents from the Invoicing module is irreversibly deleted. We offer you a data export before the deletion. Deleted data are removed from the production database within 30 days of the request at the latest, and from backups within a further 14 days (backups rotate after 14 days).
- Deleted tasks can be restored for 7 days and are then removed.
- Failed sign-in attempts: 24 hours. Session data (IP address, browser): up to 30 days after the session ends. Server logs: rotated by size, usually within a few weeks. Notification delivery records: 90 days.
- Data exports available for download: 7 days.
- Records of voluntary support payments and historical documents for paid CORTEX 1 licences: for the period required by tax and accounting law (usually up to 10 years).
- E-mail communication with us: as long as needed to handle it, then at most 3 years.
6. Security
All communication is encrypted (HTTPS). Passwords and access tokens are stored only as hashes. Each user's data are separated in the database so that no other user can access them. Uploaded files are not publicly accessible and are downloaded only through short-lived signed links. Administrative access is logged. The database and files are backed up daily.
7. Your Rights
You have the right of access to your data, rectification, erasure, restriction of processing and data portability, the right to object to processing based on legitimate interest, and the right to withdraw consent at any time (without affecting the lawfulness of earlier processing).
You can exercise most rights directly in the app: correct your data in Settings, download a complete export (JSON and CSV) in Settings → Data and delete your account in Settings → Account. Otherwise, write to us at info@getcortex.cz; we will reply within one month at the latest.
You also have the right to lodge a complaint with the supervisory authority: the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, uoou.gov.cz, or with the authority of your country of residence.
8. Cookies and Changes
The cookies and local storage we use are described in the Cookie Policy.
We may update this policy; we will inform you of a substantial change by e-mail or in the app.