Cortex Privacy Policy

1. Introduction

Enhanced Intelligence LLC ("we", "us", "our") operates Cortex, a business management app (the "App") for iPhone and on the web at cortex.enhancedint.com. Service businesses, such as auto detailers and pet care businesses, use Cortex to run bookings, jobs, clients, estimates, invoices and payments. This Privacy Policy explains what information Cortex handles, why, who else processes it, and how you can have it deleted.

Two groups of people appear in Cortex. The users are the owners and staff of a business, who sign in to the App. The business's customers never sign in to Cortex, but their details are recorded in it by the business, or by the customer when they book online, request an estimate or pay an invoice.

Each business decides what it records about its customers and is responsible for that information. We process it on the business's behalf to run the service. Cortex does not collect data for advertising, and it does not track you across other apps or websites.

This policy supplements our general privacy policy, which covers the Enhanced Intelligence website and other services.

2. Data We Collect

2.1 Account Information

When you create or are invited to a Cortex account, we collect:

• Sign-in details: Your name, email address and password. Passwords are handled by our authentication provider (Supabase Auth) and stored hashed, never in plain text.
• Role and membership: Which business you belong to and whether you are an owner, crew member or sales member.
• Device information: Basic information the App needs to run and keep you signed in, such as your app version and session.
• Notifications: If you turn on notifications in the iPhone App, it stores your phone's push token (the address Apple gives your phone for this app) so Cortex can tell you about new booking requests, payments received, jobs assigned to you and customer changes. You choose which in the App's Notifications settings, you can turn them off in your iPhone's Settings at any time, and signing out removes your phone.

2.2 Business Profile and Branding

The business's name, logo, brand colour, phone number, address, website, tagline, opening hours, crews and booking settings. Some of this is shown to the business's customers on booking pages, emails, estimates and invoices.

2.3 The Business's Customer Records

Businesses enter, or customers submit, information about the people they serve:

• Contact details: Names, email addresses, phone numbers and service addresses
• Vehicles and pets: Vehicle details for detailers, and pets with their profiles for pet care businesses, which can include breed, age, vaccination answers and behaviour notes
• Bookings and jobs: Requested and scheduled times, services chosen, prices, status, notes and service history
• Conversations: Texts, emails and call notes that the business chooses to log against a client
• Leads and sales pipeline: Prospects, contact attempts and notes

2.4 Photos and Files

• Job photos: Before, after and damage photos attached to a job. You can take them with the camera or choose them from your photo library. The App asks for camera or photo library permission only when you use that feature, and it reads only the photos you pick.
• Logo, brand kit, onboarding documents and gallery photos: Files a business uploads when setting up or presenting its business, including the logos, brand files, colours and fonts in its brand kit.

2.5 Money Records

Estimates, invoices, deposits, payments and refund records, including amounts, dates, status and the type of payment method (for example card or bank debit). Card and bank details are entered on Stripe's pages and handled by Stripe; Cortex never receives or stores full card numbers. Owners can also keep expense and mileage logs.

2.6 Agent Keys and Connected AI Apps

If an owner creates an API key or connects an AI app (for example ChatGPT or Claude), we store the connection, the permissions granted and a log of what it did. See section 6.

2.7 Instagram

A business owner can connect the business's Instagram professional account to Cortex (Business → Instagram → Connect Instagram). Cortex then reads, through Meta's Instagram API and only with the permissions the owner approves on Instagram's own screen:

• The account: its username and Instagram account ID, and an access token that lets Cortex read it. The token is kept encrypted and is never shown to anyone, including the business's staff or connected AI apps.
• Posts and their numbers: the business's own posts (link, caption, type and when it went up) and their insights, such as views, reach, likes, comments, shares, saves, follows, profile visits, skip rate and average watch time, so the business can see which posts work.
• Comments: on the business's own posts that ask viewers to comment a word, the usernames of the people who comment it, so each can become a lead for the business.
• Direct messages: the business's Instagram conversations: the other person's username and Instagram ID, the messages and any attachment links, and when each was sent, so the business can read and answer them in Cortex and see which lead each conversation belongs to.

Cortex never posts to the business's feed or stories. It sends a message on Instagram only when the business does: a reply someone at the business (or an AI app the owner connected, at the owner's request) sends from Cortex, or the private reply the business has set for people who comment a post's word. Instagram data is used only to provide these features to that business, under Meta's Platform Terms; it is not sold, shared with advertisers or used for any other purpose.

2.8 Data We Do NOT Collect

Cortex does not collect your device location, health or fitness data, contacts from your phone, advertising identifiers, or browsing history, and it contains no advertising or cross-app tracking SDKs. We do not store full card or bank account numbers.

3. How We Use Your Data

We use data to:

• Provide the service: Sign you in, run schedules, bookings, jobs, client records, estimates, invoices and reports
• Send email on a business's behalf: Booking confirmations and reminders, estimates, invoices, receipts, review requests and alerts to the business, sent to the customer or business address recorded in Cortex
• Process payments: Through the business's own Stripe account, so customers can pay invoices and deposits and the business can see what was paid or refunded
• Take bookings from AI assistants: If a business opts in, a customer's AI agent can look up open times and request a booking
• Answer calls: For businesses that use the AI phone agent, calls may be transcribed so a booking can be filed
• Keep Cortex secure: Prevent abuse, spam and fraud, enforce rate limits and investigate problems

We do not sell your data and we do not use it for advertising, profiling or any purpose unrelated to running Cortex.

4. Data Storage and Security

• Where it is stored: In a cloud-hosted database and file storage run by Supabase
• In transit: Data moves between the App, our servers and our providers over encrypted connections (HTTPS/TLS)
• Passwords: Hashed, never stored in plain text
• Access control: Each business's data is separated from other businesses by database row-level security, and what a person or key can see or change depends on their role (owner, crew or sales)
• Files: Job photos and onboarding documents are kept in private storage and opened only through short-lived links

While we take reasonable measures, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.

5. Service Providers We Use

We use the following providers to run Cortex. Each receives only the data it needs for its role and has its own privacy policy.

• Supabase: Database, sign-in, file storage and the backend functions that power the App
• Vercel: Hosting for the Cortex web app and hosted booking pages
• Stripe: Payments. Each business connects its own Stripe account, and Stripe collects and handles card and bank details under Stripe's privacy policy
• Resend: Delivery of the emails Cortex sends
• Google: Calendar sync for businesses that connect a Google Calendar, and Maps, Places and Address Validation to check and complete addresses
• Cloudflare: Turnstile bot protection on public booking pages
• Meta (Instagram): Only for businesses that connect Instagram. Cortex reads the business's own account, posts, insights, comments and messages through Meta's Instagram API and sends the business's replies through it (section 2.7), under Instagram's privacy policy
• Apple: Delivers notifications to iPhones through the Apple Push Notification service. A notification carries a short summary, such as a customer's first name and last initial, the service and the time, never a customer's own message
• Twilio, LiveKit and OpenAI: Only for businesses that use the AI phone agent. They carry the call, run the voice agent and transcribe it so a booking can be filed

We do not use advertising networks, analytics platforms that track you across sites, or data brokers.

6. Connected AI Apps and API Keys

An owner can let an AI app, such as ChatGPT or Claude, or a script work with the business's Cortex data. This happens only if the owner starts it. The owner chooses the permissions, limited by their role, and can review, narrow or revoke any key or connection at any time under Business → API keys. Actions with lasting effects, such as sending a message to a customer or deleting a record, carry the owner's own words asking for them, which Cortex records.

Once a connected AI app reads data from Cortex, that AI provider processes it under its own terms and privacy policy. Cortex does not control what it does with data after reading it, so connect only apps you trust.

7. Data Sharing

• We do not sell your data
• We do not share data with advertisers or use tracking or advertising SDKs
• We share data with the service providers in section 5 and the apps you connect in section 6, only to run Cortex
• We may disclose information if required by law or to protect our legal rights

8. Data Retention

We keep a business's data for as long as its account is active or as needed to provide the service. A business's records belong to the business, so they stay with the business when an individual user leaves. Some records, such as invoices and payment history, may need to be kept for accounting or legal reasons even after you ask for deletion.

9. Deleting Your Data

• Delete your own login: In the App, go to Settings → Delete account. This removes your sign-in. The business's records, including work you entered, stay with the business.
• Delete a whole business's data: The business owner can ask us to delete the business and its records by emailing Solutions@enhancedint.com with the subject line "Data Deletion Request" from the owner's email address.
• Instagram data: The owner can stop Cortex reading Instagram at any time under Business → Instagram → Disconnect, which deletes Cortex's access token at once; removing Cortex from the account in Instagram (Settings → Apps and websites) also ends its access. To have the Instagram data Cortex already copied (posts, insights, comment leads and messages) deleted, email Solutions@enhancedint.com with the subject line "Instagram Data Deletion Request" from the owner's email address; we delete it and confirm by email. Someone who messaged or commented on a business's account can ask the business, or email us the same way.
• A customer of a business: Ask the business first, since it controls its customer records. You can also email us and we will pass your request to the business or act on it as the law requires.

10. Your Rights

Depending on where you live, you may have the right to:

• Access: Request a copy of the personal data held about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data
• Portability: Receive your data in a machine-readable format
• Objection: Object to the processing of your data

Users can exercise these rights through their business or by contacting us. Customers of a business should contact that business first. To contact us: Solutions@enhancedint.com.

11. Children's Privacy

Cortex is a business tool and is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete it promptly. If you believe a child under 13 has provided us with personal information, please contact us.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: Solutions@enhancedint.com
• Contact Form: enhancedint.com/contact
• Location: San Diego, CA, USA