Cortx IQ Privacy Notice
How we handle personal data relating to Cortx IQ users
This Privacy Notice explains the processing for which we act as controller in connection with Cortx IQ, and gives an overview of the wider processing chain. In this notice, the Customer is the organisation that subscribes to Cortx IQ, usually your employer. Please read this notice together with the Customer's own privacy information, which covers the processing the Customer controls through the Platform.
We do not treat reading or acknowledging this notice as consent. Where we rely on consent for a specific activity, we will explain that activity, and how to withdraw consent, separately.
1. Who we are and how to contact us
Yentra.ai Limited, a company incorporated in England and Wales (company number 16348449), registered office at 128 City Road, London, United Kingdom, EC1V 2NX, trading as Cortx IQ ("Cortx IQ", "we", "us").
Privacy contact: privacy@cortxiq.com.
2. Controller and processor roles
For Customer Personal Data within Customer Data, the Customer is the controller and we are the processor, acting on the Customer's documented instructions under Schedule 2 of the Cortx IQ Terms and Conditions. For Shared Cloud Deployments this includes hosting and processing within the Platform. For Dedicated Deployments, we act as processor when we access Customer Personal Data for support or Onboarding Services.
We act as an independent controller where we determine the purposes and means of processing, including for account administration, business contact management, service security and abuse prevention, support administration, billing, legal compliance and service notices. The Customer may separately act as controller for the same information for its own employment, security or business purposes.
Koneqt Limited supports us in providing Cortx IQ. It acts as an approved sub-processor for engineering, technical support and onboarding services, and may process Customer Personal Data only on our behalf and in line with the Cortx IQ Terms and Conditions and applicable data protection requirements. Koneqt is based in the Isle of Man. Our other approved sub-processors are listed in section 6.
3. Personal data, purposes and lawful bases
| Data category | Purpose | Our role | Lawful basis where we are controller | Retention / criteria |
|---|---|---|---|---|
| Business contact and account data | Create and administer access; manage the Customer relationship; service notices | Controller | Legitimate interests in operating and administering Cortx IQ; legal obligation where applicable | For the Customer relationship and afterwards as reasonably necessary for account, billing, legal and audit obligations |
| Authentication, usage and audit logs | Authenticate users; secure the Platform; investigate incidents; maintain auditability | Controller for our security purposes; processor where logs are Customer-directed | Legitimate interests in security, resilience and fraud/abuse prevention; legal obligation where applicable | Administrative and data-access audit logs: 12 months, subject to configuration and legal requirements |
| Device and technical data | Security, troubleshooting and service operation | Controller | Legitimate interests in secure and reliable service operation | For as long as reasonably necessary for the operational or security purpose |
| Support and communications data | Respond to enquiries; provide support; manage incidents | Controller | Legitimate interests in providing and evidencing support | For as long as reasonably necessary for support, dispute, audit and legal requirements |
| Customer Data, prompts, connected records and Output | Provide Cortx IQ functionality to the Customer | Processor | The Customer determines the lawful basis; we process under the DPA and the Customer's documented instructions | The Terms and Conditions and DPA apply, including the deletion process in section 9 |
| Aggregated or non-identifying usage data | Operate, secure and improve Platform performance | Controller where no longer personal data; otherwise role depends on processing | Legitimate interests where personal data is involved and the use is proportionate | Only for as long as necessary for the purpose; aggregated data may be retained where it no longer identifies the Customer or an individual |
| Feedback | Respond to and use product feedback | Controller | Legitimate interests in improving the service | For as long as relevant to the feedback and related product record |
| Marketing preferences and business contact data | Business-to-business marketing where permitted | Controller | Legitimate interests or consent, depending on PECR and the communication | Until opt-out/withdrawal or when no longer relevant, subject to suppression records |
4. Sources of personal data
- Directly from you when you use Cortx IQ or contact support
- From the Customer, including account details, permissions and information in connected data sources
- Automatically from use of the Platform, including authentication, usage, audit and technical logs
- From identity, authentication or integration providers configured by the Customer
- From Customer-Connected Services where the Customer chooses to connect them
5. AI Input, Output and model processing
Customer Data may include prompts, documents, emails, CRM records, chats and other information connected by the Customer, together with Outputs generated by Cortx IQ. We process this information to provide the Platform and services to the Customer.
We will not use Customer Data to train or improve AI models that are made available to other customers. Customer Data may be used to build or retrain a custom model only where the Customer expressly commissions that work under a Statement of Work, and the resulting custom model is for that Customer's exclusive use, as described in the Cortx IQ Terms and Conditions.
For Shared Cloud Deployments, AI requests may be routed through approved sub-processors, including OpenRouter and the model providers reached through that service, with zero data retention routing. Section 6 lists these providers, where they process data and the transfer mechanisms used. The Customer can ask us for the current list that applies to its configuration.
6. Recipients and approved sub-processors
| Sub-processor | Purpose | Location of processing | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, database and storage for Shared Cloud Deployments | United Kingdom, AWS London region | Storage in the UK; AWS data processing addendum with UK transfer terms for any access from outside the UK |
| OpenRouter, Inc. | Routing AI requests to model providers | United States | UK Addendum to the EU Standard Contractual Clauses |
| Anthropic and OpenAI, reached through OpenRouter | AI inference, with zero data retention routing | United States | Through OpenRouter arrangements with each provider |
| Koneqt Limited | Engineering, support and Onboarding Services | Isle of Man | UK adequacy regulations |
| Techohara Solutions | Engineering support | India | International Data Transfer Agreement |
We may update our approved sub-processors in line with the Data Processing Addendum. It requires us to give the Customer at least 30 days' notice of a new or replacement sub-processor, or as much notice as is reasonably practicable for AI model providers where 30 days is not possible.
7. Customer-Connected Services
The Customer may choose to connect Cortx IQ to external AI tools, models or other services that the Customer selects and contracts for itself, such as its own ChatGPT, Claude or Copilot account. Data sent to those Customer-Connected Services is processed under the Customer's own arrangements with the relevant provider. Those services are not our sub-processors merely because the Customer connects them through Cortx IQ.
8. International transfers
Where Customer Personal Data is transferred outside the United Kingdom or accessed from outside the United Kingdom, we will use a transfer mechanism that meets applicable UK data protection law, such as an adequacy regulation, the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any assessment required by law. The mechanism for each approved sub-processor is recorded in the Data Processing Addendum and shown in section 6.
Transfers to Koneqt Limited in the Isle of Man rely on UK adequacy regulations. Transfers to OpenRouter in the United States use the UK Addendum to the EU Standard Contractual Clauses.
9. Retention and deletion
- Audit logs of administrative and data-access actions are retained for 12 months, subject to configuration and legal requirements
- Daily encrypted backups for Shared Cloud Deployments are retained for 30 days
- After termination, the Customer has a 30-day period in which to request export of Customer Data in a standard machine-readable format
- After that export period, Customer Data is deleted from live systems within 30 days and from backups within 90 days, unless the law requires it to be kept
- Controller-held account, contact, support and billing records are retained only for as long as reasonably necessary for the relevant business, security, legal, audit or dispute purpose
10. Security
We maintain technical and organisational measures appropriate to the risk, including TLS 1.2 or higher in transit, AES-256 encryption at rest, role-based access, least privilege, multi-factor authentication for administrative access, audit logging, vulnerability management, staff vetting and training, backups and incident response.
11. Your data protection rights
Where we act as controller, and subject to the conditions and exemptions in applicable data protection law, you may have rights of access, rectification, erasure, restriction, objection and data portability, together with rights relating to certain automated decision-making. Where we rely on your consent, you can withdraw it at any time. To exercise these rights, contact privacy@cortxiq.com.
Where the request relates to Customer Personal Data for which the Customer is controller and we are processor, please send it to the Customer. If you send it to us, we will pass it to the Customer without undue delay, and we will give the Customer reasonable help as the Data Processing Addendum requires.
12. Automated decision-making
Our Terms and Conditions restrict use of Cortx IQ for decisions based solely on automated processing that have legal or similarly significant effects on individuals, unless the Customer has put in place the safeguards required by applicable data protection law, including appropriate notice, the ability to make representations and human review where required.
Where we ourselves use personal data for solely automated decisions that produce legal or similarly significant effects, we will provide the information, rights and safeguards required by applicable data protection law.
13. Complaints
You have the right to complain to us about how we handle your personal data. Please email privacy@cortxiq.com or contact us by any other means. We will acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome. You can also complain to the UK data protection regulator, the Information Commission (still known as the ICO): ico.org.uk/make-a-complaint, helpline 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
14. Changes to this Privacy Notice
We may update this Privacy Notice from time to time. Where changes are material, we will take reasonable steps to bring them to your attention before or when they take effect.