Privacy

TL;DR

This site stores three technical preferences locally (theme, language, your consent choice). It runs Google Analytics 4 only if you accept via the consent banner — with IP anonymization, no ad cookies and no profiling. If you reject, zero analytics fire. No other third parties, ever.

Local preferences (no consent needed)

• cortex-theme — dark / light preference.
• cortex-lang — EN / IT preference.
• cortex-consent— your analytics consent record (so we don't ask again).

Under ePrivacy / GDPR, storage strictly necessary to deliver a service the user requested does not require prior consent.

Analytics — opt-in only

We use Google Analytics 4 (property G-L0YBYGM4P7) with Consent Mode v2. On first load, analytics_storage, ad_storage, ad_user_data and ad_personalization are all set to denied. We also disable Google signals and ad personalization signals, and request IP anonymization.

Only after you click Accept in the banner does GA start collecting: pages viewed, clicks on CTAs, form submissions (without the values), language / theme toggles, and standard Enhanced Measurement signals (scroll, outbound links, file downloads).

Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time from the link at the bottom of this page — no questions asked.

When you request access

If you submit the waitlist form, we collect your work email and optionally your role and company. Legal basis: performance of pre-contractual steps taken at your request (Article 6(1)(b) GDPR). We use this strictly to invite you to the private beta and related product updates. No marketing profiling, no resale, no ad platforms.

Your record is stored and the confirmation email is delivered by Resend (Drinkflow Inc. dba Resend, San Francisco — EU-US Data Privacy Framework certified), acting as our processor under a DPA. Email content, your address, role and company are transmitted to Resend for the sole purpose of onboarding communications. You can ask us to delete your record at any time by writing to privacy@cortexcommerce.io. We reply within 7 days and confirm deletion.

Data residency and security

Waitlist data is stored in EU regions. Transport is over TLS 1.3. When the product ships, SOC 2 Type II will be in progress and row-level isolation per tenant will apply.

Google Analytics processes data on Google infrastructure and, per Google's current EU arrangements, may transfer aggregated data outside the EU under the EU-US Data Privacy Framework (Google LLC is certified). If you're not comfortable with that, reject analytics — you won't lose any functionality.

Your rights (GDPR)

Access, rectification, erasure, restriction, portability, objection, withdrawal of consent. Data controller: Cortex Commerce Srl, Milano. Write to privacy@cortexcommerce.io. If we fail to resolve your request, you can file a complaint with the Italian Data Protection Authority (Garante Privacy).

Change your mind

Reopen the consent banner to update or withdraw your choice: