Privacy Policy

• We do not use third-party advertising or analytics trackers - no Google Analytics, no Meta pixel, no ad networks, no cross-site tracking.
• We do not sell, rent, or share your personal data for anyone else's marketing.
• We do not build advertising profiles or track your activity across other websites.
• We collect only what we need to give you an account, deliver what you bought, and keep the service secure.

The controller is Khay Digital Ltd, registered in Mauritius, a member of the Khay Group. For any privacy question or request, contact info@khay.digital.

• Account data - your name and email address, and a securely hashed password (handled by our authentication provider; we never see your password).
• Purchase data - the bundles you buy, order amounts, and dates. We do not receive or store your card number - that goes directly to our payment processor.
• Support messages - anything you send us by email.
• Minimal technical data - standard server logs (such as IP address and timestamps) kept briefly for security, fraud prevention, and debugging.
• First-party usage counts - we keep our own internal, aggregated record of which pages are viewed and where visitors arrive from (referrer/source and coarse country), tied only to a random first-party identifier stored in your browser. This stays in our systems, is never shared with third parties, and is not used to track you across other websites.

We use only what is strictly necessary to run the service - no advertising or analytics cookies:

• A first-party authentication cookie to keep you signed in (set by our authentication provider).
• First-party browser storage on your device to remember simple preferences (such as your chosen currency). This stays in your browser and is not shared with third parties.
• On payment pages only, our payment processor (Stripe) may set cookies strictly to process the payment and prevent fraud - not for advertising.

Under the GDPR / UK GDPR and the Mauritius Data Protection Act 2017, we rely on:

• Performance of a contract - to create your account, deliver purchased bundles, and provide updates and support.
• Legal obligation - to keep accounting and tax records of your purchases.
• Legitimate interests - to secure the service, prevent fraud and abuse, and fix problems (balanced against your rights).
• Consent - only if we ever send optional marketing; you can withdraw it at any time.

We use a small number of trusted providers strictly to run the product. They act on our instructions under data-processing terms and are not trackers:

• Supabase - authentication, database, and file storage (your account, purchases, and skills).
• Stripe - payment processing (card data goes directly to Stripe; we never store it).
• Vercel - website hosting and content delivery.
• An email provider - to send receipts and update notifications.

We and our providers may process your data in countries other than your own. Where we transfer personal data internationally, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.

We keep your account and purchase records while your account is active and for as long as needed to provide lifetime access and meet legal, tax, and accounting obligations. Security logs are kept only briefly. You can ask us to delete your account at any time, subject to records we must retain by law.

Depending on where you live, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Delete your data (subject to legal retention);
• Restrict or object to certain processing;
• Receive a portable copy of your data;
• Withdraw consent where processing is based on consent.

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects. To exercise any right, email info@khay.digital. You also have the right to complain to a supervisory authority - the Data Protection Office in Mauritius, or your local authority in the EU/UK (such as the ICO).

We protect your data with encrypted connections (HTTPS), access controls, and database row-level security. No system is perfectly secure, but we work to protect your data and to respond promptly to any incident.

Cortex is not intended for anyone under 18, and we do not knowingly collect data from children.

We may update this policy from time to time and will update the “last updated” date above. For any privacy question or request, contact info@khay.digital.