Privacy Policy

1. Roles: controller and processor

We are the controller of your account data (name, email, company, billing) and of data about your use of the Services.

With respect to the data your company puts into Cordex — contacts, WhatsApp and other channel conversations, CRM deals, campaigns, automations, and files — your company is the controller and Cordex acts as the processor, processing that data only to provide the Services on your company's instructions.

2. Data we collect

• Registration data: name, email, password (stored only as a hash), photo, and language; if you sign in with Google, we receive the name, email, and photo of your Google account.
• Company data: name, members, invitations, plan, and billing history. Card data is collected and stored by Stripe; Cordex does not store card numbers.
• Customer content: contacts, messages, media, notes, deals, custom fields, AI agents, flows, campaigns, audiences, and reports that your company creates or receives through connected channels.
• Integration credentials: access tokens for the channels and ad networks you connect, stored encrypted.
• Technical data: IP address, browser, access and error logs, and an activity log of the operations performed on the account (including those performed through the API and MCP).
• Communications: messages you send us through support.

3. How we use data

• To provide, maintain, and protect the Services: authentication, sending and receiving messages, automations, AI agents, reports, and support (performance of a contract, Art. 7, V, LGPD).
• Billing and tax obligations (performance of a contract and compliance with a legal obligation).
• Security, fraud and abuse prevention, auditing, and the access logging required by Brazil's Internet Civil Framework (Marco Civil da Internet, Law 12.965/2014) (legal obligation and legitimate interest).
• Communications about your account and the product, such as security alerts and changes to this policy.
• To improve the product using aggregated usage metrics. We do not use customer content to train AI models or for advertising, and we do not sell personal data.

4. AI assistants, API, and MCP server

Cordex offers a REST API and a remote MCP server (https://app.cordex.ai/api/mcp) so that third-party AI assistants, such as Claude (Anthropic), ChatGPT (OpenAI), Grok (xAI), and others, can operate your account at your request.

A connection is only made after you sign in to Cordex, choose the company, and approve the OAuth consent screen, which shows the application, the redirect address, and the scopes requested. You can limit access to specific modules and to read-only, and revoke it at any time in Settings › API and MCP; revocation invalidates the tokens immediately.

The assistant receives only the results of the tools it calls, within the approved scopes. Cordex receives only the parameters of each call: we do not collect, request, or store your conversation history with the assistant, its memory, or your files.

Write calls are recorded in the company's activity log, marked as made via API. What the assistant does with the results is governed by the assistant provider's privacy policy.

5. Sharing and subprocessors

We share data only with providers necessary to operate the Services, under contract and with confidentiality and security obligations:

• Hetzner Online (Germany): server and database hosting.
• Cloudflare (R2): storage of media and files.
• OpenRouter and the model providers it routes to: AI processing for the agents and the Copilot, with no use for training.
• Meta (WhatsApp Business Platform, Instagram, Messenger) and partner providers of access to the official API and to ad networks: sending and receiving messages and ad integration, when your company connects those channels.
• Stripe: payments and subscriptions.
• Resend: transactional email delivery (verification, invitations, alerts).
• Google: sign-in with Google, when you choose that option.
• Integration provider: connections to third-party applications that your company enables.

6. International transfers

Some subprocessors are located outside Brazil (European Union and United States). These transfers follow Art. 33 of the LGPD, with contractual clauses and equivalent safeguards.

7. Retention

• Account data and customer content: while the account is active. After the account is closed at your request to support, we delete or anonymize it within 90 days, except for what the law requires us to keep.
• Application access logs: 6 months, as required by the Marco Civil da Internet.
• Tax and billing data: for the legal period (generally 5 years).
• OAuth access tokens last 10 minutes and refresh tokens 30 days; both are deleted or invalidated when you revoke access.

8. Security

We use HTTPS on all connections, hashed passwords, encrypted channel credentials, per-company data isolation in the database (row-level security), PKCE and token rotation in OAuth, role-based access control, and activity logging. No system is completely immune; if a significant incident occurs, we will notify those affected and Brazil's National Data Protection Authority (ANPD) as required by law.

9. Your rights

You may request confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing, and withdrawal of consent, and you may object to processing (Art. 18 of the LGPD). If the data belongs to a company that is a Cordex customer, we will forward the request to that company. We will respond within 15 days. You may also file a complaint with the National Data Protection Authority (ANPD).

10. Cookies

We use strictly necessary cookies to maintain your session and remember your language and theme. We do not use advertising cookies on the platform.

11. Children

The Services are intended for businesses and are not directed to anyone under 18.

12. Changes to this policy

We may update this policy. The date at the top indicates the latest version; significant changes will be notified by email or on the platform.

13. Contact and Data Protection Officer (DPO)

Data Protection Officer: privacidade@cordex.ai. Support: suporte@cordex.ai or WhatsApp +55 11 98805-6388. Address: CORDEX AI TECNOLOGIA LTDA, Rua Bom Pastor, 529, sala 03, Ipiranga, São Paulo/SP, CEP 04203-050, Brasil.