Cortexa

Privacy Policy

Last updated: October 26, 2026

1. Who we are

Cortexa LLC, a New Jersey limited liability company located at 16 Pocono Rd STE 205, Denville, NJ 07834 ("Cortexa", "we", "us"), operates a webinar and lead-management platform that lets clinics and other organizations host automated webinars, register attendees, collect leads, and schedule appointments. This policy explains what personal data we process, why, and what rights you have. For any privacy question or request, contact privacy@cortexa.vip.

Cortexa is used by two kinds of people: hosts (staff of the organization running webinars) and viewers (people who register for and attend webinars). Where a clinic uses Cortexa to manage its own attendees and leads, that clinic determines why the data is collected and is the controller of that data; Cortexa processes it on the clinic's behalf.

2. Data we collect

  • Account data — name, email address, and a password (stored as a secure hash), or your Google / Microsoft profile identifiers if you sign in with those providers.
  • Webinar registration and attendance — the name, email, and optional phone number you register with, plus attendance records such as join time, watch time, chat messages, and questions you ask during a webinar.
  • Appointments — booking details you submit when scheduling a consultation (name, contact details, chosen time, notes).
  • Google Calendar data — if a clinic connects its Google Calendar, the limited calendar data described in section 4.
  • Leads — contact information collected through webinar sign-up forms, files imported by the organization, or Facebook Lead Ads forms (see section 3), such as name, email, phone number, and answers to the form's questions.
  • Payment data — subscription status and billing events. Card details are collected and stored by our payment processor, Stripe; Cortexa never stores card numbers.
  • Content — webinar videos and materials uploaded by hosts, and transcripts generated from them.
  • Technical data — logs, device and browser information, and cookies required to keep you signed in.

3. Facebook / Meta data

When an organization connects its Facebook Page to Cortexa, we store an access token for that Page and use Meta's Graph API to retrieve leads submitted through the organization's own Facebook Lead Ads forms. This data is used for exactly one purpose: delivering the organization's leads into its own Cortexa CRM so it can follow up with people who expressed interest.

  • Lead data retrieved from Meta is visible only to the organization that owns the Facebook Page. It is never shared across organizations, sold, or used for advertising by Cortexa.
  • Disconnecting the Facebook Page in the Integrations settings removes the stored access token immediately.
  • See our Data Deletion Instructions for how to have this data removed.

4. Google user data

A clinic can connect its Google Calendar to Cortexa. A member of the clinic's team signs in with Google and allows Cortexa to see, create, change, and delete events on the calendars that Google account owns. Cortexa uses this access only to:

  • Add appointments to the clinic's calendar. Each appointment booked through Cortexa is added to the account's primary Google Calendar, and the event is updated or removed when the appointment is rescheduled or cancelled. Depending on the clinic's setting, the event contains the appointment type plus the booking person's name, email, phone number and notes, or only the appointment type and a link back to Cortexa.
  • Avoid double-booking. Cortexa reads the start and end time and the "busy / free" setting of events on the primary calendar, so that times the clinic is already busy are not offered on its booking page. Cortexa does not read event titles, descriptions, locations, or guest lists.

What we store: the connected Google account's email address and account identifier, the access and refresh tokens Google issues (encrypted at rest), and, for each appointment, the ID of the calendar event Cortexa created. Busy times are kept only in server memory for about a minute and are never written to our database.

How we protect and share it: Google user data is never sold, never used for advertising, and never used to develop, improve, or train generalized artificial-intelligence or machine-learning models. It is not transferred to anyone except as needed to provide the feature (our hosting providers), to comply with applicable law, or as part of a merger or acquisition with prior notice. Cortexa staff do not read Google user data unless the clinic asks us to for support, or it is needed for security purposes or to comply with the law.

Removing access: disconnecting Google Calendar in Cortexa (on the Integrations or Scheduling page) revokes Cortexa's access at Google and deletes the stored tokens immediately. Events already added stay in the clinic's calendar, under its control. Access can also be removed at any time from your Google Account's permissions page.

Cortexa's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. How we use data

  • Providing the platform: webinars, streaming, chat, and Q&A.
  • Sending webinar confirmations, reminders, and follow-up messages by email and — where an organization has enabled it — WhatsApp.
  • Scheduling and managing appointments booked with a host.
  • Adding appointments to a clinic's connected Google Calendar and keeping its busy times off the booking page (section 4).
  • Generating suggested answers to webinar questions using AI, based on the webinar's own transcript and FAQ content.
  • Billing, account management, and service communications.
  • Security, debugging, and preventing abuse of the platform.

We do not sell personal data.

6. Service providers

Cortexa relies on a small set of processors to run the service. Data is shared with them only to the extent needed for their function:

  • Amazon Web Services — video storage and transcription
  • Mux — live video streaming and playback
  • Stripe — payments and subscriptions
  • Resend — transactional email delivery
  • Twilio — WhatsApp message delivery
  • OpenAI — generation of webinar Q&A suggestions
  • Meta Platforms — Facebook Lead Ads integration
  • Google — Google sign-in and the Google Calendar integration
  • Hosting and infrastructure providers for the platform itself

7. Retention and deletion

We keep personal data for as long as the related account or organization relationship is active, and for a reasonable period afterwards where required for billing or legal reasons. Webinar registration and lead data is kept for as long as the organization that collected it keeps it in its CRM. Google Calendar tokens are deleted as soon as the clinic disconnects Google Calendar.

You can request deletion of your data at any time — see the Data Deletion Instructions.

8. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, email privacy@cortexa.vip from the address associated with your data. If your data was collected by a specific clinic or organization, we may refer your request to them as the controller of that data, or handle it together with them.

9. Changes to this policy

We may update this policy as the platform evolves. Material changes will be announced in the application or by email. The date at the top of this page reflects the latest revision.