Who we are
Cortex is published by BK Human Fund Pty Ltd (ABN 20 613 204 621), of Victoria, Australia, trading as Cortex. “Cortex”, “we” and “us” mean that company. The application runs at https://app.cortex-ai.com.au/ and this website at https://cortex-ai.com.au.
We handle personal information under the Australian Privacy Act 1988 and the Australian Privacy Principles. This policy is also written to meet the EU and UK General Data Protection Regulations and the terms Shopify sets for apps that use its API.
For anything about privacy, write to contact@huntthenight.com.au.
Whose data it is
Three kinds of people appear in this policy: the merchant (the business that installs Cortex on its Shopify store), the merchant’s staff who sign in to Cortex, and shoppers (the merchant’s own customers).
- For shoppers’ personal information, the merchant is the controller. Cortex is a processor: it handles that information only on the merchant’s instructions, which are the mappings and settings the merchant saves and the syncs it switches on.
- For the account details of the merchant’s staff, Cortex is the controller.
What we collect
About the merchant’s staff
When a person signs in, Shopify gives Cortex their name, email address, whether Shopify has verified that address, their Shopify user id and whether they are the store’s owner or a collaborator. Cortex stores those with the person’s access status and capabilities in Cortex, the time they last signed in and their notification preferences.
About the store
Cortex stores the shop domain, the permissions (scopes) the store granted, the store’s Shopify access token and the merchant’s Retail Express credentials: an API key and the SOAP client id, username and password. The token and the credentials are encrypted at rest. Cortex also stores the store’s settings, its mappings and its sync history.
About shoppers
To sync an order, Cortex reads from Shopify the shopper’s name, email address, phone number, billing and shipping addresses and company, with the order’s contents and notes. It does not keep a copy. The next section says exactly what happens to that information.
Logs and monitoring
Request logs record the IP address, the shop domain and the route requested, with query strings and credentials removed. Error text has data values scrubbed from it. Operational metrics carry no store identifier and no personal identifier.
What happens to shoppers’ data
Cortex sends the shopper’s details and the order to the merchant’s own Retail Express account, to create or update the customer and the order there. In the other direction it writes an order’s email address and delivery address from Retail Express back to Shopify.
What Cortex persists is identifiers and links, so that the two records stay matched: the Shopify and Retail Express ids of the order and the customer, order numbers, amounts, and fingerprints (digests) of the data it last wrote. Contact details are held only inside a sync operation that is in progress, and are erased when that operation settles. The notifications Shopify sends Cortex are trimmed to ids before they are stored.
- Cortex never uses shoppers’ data for marketing, analytics, profiling, advertising or automated decision-making.
- Cortex never sells it.
- Cortex shares it with no one except the merchant’s own Retail Express account.
What we use it for
- Staff account details: to sign people in, to apply the access each person has been granted, to record who changed what in the audit log, and to send the email alerts each person has chosen.
- Store data: to connect to Shopify and Retail Express on the merchant’s behalf and to run the syncs the merchant has switched on.
- Shoppers’ data: to create and update customers and orders in the merchant’s Retail Express account and keep the two systems’ records matched. Nothing else.
- Logs and monitoring: to keep the service running, find faults and detect abuse.
AI assistants
Cortex itself sends no data to any AI or language-model provider.
Cortex includes an MCP server, which is opt-in. A store member may connect an AI assistant of their own choosing through an OAuth consent page, and that assistant can then act with the capabilities the member holds and no more. What the assistant receives is handled by the provider the member chose, under that provider’s terms. A connection can be revoked in Cortex at any time.
Who receives data
These are the only parties Cortex passes data to. There are no analytics providers and no advertising providers.
- Render Services, Inc.
- Hosts the application and its managed PostgreSQL database, in Render’s Singapore region. Render’s network edge is provided by Cloudflare. Render also keeps the database’s backups.
- Shopify
- The platform Cortex is installed on. Shopify also bills for the app: Cortex never sees payment card details.
- The merchant’s Retail Express account (Maropost)
- Receives customers and orders, as the merchant has instructed.
Where data is stored
Cortex’s data is stored in Singapore. Our staff access it from Australia. If you are in another country, including one in the European Economic Area or the United Kingdom, your information is therefore transferred to and handled in Singapore and Australia.
How long we keep it
- Sync history
- 90 days.
- Security audit log and the log of protected-data reads
- 400 days.
- Browser sessions
- About a day; a session lasts as long as the Shopify sign-in it came from.
- Links between Shopify and Retail Express records
- For as long as the app is installed.
- Database backups
- 7 days. They are Render’s point-in-time recovery data and daily backups of the managed database, encrypted at rest by Render and held in its Singapore region.
Uninstalling and erasure
When a merchant uninstalls Cortex, the store’s Shopify access token, every browser session and the Retail Express credentials are deleted immediately, and syncing stops. Mappings, record links and history are kept in case the store reinstalls, until Shopify sends its request to erase the shop, which it does 48 hours after an uninstall. On that request, everything Cortex holds for the store is erased.
Requests Shopify sends about a shopper
- Erasure (customers/redact)
- Cortex deletes its links and any details it holds for that person within 30 days, and normally at once. It records the person’s Retail Express customer ids for the merchant, because the copy in Retail Express belongs to the merchant, who must erase it there.
- Access (customers/data_request)
- Cortex records the request and notifies the merchant, who can export what Cortex holds about the person from Settings > Privacy requests within 30 days.
Security
- Connections are encrypted in transit with TLS, and browsers are told to use HTTPS only (HSTS).
- The Shopify access token and Retail Express credentials are encrypted at rest with AES-256-GCM, bound to the store that owns them, with keys that can be rotated.
- Session tokens and OAuth tokens are stored only as hashes, never raw.
- Every Shopify webhook is verified by its HMAC signature before it is acted on.
- Each store member has only the capabilities granted to them, and one store’s data is isolated from another’s.
- Setup and access changes are written to an append-only audit log.
- Requests are rate limited, database backups are encrypted at rest, and production and test environments are separate.
If a data breach affects a merchant’s data, we notify the affected merchants without undue delay, and the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme requires it.
Your rights
If you are a shopper
Contact the store you bought from first. It decides what is done with your information, and holds the copies in Shopify and Retail Express. If you write to us instead, we pass your request to that merchant.
If you are a member of a merchant’s staff
You may ask for access to the account details Cortex holds about you, and for them to be corrected or deleted. Write to contact@huntthenight.com.au.
Complaints
If you think we have mishandled your information, tell us first at contact@huntthenight.com.au so we can put it right. You may also complain to the Office of the Australian Information Commissioner at oaic.gov.au. If you are in the European Economic Area or the United Kingdom, you may complain to your local data protection authority.
Children
Cortex is a tool for businesses. It is not directed at children, and accounts are for a merchant’s staff only.
Changes to this policy
When this policy changes, the new version is published on this page with the date it was last updated.
Contact
BK Human Fund Pty Ltd (ABN 20 613 204 621), trading as Cortex, Victoria, Australia.
Email contact@huntthenight.com.au.