Privacy Policy

1. Who we are

Engine Cortex (Arsova, Culiacán, Sinaloa, Mexico) operates an AI sales-agent platform for small and medium businesses. We act as the data controller for account data, and as a processor for the end-customer conversations our business customers route through the platform.

Privacy contact: info@enginecortex.com

2. What we collect

• Identification and contact data — name, email, phone, business name.
• Account data — plan, settings, agent configuration, usage counters.
• Conversation data — messages exchanged between your customers and the agent across WhatsApp, Telegram and the web widget.
• Usage and analytics data — pages visited, feature usage, technical error reports.
• Financial data — processed by Stripe. We never store full card numbers.

3. Why we use it

• To operate the service: generate agent replies, manage your catalog, orders, appointments and CRM.
• To bill your subscription and enforce plan limits.
• To provide support and to detect abuse and fraud.

We never use your conversations to train AI models.

4. Third parties and international transfers

The platform runs on Amazon Web Services in the United States (us-east-1). Message text is sent to AWS Bedrock for model inference, with personal data deterministically redacted beforehand. Other processors include Meta (WhatsApp), Microsoft Azure (voice transcription and synthesis), Stripe (payments), Google Analytics and Sentry — all in the United States.

These transfers are made under the LFPDPPP in force. The full processor table is in the Spanish notice, section 4.

5. Security

• Encryption in transit (TLS/HTTPS).
• Field-level AES-256-GCM encryption for API keys, integration credentials, payment instructions and knowledge-base documents.
• Role-based access control and per-organization isolation.
• Multi-factor authentication for administrative access.

6. Your rights, and how to delete your data

Under the LFPDPPP you may request access, rectification, cancellation (deletion) or objection — the "ARCO" rights — at any time.

To request deletion of your data, email info@enginecortex.com with the subject line "Data Deletion Request" and include:

1. Your full name.
2. The email address or phone number associated with the data.
3. A clear description of what you want deleted.
4. A copy of a valid government-issued ID (to prevent deletion by impostors).

We respond within a maximum of 20 business days, as required by the LFPDPPP. Deletion covers every surface where the data lives, including conversations, CRM records, orders and appointments.

If you are an end customer who chatted with a business using Cortex, that business is the data controller — you may also contact them directly, and we will act on their instruction.

7. Retention

We retain account data for as long as the account is active. After cancellation, data is retained only for the period required by Mexican tax and commercial law, then deleted. Retention periods per data category are listed in the Spanish notice, section 8.

8. Regulator

If you believe your rights have been violated, you may file a complaint with Mexico's data protection authority, Secretaría Anticorrupción y Buen Gobierno (SABG). Details are in the Spanish notice, section 13.