This Cortex privacy policy covers cortex.red8.io — the Cortex product site, its waitlist, and the contact forms served from it. The hosted Cortex service itself — your account, your organisation’s tenant and the accounts you connect to it — has its own privacy policy and Data Processing Agreement. If Cortex runs on your own infrastructure, see Self-hosted instances at the bottom: red8.io is not the controller of your data, you are.
Who is responsible
red8.io, a sole trader based in Bangkok, Thailand, is the data controller for everything described here. For any privacy question, or to exercise any of the rights below, write to privacy@red8.io.
The waitlist
If you join the Cortex waitlist we store your email address, the time you submitted it, and the fact that you consented.
- Why: to send you one email when it opens, and to answer you if you write back. Nothing else.
- Lawful basis: your consent. We use double opt-in — your address is only recorded as consenting once you click the link in the confirmation email. If you never click it, the entry stays unconfirmed and is never mailed again.
- Where it goes: into the Cortex instance red8.io runs on its own server. It is not sold, rented, shared or passed to any advertising network.
- Referral links: if you share your referral link, the code identifies you as the referrer. It never contains anyone else’s address — the person joining types their own.
Contact and enquiry forms
A contact form on this site may ask for your name, email address, company, phone number and a message. Only the email address is required. We use what you send to reply to you and, if it becomes a business conversation, to keep a record of it. Same basis, same rights, same address to write to.
How long we keep it
Until you ask us to erase it. We would rather say that plainly than quote a retention period we do not currently enforce automatically. Ask at privacy@red8.io and your record is deleted — not flagged, not hidden, deleted.
Analytics
cortex.red8.io counts visits with Google Analytics, loaded at Cloudflare’s edge. It is off until you accept it — the analytics option is switched off by default in the consent banner, and nothing loads if you decline or ignore it.
When you join the waitlist a conversion event is recorded, carrying only which product and which page. Your email address is never sent to Google, and no advertising or cross-site profile is built. See the red8.io website privacy policy for the same arrangement across the rest of the site.
Your rights
You can ask us to show you what we hold, correct it, delete it, restrict what we do with it, or hand it over in a portable form. You can withdraw consent at any time — that stops future email and does not affect anything done before you withdrew. Write to privacy@red8.io; we will answer within 30 days.
If you are in the EU or the UK and think we have handled your data badly, you may complain to your national data protection authority. We would rather you told us first, but it is your right either way.
Self-hosted instances
Cortex can also run on your own infrastructure, set up with us on request. If it does, you are the data controller for everything inside that instance — your contacts, your mail, your team’s hours. red8.io operates no server that receives, stores or processes any of it, and by default a self-hosted instance never contacts us at all.
That also means the waitlist and contact forms described above belong to this deployment. Your own instance’s forms are yours, and the privacy policy they link to is one you configure.
Cortex / Hosted service privacy policy / Website privacy policy / Terms of Service