Privacy Policy

1. Who we are

Kordox ("Kordox", "we", "us") is a work-and-money operations platform operated by Braineetech. This Privacy Policy explains what data we collect, how we use it, and the choices you have. It applies to kordox.com, the Kordox web app, and related services (the "Service").

2. Data we collect

You give us

• Account data — your name, email address, and authentication details (we use passwordless magic links and optional Google/Microsoft sign-in; we do not store passwords).
• Organization & workspace data — organizations, projects/ventures, and the records you create (leads, customers, deals, tasks, notes, files, custom objects).
• Billing data — handled by our payment processor (Stripe); we store plan and subscription metadata, not full card numbers.

From connected services (only if you connect them)

• Financial connectors (e.g. Stripe, Shopify, ad platforms, bank feeds) — revenue, cost, payout, and transaction data used to compute per-venture profit & loss.
• Email connectors (Gmail / Microsoft 365) — message metadata and content needed to triage your inbox, draft replies, and link messages to records. See Section 8.

Automatically

• Usage & device data — log data, IP address, browser type, and actions taken, for security, debugging, and product analytics (we use privacy-friendly, cookieless analytics).

3. How we use data

• To provide and operate the Service (the daily cockpit, CRM, per-venture P&L).
• To power AI features — anomaly/spend-spike detection, digests, and email triage/drafting.
• To secure the Service (authentication, MFA, fraud/abuse prevention, audit logging).
• To communicate with you about the Service (transactional email via our provider).
• To improve the Service via aggregated, de-identified usage analysis.

We do not sell your personal data, and we do not use your connected email or financial content for advertising.

4. AI processing

Some features use AI models (e.g. Cloudflare Workers AI) to analyze your data and generate outputs such as anomaly alerts and draft email replies. Your content is processed only to provide these features to you. We do not use your content, or data from Google/Microsoft APIs, to train generalized or foundation AI models.

5. How we share data

We share data only with service providers ("sub-processors") that help us run the Service, under contracts that limit their use of the data:

• Cloudflare — application hosting, edge, storage, and AI.
• Google Cloud — managed PostgreSQL database hosting.
• Stripe — payment processing and, if connected, revenue data.
• Resend — transactional email delivery.
• Google / Microsoft — sign-in and, if connected, email access.

We may also disclose data to comply with law, enforce our terms, or protect rights and safety, and we may transfer data as part of a merger or acquisition (you will be notified).

6. Security

We protect data with encryption in transit, multi-tenant isolation, role-based access control (RBAC), optional multi-factor authentication, encrypted storage of connector credentials, and audit logging. No method is perfectly secure, but we work to protect your data and to notify you of incidents as required by law.

7. Data retention & your rights

We keep your data while your account is active and as needed to provide the Service or meet legal obligations. You can access, correct, export, or delete your data — contact us or use in-app controls. Disconnecting a connector stops further data collection from it; you may request deletion of previously synced data. Depending on your location, you may have rights under the GDPR, UK GDPR, or CCPA/CPRA.

8. Google & Microsoft user data (email connectors)

If you connect Gmail or Microsoft 365, we request only the scopes needed to provide email features (read, send, and modify messages, plus your email address). Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google/Microsoft data only to provide and improve user-facing features you have enabled (inbox triage, drafting, and linking messages to records).
• We do not transfer or sell this data for advertising, and do not use it to train generalized AI models.
• Humans do not read your messages except with your explicit consent, for security/abuse investigations, to comply with law, or where data is aggregated and anonymized.
• You can disconnect at any time, which revokes our access going forward.

9. International transfers

We may process data in countries other than yours (including the United States). Where required, we use appropriate safeguards for such transfers.

10. Children

The Service is for business use and is not directed to children under 16, and we do not knowingly collect their data.

11. Changes

We may update this policy; we will post the new version here and update the "Last updated" date, and notify you of material changes.

12. Contact

Questions or requests: privacy@kordox.com.