Privacy Policy – CtxCore

Version 2.1 · 2026-10-11

This policy applies to the customer account CtxCore Account (account.ctxcore.io), to the CtxCore products (currently CtxCore Brain, brain.ctxcore.io; section 4) and to support by email. The website ctxcore.io has its own privacy notice at https://ctxcore.io/privacy.

1. Who is responsible

CtxCore AB, company registration number 559560-5535, Gamla Sikforsvägen 10, 712 93 Hällefors, Sweden. I am Stefan Parge and I run the company on my own. Please send questions about data protection to privacy@ctxcore.io. I have not designated a data protection officer.

2. Two roles: controller or processor

• Customer account, billing, support: here I decide on the processing and I am the controller. This policy applies.
• Content in the products: what customers store in a product (for CtxCore Brain: Rules, documents, interviews, names of their employees) I process on behalf of the customer under the Data Processing Agreement. The company that uses a product is the controller. If you work for a customer, please contact your employer first with any questions. Section 4 still describes what CtxCore Brain processes technically.

3. CtxCore Account

Sign-up. Company name, country, organisation number or VAT ID, name and email address of the contact person, language, acceptance of the Terms of Service and the Data Processing Agreement with version and time, IP address and time of sign-up. Purpose: concluding the contract, checking that the customer is a business, preventing abuse (one trial per company, limits on attempts per IP address and email address). I check VAT IDs via VIES, the service of the European Commission. Legal basis: Art. 6(1)(b) and (f) GDPR.

Sign-in. You sign in with a link that I send to your email address; a session cookie keeps you signed in. This cookie is technically necessary and does not require consent.

Subscription and payment. Payment, subscription, invoices, taxes and the customer portal are handled by Stripe Payments Europe, Ltd. (Ireland). Stripe collects payment data directly; I do not see full card numbers. I store identifiers of the customer and the subscription, the plan, its status and the billing period. Legal basis: Art. 6(1)(b) and (c) GDPR. Stripe may also transfer data to the USA (EU-US Data Privacy Framework, Standard Contractual Clauses).

Emails. Confirmation, sign-in links, reminders before the end of the trial, before archiving and before deletion, notices when the trial or plan is paused, archived or deleted, and notices about used-up quotas. Sent via Amazon SES (Amazon Web Services EMEA SARL, region Stockholm, Sweden; section 6). Legal basis: Art. 6(1)(b) GDPR.

Technical logs. When you use CtxCore Account or Brain, the server processes your IP address, the time and the requested address in order to deliver the pages and to defend against attacks. I keep these logs only as long as needed for operation and security. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).

Retention periods.

• Account data: for as long as the customer relationship exists.
• Sign-ups that are not confirmed: deleted after 30 days.
• Accounts whose setup could not be completed and that never had a plan: deleted after 30 days, together with the payment card details stored at Stripe during sign-up.
• Logs of status changes (for example trial started, paused, archived): 12 months.
• Backups of the account data: 14 days, on the server at Hostinger and as a second copy in Amazon S3 in Frankfurt.
• Usage and cost figures: once the customer's data has been deleted, only in anonymised form without any reference to the customer.
• Invoices and accounting records: 7 years after the end of the calendar year in which the financial year ended (Swedish Bookkeeping Act, bokföringslagen).

The products and CtxCore Account only set technically necessary cookies (sign-in). There are no analytics or advertising trackers in the products or in CtxCore Account.

4. CtxCore Brain

For content in Brain, I am a processor (section 2). So that you know what happens:

• Account in Brain: name, email address, role in the Context, password as a hash, sessions, access for AI tools.
• Content: Rules, Topics, Skills, Proposals, Conflicts, Flags, including who proposed or approved what; uploaded documents; chat questions.
• Voice interviews: your voice goes live to Deepgram's speech recognition (EU endpoint) and is not used there to improve models. The interview assistant's answers are spoken by Amazon Polly (Frankfurt). The transcript is stored, not the recording. The voice connection is set up and relayed via CtxCore's own TURN server at Hostinger in Frankfurt. It processes your IP address and keeps it only in small, size-limited server logs that are continuously overwritten.
• AI processing: texts are processed via Amazon Bedrock in EU regions (Claude models by Anthropic, Amazon Titan for search, and Cohere Rerank 3.5 to sort search results, which runs in Frankfurt only). Customer data is not used for training.
• Action log: which action was taken when (type of action, time and IDs, no content), for troubleshooting; entries are deleted after 12 months, and the whole log is deleted together with the Context.
• Usage: For each Context I count chat questions, interview seconds and uploads as well as the costs of processing, in order to enforce quotas and to bill. These figures do not contain any content. Legal basis: Art. 6(1)(b) and (f) GDPR.
• Support access: I access the content of your Context for support only if your Context Lead approves this for a limited time; every such access is logged and visible to the Context Lead.
• Location: servers at Hostinger in Frankfurt, Germany. A second, encrypted copy of the backups is kept in Amazon S3 in Frankfurt. All sub-processors are listed on the list of sub-processors.
• Deletion: after the end of the contract, Brain is paused for 30 days and archived for 30 days, then deleted: the content, uploaded files, transcripts, the action log and the login accounts of persons who are not members of any other Context. What remains is a record of the deletion without any content, which is deleted after 12 months, and cost figures as anonymised monthly totals without any reference to the customer or to persons. Backups still contain the deleted data until they are overwritten, no later than 14 days after the deletion.

5. Support

If you write to me, I process your message in my mailbox at Google Workspace (Google Cloud EMEA Limited, Ireland) in order to reply. Legal basis: Art. 6(1)(b) or (f) GDPR. I delete support emails when they are no longer needed for the request or for the customer relationship, unless retention obligations apply.

6. Recipients and transfers to third countries

Recipients are the service providers named in sections 3 to 5 and on the list of sub-processors, including Amazon Web Services EMEA SARL (Amazon SES, region Stockholm, Sweden) for sending emails and Amazon S3 (Frankfurt, Germany) for backups. Transfers to the USA are based on the adequacy decision for the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the Standard Contractual Clauses of the European Commission. I do not sell data and do not pass it on for advertising.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15 to 21 GDPR). You can withdraw consent at any time. Write to privacy@ctxcore.io. If your request concerns content in a product, I forward it to the company that uses the product and support it.

You can lodge a complaint with a supervisory authority, in Sweden with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se), or with the authority at your place of residence or work.

8. Obligation to provide data

Without the details provided at sign-up, I cannot conclude a contract. I do not make automated decisions within the meaning of Art. 22 GDPR. The VAT ID check via VIES is a purely formal check.

9. Changes

If this policy changes materially, I change the version number and date at the top and inform customers by email.

Terms · Data Processing Agreement · Subprocessors