Privacy Policy

Last updated: 19 August 2026

1. Who processes the data

Z·Cortex Agents (agents.zcortex.ai) lets website owners build an AI consultant and place it on their own site. We process data about two groups: our customers (the website owners) and the visitors to their sites who talk to the consultant.

For visitors’ data we act as a processor on behalf of the customer who owns the website: they decide why contacts are collected, we only process them technically for them. For the customers’ own data (account, payments) we act as the controller.

2. What data we collect

• Customers of the service: e-mail, an encrypted password, business name, the knowledge base you uploaded, and payment history.
• Visitors to customers’ sites: we pass the text of a question to the model to get an answer, but we do not store the conversation on our servers — the history lives only in the browser tab and disappears with it. Voice audio is processed by ElevenLabs. Contacts a visitor leaves voluntarily (name, phone, e-mail, Telegram) are stored as a lead.
• Technical data: IP address (to guard against abuse and to count conversations) and a session cookie used only to sign in to the dashboard. We set no advertising or tracking cookies.

3. Why

So the consultant answers about your actual business, so you see leads in your dashboard, so we can count plan limits and protect the service from abuse. We do not sell data and do not pass it to third parties for advertising.

4. Who receives the data (processors)

• Anthropic PBC (USA) — processing the text of questions to produce the consultant’s answer. Anthropic does not use this data to train its models.
• ElevenLabs Inc. (USA) — speech synthesis and recognition during a voice conversation.
• jsDelivr (CDN) — serves the voice library on your website’s page; it receives the visitor’s IP address.
• Forward Email — delivery of our e-mails (leads, password recovery).
• Monobank (Ukraine), Plisio — taking payment under the contract with the Ukrainian sole trader. We never see or store your card details.
• Stripe Payments Europe / Stripe Inc. — taking international card payments under the contract with Z Cortex AI FZE LLC. Stripe handles the card number; we never see or store it.

4.1. Transfers outside Ukraine and the EEA

Anthropic and ElevenLabs are based in the USA, so part of the processing happens there. The legal grounds for that transfer are:

• the European Commission’s Standard Contractual Clauses (SCC, Decision 2021/914), agreed with each of these processors as part of their data processing agreements;
• the unambiguous consent of the data subject (Article 29(4)(1) of the Ukrainian Personal Data Protection Act), given by the visitor when they start a conversation after the widget has told them they are talking to an artificial intelligence.

ElevenLabs is additionally certified under the EU-US Data Privacy Framework.

5. How long we keep it

• Leads with visitors’ contacts — 12 months from arrival, then deleted automatically. A customer can delete any lead earlier or export them as a table.
• Text conversations with the consultant — not stored at all.
• Voice conversation recordings — on the ElevenLabs side, under their policy.
• Account and knowledge base — for as long as the account exists; erased within 30 days of deletion.
• Payment records — 3 years (accounting requirements).

6. Your rights

You can get a copy of your data, correct it, restrict processing, object to it, withdraw consent, or delete your account. Some of this you do yourself and immediately: exporting leads as a table, deleting a consultant and deleting your account — buttons in the dashboard. For anything else, write to info@zcortex.ai: we answer within one business day, and the deadline for a written request is 30 calendar days. If you believe we have infringed your rights, you may complain to the supervisory authority where you live.

7. The site owner’s responsibility

If you place the consultant on your website, you are the controller of your visitors’ data. We act as a processor on your instructions and process that data only to run your consultant. The widget itself tells the visitor they are talking to an artificial intelligence — our engine places that line and switching it off is prohibited.

If you need a separate written data processing agreement (DPA), write to info@zcortex.ai, and we will send one for signature.

8. Language of this document

The original is written in Ukrainian. The Russian (/ru/privacy) and English (/en/privacy) versions are provided for convenience; if they differ, the Ukrainian text prevails.