How your data is processed.
The data used to prepare your files, the technical processors, how long they are kept, and how you exercise your rights with Cortex.
1. Who to contact
Cortex-Compta is your contact for the service and for data requests. Contact: admin@cortex-compta.ch — Rue de la Filature 17, 1227 Carouge, Switzerland.
If you process your clients’ documents, you must have their authorisation and agree responsibilities with them. Ask for the contractual processing details before handing over data subject to special requirements.
2. Data concerned
The service uses account data, deposited documents and the information needed to prepare them. Extracted data can identify a person or a company: it is not automatically anonymous.
- Account: identity, email, settings and access rights.
- File: files, images, read text, suppliers, customers, amounts, dates, references and proposals.
- Use: treatments, consumption, exports and technical events needed to run the service.
- Relationship: support messages and subscription information.
3. Why this data is used
The data is used to provide document preparation, manage accounts and subscriptions, keep the service secure, fix incidents and answer requests.
Processing needed for the service sits in the contractual relationship. Other processing may follow a legal duty or, where required, your consent. Send only what the file needs.
4. Processors and places of processing
Cortex servers, files and database are hosted with Infomaniak, in Geneva (Switzerland). Document processing also uses Google Cloud Vision for OCR (Zurich access point), the DeepL API for translation (processed in Switzerland) and Microsoft Azure for the language model (Switzerland North region, Zurich), which handles about 15 % of the processing. Documents are processed in Switzerland by these four processors.
Payment, e-mail and error tracking go through other providers: Stripe for subscription payments, Brevo for transactional email, and Sentry for technical error tracking when that configuration is on. For these three providers, countries and contractual safeguards remain to be confirmed. Contact us before depositing data if location drives your decision.
Processors in the service are not a sharing for advertising. Data may also be disclosed where the law requires it.
5. Retention: several categories, several periods
Source PDFs and images of documents, and the export PDF ZIP, are deleted after 48 h. Journals, Excel files and extracted data remain downloadable. This period is Cortex’s choice, not a general GDPR duration.
Entries and extracted data are not deleted with the sources: they stay available to authorised users for as long as the account exists. Consultation and export of that data stay free after the subscription ends, while the account exists.
From the Settings page, you can delete your account at any time. Your data is then deleted immediately: you no longer have access to your exports. Download them first. Information needed for billing, security or legal duties may be kept separately. Contact us for the applicable periods.
Cortex does not replace your legal archiving. Keep the documents and exports you need under your duties.
6. Protective measures
Access to files rests on authentication, user rights and separated workspaces. Passwords are stored hashed. Site traffic uses HTTPS.
Protect your credentials, turn on the security options offered and review your team’s access. No measure can guarantee that an incident will never occur.
7. Cookies and audience measurement
The site and the app use mechanisms needed for the session, security and your preferences. Those mechanisms are not covered by the audience banner.
Google Analytics 4 loads only after an explicit accept. Until you decide, or if you refuse, the browser does not call googletagmanager.com and does not send a measurement event to our relay. You can accept, refuse, then change that choice from this page or the banner.
A language preference, the measurement choice or an attribution code may stay in the browser’s local storage. Technical error tracking (Sentry) depends on the service configuration and is not audience measurement. Contact us for durations not yet documented here.
8. Your rights and requests
Under applicable law, including the Swiss Data Protection Act and the GDPR where it applies, you may request access to your data, its rectification, its deletion or, in the cases provided, its handover or transfer.
You may also object or withdraw consent where those rights apply. Some data may have to be kept because of legal duties.
Write to admin@cortex-compta.ch and state your request. Information to verify your identity may be needed. You may also contact the competent data-protection authority.
9. Changes to this policy
This policy is updated when the service or its processing conditions change. Changes that affect the contractual relationship are communicated as appropriate. Version of 30 October 2026.