Privacy policy

1. Controller and scope

Christoph Vogelsang · sole proprietor · P.O. Box 33, 3400 Klosterneuburg, Austria · VAT ID ATU66520099 · office@vogelsang.ai

This privacy policy applies to the website vogelsang.ai, including the Cortex product page, and to the Cortex web application at cortex.vogelsang.ai. Where processing differs between the website and the application, this is stated in the relevant section.

2. Hosting and server logs

This website is hosted by Vercel Inc., USA. Execution is configured for Frankfurt, Germany, although processing or access in the USA or other countries may still occur.

When the site is accessed, Vercel processes technically necessary connection data. The legal basis is our legitimate interest in secure and stable operation under Article 6(1)(f) GDPR.

• IP address
• time and requested address
• browser, operating system and device type
• status code and amount of data transferred
• referring page, if provided by the browser

3. Cookies and local storage

We do not use analytics, advertising or social-media cookies. There is no user tracking or behavioural advertising.

The language switch stores the selected language locally in the browser under the key vog-lang. It does not leave the browser. Temporary access protection may also use technically necessary credentials.

4. Contact forms and Cortex waitlist

vogelsang.ai and the Cortex page have forms that handle your data differently.

Contact forms and 'Request early access'. The contact form on the home page, the contact form on the Cortex page and 'Request early access' work the same way: we process your name, email address and message in order to answer your enquiry. Your message is sent as an email to contact@vogelsang.ai (for 'Request early access': cortex@vogelsang.ai) via our email service provider (see 'Recipients') and is not stored in a database; your address appears only in the reply-to field so that we can answer you. Where your enquiry concerns our services, the legal basis is taking steps prior to entering into a contract at your request under Article 6(1)(b) GDPR; otherwise it is our legitimate interest in answering your enquiry under Article 6(1)(f) GDPR. We keep the email for as long as needed to deal with it and delete it no later than twelve months after the correspondence has ended, unless a statutory retention obligation applies. We protect these forms against automated submissions in the same way as the waitlist (see 'Protection against automated signups').

Get notified at launch. Here we add you to a list. We store your email address, the time, and your consent. The legal basis is your consent under Article 6(1)(a) GDPR. After you submit, you receive a confirmation email; your entry only becomes active once you click the link in it. If you don't confirm within 48 hours, the link expires and the signup does not take effect. It is not a newsletter — we write to you once, when Cortex launches.

Unsubscribing. Every email contains an unsubscribe link. It works immediately and without giving a reason. You can withdraw your consent for the future at any time this way. When you unsubscribe, we delete your email address. What remains is only a record that and when you unsubscribed, together with the version of the consent text you were shown. That record is also deleted after three years.

Proof of your consent. We additionally store the version and a checksum of the consent text that was shown to you. This lets us later demonstrate what your consent related to. No further conclusions can be drawn from it.

Protection against automated signups. The form contains a field that is invisible to you and only automated programs fill in. We additionally limit the number of signups per sender. For this, your IP address is converted exclusively into a checksum that cannot be reversed; the address itself is not stored. The legal basis is our legitimate interest in abuse-free operation under Article 6(1)(f) GDPR. We do not use a CAPTCHA.

Recipients. The list is stored in a Supabase project in Ireland (eu-west-1); the contracting party and data importer is Supabase Pte. Ltd., Singapore. Emails are sent via Plus Five Five, Inc. (Resend), USA; processing is configured for Ireland. Our emails contain no tracking pixels and no rewritten click-links — we do not measure whether or when you open an email.

Retention period. Confirmed signups remain stored until you unsubscribe or the launch email has been sent. No later than 24 months after you sign up, we delete your entry in any case, even if the launch has not happened by then. Unconfirmed signups are deleted once their confirmation link has expired — that is the case after 48 hours have passed. Unsubscribe records are deleted after three years. The checksums from abuse protection are deleted after 25 hours. Cleanup runs automatically, hourly, directly in the database.

5. Cortex (product)

A separate privacy policy applies to the Cortex product — the Google user data per permission, the permissions deliberately not requested, Limited Use, AI processing, and the storage and deletion of Cortex data: vogelsang.ai/cortex/privacy.

6. Your rights

Subject to the GDPR, you have rights of access, rectification, erasure, restriction, portability and objection. You may withdraw consent for the future at any time. Contact office@vogelsang.ai.

7. Supervisory authority

You may lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

8. Protecting your data

When you connect Cortex to your Google account, we do not store the access credentials this requires in plain text. They are stored encrypted, using a method that also makes it possible to detect whether the stored data has been tampered with afterwards. The key required for this is kept separate from the database, in the service's runtime environment. Data is transmitted over encrypted connections throughout.

The content itself — stored emails, calendar copies, and the tasks and analyses derived from them — is transmitted over encrypted connections. Supabase, the database platform Cortex uses, encrypts the underlying storage at rest by default. Cortex does not additionally encrypt individual content fields: search, sorting and the AI-assisted analysis read exactly those fields.

Access through the application is tied to your own account. If you share a workspace with other members, they can see the processing state of individual conversations and which category they are assigned to; these features do not display the content of the emails. The operator has technical administrative access to the database. Human access to stored content only takes place where you have expressly consented in advance to access to specific data, where it is necessary for security purposes, or where a legal obligation requires it. Administrative work for operation and troubleshooting takes place without viewing content. For data from Google Workspace, the restrictions in the Cortex privacy policy apply in addition: vogelsang.ai/cortex/privacy.

9. Microsoft account data in Cortex

The information on connected Microsoft accounts is also part of the Cortex privacy policy: vogelsang.ai/cortex/privacy.