Privacy Policy

This Policy applies to personal information processed in connection with:

• COS (CEO Operating System) for leadership — company pulse, executive desk, workforce views, connectors, and approve-before-send workflows;
• HRMS for people operations — employee roster, leave and approvals, payroll and payslip views, calendar, analytics, and related people-ops settings;
• ERMS for employees — clock in/out (including geofence or WFH modes where enabled), leave, payslips, home and tasks, expenses, and notices on web and mobile;
• Ask with sources — questions and answers grounded in connected workplace data (for example email, chat, code, and docs) with citations;
• Approvals — human-gated queues for leave, travel, WFH, outbound drafts, and similar commits before they leave the system;
• Connectors and integrations — including Google Workspace, Gmail, Calendar, Drive, Slack, GitHub, Notion, Jira, Confluence, Zoom, Microsoft Teams, Outlook, identity providers (such as Okta or Entra ID), and other connectors your organization enables;
• Platform surfaces described as Seed to Scale — ingestion, desk, approvals, and role-right views across the company graph;
• Security and access features such as SSO, permissions, private networking options, and compliance-related controls where offered;
• Our marketing website, waitlist, and demo booking flows.

Depending on how you use Cortex, we may collect information including:

• Account information such as your name, email address, mobile number, organization, job role, account identifiers, and authentication information.
• Organization and workspace information that you or your organization provide while configuring or using Cortex, including role seats (COS, HRMS, ERMS), policies, and settings.
• People and workforce information your organization chooses to store in Cortex, such as employee profiles, org structure, attendance, leave balances and requests, WFH or travel requests, payroll and payslip views, expenses, notices, tasks, and related operational records.
• Leadership and operations signals surfaced in COS, such as headcount, attendance summaries, risk or coverage indicators, approval queues, and similar metrics derived from workspace data.
• Ask-with-sources content — prompts, answers, citations, and linked source references from connected tools.
• Approval and outbound content — drafts, leave or policy requests, coverage notes, and human release decisions (approve, reject, or request change).
• Mobile and web runtime data for ERMS — clock events, location or geofence-related signals where your organization enables them, device session information needed to operate the app, and push or in-app notices.
• Usage information such as features accessed, desk and approval activity, timestamps, application activity, and related service usage.
• Device and technical information such as IP address, browser information, device information, operating system, diagnostic information, and security logs.
• Communications and support information that you provide when contacting our support team, booking a demo, or joining a waitlist (including name, email, and how you found us).
• Billing and transaction information necessary to manage subscriptions, invoices, payments, and account balances. Payment information may be processed by third-party payment service providers.
• Information from third-party services that you or your organization choose to connect, including Google account and Google Workspace data as described below, and other connectors listed in this Policy.

If you or your organization connect a Google account to Cortex, we access Google user data only after you authorize the connection through Google’s OAuth consent screen and only for the features you enable.

Depending on the integration and permissions you approve, we may access categories of Google data such as:

• basic profile information (name, email address, and Google account identifier via openid, email, and profile scopes);
• Gmail message metadata and content (via Gmail scopes) to ground answers with sources, sync mail for workplace context, and support approve-before-send workflows when you configure those features;
• Google Drive, Docs, Calendar, Contacts, and Tasks data (via the corresponding Google scopes) to list, read, and sync content you select for knowledge, automations, scheduling, and related product features;
• Google Calendar and Google Sheets data where you connect those features for scheduling, reporting, or integrations you configure;
• Google Workspace directory signals (users, groups, and related ACL context) where SSO or identity sync is enabled.

We store OAuth tokens securely to maintain your connection, along with synced or cached copies of Google data needed to provide the features you use (for example, indexed knowledge-base content, message headers, or calendar event details). We do not use Google user data to build advertising profiles or to sell personal information.

You can disconnect a Google integration from Cortex at any time through your workspace or integration settings. You can also revoke Cortex’s access from your Google Account at myaccount.google.com/permissions. After disconnection or revocation, we stop collecting new Google user data and delete or disable stored OAuth tokens according to our retention practices. Previously synced content may remain until you delete it in Cortex or request deletion as described under “Your Choices and Rights”.

For questions about Google data handled by Cortex, contact support@zeto.studio.

Cortex’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In summary, we use Google user data only to provide and improve user-facing features of Cortex that you or your organization enable; to maintain security, prevent abuse, and troubleshoot the service; and to comply with applicable law. We do not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising. We do not sell Google user data. We do not transfer Google user data to third parties except to service providers that process data on our behalf to operate Cortex (subject to confidentiality and use restrictions), when required for security or legal compliance, or in connection with a merger or acquisition subject to applicable law.

Human access to Google user data is limited to what is necessary to operate and support the service, to investigate security or abuse issues, to comply with law, or with your explicit permission.

Use of Cortex is also subject to our Terms of Service.

When your organization connects non-Google tools to Cortex, we may process data from those services only as needed for the features you enable. Examples include:

• Collaboration — Slack, Microsoft Teams, Zoom, Discord, and similar tools (messages, channels, meeting metadata, or files you authorize);
• Engineering — GitHub, Jira, Confluence, and similar tools (repositories, issues, pages, or activity you authorize);
• Productivity — Notion, calendar, and document systems (pages, databases, or events you authorize);
• Identity and SSO — Okta, Entra ID, OneLogin, JumpCloud, and similar providers (directory and access attributes needed for sign-in and roles);
• People and HR systems — BambooHR, Workday, HiBob, Greenhouse, and similar systems where connected (roster, leave, or hiring signals you authorize);
• Finance or customer systems your organization chooses to connect for operational context.

Each connector is governed by that provider’s terms and privacy policy, and by the permissions your organization grants. You can disconnect connectors in Cortex settings subject to your organization’s admin controls.

Cortex presents role-right views of shared company data. Administrators control which users can access COS, HRMS, or ERMS seats and what they can see or change.

Approvals and approve-before-send features may store draft content, requester and approver identities, decision history, and related comments until released, rejected, or deleted according to your organization’s configuration and our retention practices.

Automation may prepare drafts or recommendations; humans remain responsible for releasing outbound actions where your organization enables human gates.

We may use information to:

• provide, operate, maintain, and improve Cortex across COS, HRMS, ERMS, ask, approvals, connectors, and platform features;
• create and manage user accounts and organizations;
• authenticate users (including SSO) and protect accounts;
• provide 2FA, OTP, login alerts, security notifications, account notifications, billing alerts, usage alerts, service notifications, and customer support;
• process payments and maintain billing records;
• provide customer support and respond to demo or waitlist requests;
• monitor system availability, security, fraud, abuse, and unauthorized activity;
• analyze product performance and improve the services;
• maintain records necessary for security, compliance, dispute resolution, and legal obligations;
• communicate with users concerning their accounts or the services they use;
• operate integrations you connect;
• power ask-with-sources, approvals, people ops, employee runtime, and leadership views you enable; and
• comply with applicable laws and lawful requests.

If you voluntarily opt in to receive SMS messages from Cortex, we may use your mobile number to send messages relating to your Cortex account and services.

Messages may include 2FA and OTP codes, login and security alerts, account notifications, billing and payment alerts, usage alerts, service updates, and support notifications.

Message frequency varies depending on your activity and use of Cortex.

Message and data rates may apply.

You may reply STOP to opt out of SMS messages.

You may reply HELP for assistance or contact support@zeto.studio.

SMS consent is optional and is not a condition of purchasing or creating a Cortex account.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Mobile information and SMS consent information will not be shared with third parties or affiliates for their marketing or promotional purposes.

We may provide information to communications infrastructure providers and other service providers only where necessary to operate and deliver the messaging service on our behalf. Such service providers are not authorized by us to use SMS opt-in information for their own marketing purposes.

We may disclose personal information to service providers that help us provide services such as hosting, infrastructure, authentication, communications, analytics, customer support, security, billing, and payment processing.

These service providers may process information only for the purposes for which we engage them and subject to applicable contractual and legal requirements.

Where you use Cortex through an organization, certain information may be accessible to authorized administrators and other users according to the permissions and roles configured by the organization (including leadership, people ops, and employee seats).

We may disclose information where required by law, legal process, court order, regulatory request, or where reasonably necessary to protect Cortex, our customers, users, or others.

Information may also be transferred as part of a merger, acquisition, restructuring, financing, or sale of all or part of our business, subject to applicable law.

Regardless of the above, SMS opt-in information and consent are not sold or shared with third parties or affiliates for marketing or promotional purposes.

We do not sell Google user data obtained through Google APIs.

Cortex may use infrastructure and service providers located in multiple countries.

As a result, personal information may be processed in countries other than the country in which you are located.

Where required, we take reasonable measures to protect information transferred internationally in accordance with applicable law.

We retain personal information for as long as reasonably necessary to provide Cortex, maintain security, meet contractual obligations, resolve disputes, enforce agreements, and comply with legal and regulatory obligations.

SMS consent and opt-out records may be retained for compliance and audit purposes even after a user has opted out.

Google OAuth tokens and synced Google data are retained while an integration remains connected and as needed thereafter for backup, security, and legal compliance, unless you disconnect the integration or request deletion where applicable law provides a right to erasure.

When information is no longer reasonably required, we may delete, anonymize, or otherwise securely dispose of it subject to applicable legal requirements.

We use reasonable administrative, organizational, and technical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, loss, or misuse. Depending on your plan and configuration, Cortex may also support controls such as SSO, role-based permissions, and private networking options.

No system can guarantee absolute security, and users are responsible for maintaining the confidentiality of their account credentials.

Depending on applicable law, you may have rights relating to your personal information, including requesting access, correction, deletion, or withdrawal of consent.

You may update certain account information directly through Cortex.

For privacy-related requests, including requests to delete personal information or Google user data processed by Cortex, contact: support@zeto.studio

You can withdraw SMS consent at any time by replying STOP to a Cortex SMS.

You can revoke Google access at myaccount.google.com/permissions and disconnect Google integrations in Cortex settings.

Cortex may use cookies, local storage, and similar technologies for authentication, security, preferences, analytics, performance, and functionality.

Where required by applicable law, we will request appropriate consent for non-essential technologies.

Cortex is not intended to be used directly by children under the age of 18 unless such use is specifically provided through an authorized organization and supported by appropriate legal permissions.

If we become aware that personal information has been collected contrary to applicable legal requirements, we may take appropriate steps to delete or restrict that information.

Cortex may integrate with third-party services selected by users or organizations, including Google services and other workplace connectors when you choose to connect them.

Those services may process information according to their own terms and privacy policies.

We encourage users and organizations to review the privacy practices of third-party services before enabling integrations.

We may update this Privacy Policy from time to time.

When material changes are made, we may provide notice through the Cortex application, website, email, or another appropriate channel.

The Effective Date at the top of this page indicates when this Privacy Policy was last updated.

For questions regarding this Privacy Policy or privacy practices, contact:

Zeto Tech Labs Private Limited
Cortex
Email: support@zeto.studio
Website: https://zeto.studio/

Road No 36, Madhapur, Jubilee Hills, Hyderabad, Telangana, India - 500033
Phone: +91 70321 22041