Privacy Policy

Cortex Layer ("we", "us") is operated by Miguel Cota. This policy covers the Cortex Layer website, dashboard, and MCP memory server (together, the "Service"). It describes what personal data we collect, how we use it, who we share it with, how long we keep it, and the controls available to you.

1. What we collect

• Account data. Your email address, collected when you sign in. We use Firebase Authentication to verify sign-ins; we don't handle or store passwords ourselves.
• Memory content. The text your AI agent stores or retrieves through the MCP server (e.g. via memory_add, memory_update). This is whatever your agent sends — see "Data minimization" below for what we ask you not to store there.
• API keys. We store only a one-way hash of each key. The plaintext key is shown once at creation and never stored or logged.
• Billing data. Your Stripe customer ID and subscription tier/status. We never see or store your card number or other payment details — those go directly to Stripe.
• Usage counters. How many reads/writes you've made against your plan's monthly cap. This is a count, not the content of what you read or wrote.

We don't use third-party analytics, advertising trackers, or tracking cookies on the Service.

2. How we use it

• To operate the Service: authenticate requests, enforce plan limits, and serve the dashboard and MCP endpoints.
• To process payments and manage subscriptions through Stripe.
• To respond to support requests you send us.
• To extract and retrieve facts from your memory content, so your agent can read back what it previously stored.

That extraction/retrieval work currently runs entirely on language models we host ourselves — no memory content is sent to a third-party AI provider by default. If that ever changes, we'll update this policy first and disclose which provider is involved.

3. Who we share it with

We don't sell personal data. We share limited data with the following providers, only as needed to run the Service:

• Stripe — payment processing and subscription management.
• Firebase (Google) — sign-in/authentication.
• Cloudflare — hosting, content delivery, and email routing for this domain.

We may also disclose data if required by law, or to protect the security or rights of the Service and its users.

4. Data retention

• Account data and memory content are kept for as long as your account is active.
• Individual memories can be deleted at any time — your agent can delete them directly through the MCP server, and the dashboard is read-only by design (it reflects what your agent has stored).
• API keys can be revoked at any time from the dashboard.
• To delete your account and all associated data, email support@cortexlayer.net. We'll confirm and complete the deletion within 30 days.

5. Your controls

• Delete or update individual memories any time, through your agent.
• Revoke API keys any time, from the dashboard.
• Manage or cancel your subscription any time, from the Stripe billing portal.
• Request a copy or deletion of your data, or ask us any question about this policy, by emailing support@cortexlayer.net.

6. Data minimization

Memory content is only as safe as what gets stored in it. Please don't have your agent store payment card numbers, health records, government ID numbers, passwords, or other credentials as memory content. We treat memory content as data, not as a vault for secrets.

7. Children

The Service is not directed to children under 13, and we don't knowingly collect data from them.

8. Changes to this policy

If we make material changes, we'll update the effective date above and, where appropriate, let you know directly.

9. Contact

Questions about this policy or your data: support@cortexlayer.net, or see our support page.