Last updated: June 23, 2026
This policy describes how CRTX handles your personal data when you use our document intelligence platform. We've written it to be readable — not just legally complete.
CRTX (“we,” “us,” or “our”) operates the document intelligence platform available at crtx.chat(the “Service”). This Privacy Policy explains what information we collect, how we use it, with whom we share it, and the choices you have.
By creating an account or using the Service, you agree to the practices described here. If you do not agree, do not use the Service.
When you register, we collect your email address and any profile details you provide. Authentication is handled through Supabase Auth, which may record your IP address and browser metadata at sign-in.
The Service allows you to upload PDF documents and submit URLs for ingestion. We store the original files and the text, tables, and images extracted from them. We also generate and store vector embeddings of your content to power semantic search.
We store the natural-language questions you submit, the answers returned by the AI, and citation metadata (which document chunks were retrieved). This data is used to provide the Service and to improve response quality.
We automatically collect log data including your IP address, browser type and version, operating system, referring URLs, pages visited within the Service, timestamps, and error reports. We use this data for security monitoring, debugging, and aggregate analytics.
We use strictly necessary session cookies to keep you logged in. We do not currently use advertising or third-party tracking cookies. If this changes, we will update this policy and, where required, obtain your consent.
We use your information to:
We do not use your uploaded documents or query history to train or fine-tune AI models without your explicit opt-in consent.
If you are located in the European Economic Area or the United Kingdom, we process your personal data under the following legal bases:
We retain your account data and uploaded content for as long as your account is active. If you delete a document or collection, it is removed from our primary database within 30 days; vector embeddings are removed from Pinecone within the same period.
If you delete your account, we delete or anonymize all personal data within 90 days, except where we are required to retain it by law (e.g., tax or fraud-prevention records) or where data is held in encrypted backups that are purged on a rolling cycle.
Aggregate, anonymized analytics data that cannot be linked back to you may be retained indefinitely.
We implement technical and organizational measures designed to protect your data against unauthorized access, disclosure, alteration, or destruction. These include:
No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. If you become aware of a security vulnerability, please contact us immediately at onboarding@vesselapplications.com.
Depending on your location, you may have the following rights regarding your personal data:
In addition to the rights above, you may object to processing based on legitimate interests, request restriction of processing, and withdraw consent where processing is consent-based. You also have the right to lodge a complaint with your local supervisory authority.
California residents have the right to know what personal information we collect and how it is used and shared, to delete personal information, to correct inaccurate personal information, to opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioral advertising), and to non-discrimination for exercising these rights.
To exercise any of these rights, email us at onboarding@vesselapplications.com. We will respond within the timeframe required by applicable law (typically 30 days). We may need to verify your identity before fulfilling a request.
Our infrastructure is primarily hosted in the United States. If you are located outside the United States, your data is transferred to and processed in the US. We rely on Standard Contractual Clauses approved by the European Commission, or other lawful transfer mechanisms, when transferring personal data from the EEA, UK, or Switzerland to the US.
The Service is not directed to children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, contact us at onboarding@vesselapplications.com and we will delete it promptly.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (at the address associated with your account) or by displaying a prominent notice in the Service at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.
The “Last Updated” date at the top of this page reflects when the most recent changes were made.
If you have questions or concerns about this Privacy Policy or our data practices, please contact us:
For formal data protection requests under GDPR or CCPA, please include “Data Subject Request” in your subject line.
© 2026 CRTX. All rights reserved.