Privacy Policy

1Who We Are

Cognethics LLC ("Cognethics," "we," "us," or "our") is an enterprise software company headquartered in Atlanta, GA. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at cognethics.com and use our platform services.

2Information We Collect

Information You Provide

• Contact form submissions: name, work email address, company name, area of interest, and any message you provide when booking a demo or contacting us.
• Account information: when you create a platform account, we collect your name, email, organization details, and role.
• Communications: records of correspondence when you contact us for support or other inquiries.

Information Collected Automatically

• Request data: like any website, the network that delivers these pages (Cloudflare) receives your IP address, browser type, the page requested, the referring URL, and a timestamp.
• Fonts: page fonts are served by Google Fonts, so your browser’s request for them reaches Google with your IP address.
• Analytics, only if you accept: see “Cookies, Storage, and Analytics” below.

Cookies, Storage, and Analytics

This website does not set advertising cookies. On your first visit, a banner asks whether you allow analytics. Until you choose Accept, no analytics script is loaded.

If you accept, two analytics tools load. Neither sets a cookie:

• Cloudflare Web Analytics reports page views and page-load performance (page address, referrer, browser, and timing) to Cloudflare. It does not use cookies or local storage.
• Our first-party analytics sends page views, the referring page, campaign tags in the link you followed, and your screen size, language, time zone, and browser to our own platform. It keeps a visit ID in your browser tab’s session storage, which is cleared when you close the tab, and stores no persistent identifier on your device. If your browser sends a Do Not Track signal, it collects nothing.

The site also keeps two preferences in your browser’s local storage so it works as you left it: your light or dark theme, and your analytics choice. Neither is used to track you.

You can change your choice at any time: open cookie settings.

Information We Do Not Collect

• We do not sell, rent, or trade your personal information to third parties.
• We do not use your data to train AI models.

3How We Use Your Information

• To respond to your demo requests and inquiries.
• To provide, maintain, and improve our platform services.
• To send you relevant updates about your account or our services (you can opt out at any time).
• To detect, prevent, and address security issues and abuse.
• To comply with legal obligations.

4Legal Basis for Processing (GDPR)

Cognethics processes customer data in AWS regions in the United States: us-east-1 (N. Virginia) is the primary region, continuously replicated to a hot standby in us-east-2 (Ohio). For customers with EEA, UK, or Swiss personal data, our standard Data Processing Addendum (DPA) provides Standard Contractual Clauses (Module 2 — controller-to-processor, EU 2021/914) and addresses cross-border transfer safeguards. To execute the DPA, use the request form below and select the legal / DPA request type.

For personal data we process directly (for example, when you submit our contact form), we rely on the following legal bases:

• Consent: when you submit the contact form, you consent to us processing your data for the stated purpose.
• Legitimate interest: to operate and improve our services, provided this does not override your rights.
• Legal obligation: to comply with applicable laws and regulations.

5Data Storage and Security

• Your data is stored on AWS infrastructure in the United States: primary in us-east-1 (N. Virginia), replicated to a hot standby in us-east-2 (Ohio).
• All data is encrypted in transit (TLS 1.2+) and at rest.
• Access to personal data is restricted to authorized personnel on a need-to-know basis.
• We maintain complete audit trails of all data access.
• Our platform architecture is designed for multi-tenant data isolation — your data is never accessible to other customers.

6Data Retention

We retain your personal information only as long as necessary to fulfill the purposes outlined in this policy. Contact form submissions are retained for the duration of our business relationship. You may request deletion of your data at any time (see Section 8).

7Sub-processors

We use a limited number of sub-processors to operate the Services:

• Amazon Web Services (AWS): infrastructure hosting in the United States (us-east-1 primary, us-east-2 standby). Compute, storage, database, networking, and managed security. Covered by DPA + BAA.
• Anthropic: large language model inference for AI features. Accessed via the Anthropic API and via AWS Bedrock (US regions). Covered by DPA.
• Cloudflare: CDN, DDoS protection, and Cloudflare Tunnel routing. Processes request metadata only (IP, timestamp, User-Agent, referrer); no document content traverses Cloudflare in plaintext. Covered by DPA.
• Google (Gemini API): large language model inference for specific extraction workflows (e.g., healthcare EOB extraction, technical specification extraction, invoice parsing). US regions. Covered by DPA.

We do not share your personal data with advertising networks or data brokers. Website analytics run only with your consent, as described in Section 2.

8Your Rights

Depending on your location, you may have the following rights:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate data.
• Deletion: request deletion of your personal data.
• Portability: request your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdraw consent: withdraw consent at any time where processing is based on consent.

To exercise any of these rights, use the request form below. We will respond within 30 days.

9Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

10Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised "Last updated" date.

11Contact Us

For questions about this Privacy Policy, or to exercise any of the rights listed in Section 8, use the form below. We respond within 30 days.