Privacy Policy
Effective 25 October 2026
This policy explains what personal data Cortex Lab AI collects through this website, through our SEO reporting tool and in the course of our consulting work, why we collect it, who else can see it, and what you can ask us to do about it.
1. Who we are
Cortex Lab AI (“we”, “us”) is an AI and workflow automation consultancy in Singapore. The company is CORTEX LAB AI PTE. LTD., UEN 202546841R, with its office at 3 Depot Close, #06-10, Singapore 109840.
We are the organisation responsible for the personal data described here, and we handle it under the Personal Data Protection Act 2012 of Singapore (the PDPA).
2. What we collect, and why
We collect only what a given interaction needs. You can read this website without giving us anything at all.
| What | When | Why we need it |
|---|---|---|
| Name, email address, time zone, and anything you write in the booking form | When you book a consultation | To hold the appointment, send the calendar invitation, and prepare for the call |
| Name, email address, company name, and the message you write | When you send the contact form, or email or call us directly | To reply to you |
| The details the registration form asks for, usually name, email address, phone number and company | When you register for one of our events | To run the event and send you its details |
| Pages you visit, how you reached the site, device and browser type, and approximate location | When you browse this site, through Google Analytics cookies | To see which pages help people and how many visits lead to a booked call. See section 4. |
| IP address, browser type, and page requested | Automatically, whenever a page or embedded resource loads | A technical by-product of serving the site; also used to keep it available and secure |
| Read-only access to your Google Search Console and Google Analytics data | When you connect your Google account to our SEO reporting tool | To prepare the search reports you engaged us for. See section 5. |
| Business information you share with us, which may include personal data about your staff or customers | During a paid engagement | To do the work you engaged us for. See section 7. |
We do not run advertising pixels, and we do not buy, sell, rent or trade personal data.
3. The basis on which we handle it
Under the PDPA we rely on your consent, given when you submit a form, register for an event, book a call or connect your Google account. Where you give us data for an obvious purpose, such as your email address so we can confirm your booking, we may also rely on deemed consent. We rely on the legitimate interests exception for keeping the site secure and available.
You can withdraw consent at any time under section 16 of the PDPA. See section 11 for how, and what happens when you do.
4. Cookies and analytics
This site uses Google Analytics to count visits and to record when someone presses a booking button or completes a booking. Google Analytics sets cookies in your browser so it can tell one visit from the next. We read its reports in aggregate and do not use them to identify individual visitors.
You can block or delete these cookies in your browser settings, or install Google's opt-out add-on from tools.google.com/dlpage/gaoptout. The site works the same without them.
5. Our SEO reporting tool and your Google data
We run an SEO reporting tool at seo.cortexlab-ai.tech for clients who engage us for search work. If you connect your Google account to it, Google asks you to allow read-only access to:
- Google Search Console: the searches your site appears for, its clicks, impressions and positions, and how Google indexes its pages.
- Google Analytics: visits, traffic sources, pages viewed and conversions for the properties you choose.
We use this data only to prepare your reports and the recommendations in them. The tool cannot change anything in your Google account. We do not use Google data for advertising, we do not sell it, and we do not use it to train AI models. Your access tokens are stored encrypted on our server in Singapore. When we use an AI assistant (Anthropic's Claude) to help draft a report, the relevant figures pass through it, and we keep the setting that lets Anthropic train on our conversations switched off.
Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
You can remove our access at any time at myaccount.google.com/permissions, and the tool stops reading your data. Ask us and we will also delete the stored tokens and the data the tool pulled.
6. Who else can see your data
We use a small number of service providers. They act on our instructions and are not permitted to use your data for their own purposes.
| Provider | What it handles | Where |
|---|---|---|
| Cal.com | Consultation bookings and calendar invitations | United States and European Union |
| Web3Forms | Delivering contact form submissions to our inbox | United States |
| Website analytics, event registrations (kept in Google Sheets), and the server that runs our SEO reporting tool (Google Cloud) | Singapore for the SEO tool's server; Google's global infrastructure for Analytics and Sheets | |
| Anthropic (Claude) | Helping us draft SEO reports from your Search Console and Analytics data | United States |
| Vercel | Hosting this website | Global content delivery network |
| Simple Icons | Tool logos shown on some pages; it receives your IP address as a consequence | Global content delivery network |
| Hostinger | Our email | Kuala Lumpur, Malaysia, and the European Union |
We will also disclose personal data where the law requires it, or where it is necessary to establish or defend a legal claim. If our business is ever sold or merged, personal data may transfer to the acquirer, and this policy will continue to apply until you are told otherwise.
7. Data belonging to our clients
When we build automations for a client, we necessarily see business data, and sometimes personal data about that client's staff or customers. In that situation the client is the organisation responsible for the data and we act as their data intermediary under the PDPA.
- We build inside systems the client already licenses wherever possible, so their data stays under agreements they already hold.
- We access only what the specific piece of work requires, and only for as long as it requires it.
- We do not use client data to train models, to build products, or as material for other clients.
- The engagement agreement, not this policy, governs what happens to that data. Where the two differ, the engagement agreement wins.
8. How long we keep it
We stop keeping personal data once the purpose it was collected for has ended and we have no legal reason to retain it.
| What | How long |
|---|---|
| Booking records for consultations that did not become engagements | 12 months from the appointment |
| Contact form enquiries that do not become engagements | 12 months from your last message |
| Event registrations | 12 months after the event |
| Google Analytics data | Up to 14 months, the longest period Google Analytics offers |
| Google access tokens and data pulled by the SEO reporting tool | Until you remove access or the engagement ends, then deleted within 30 days |
| Correspondence and records relating to a paid engagement | 5 years after the engagement ends, to meet accounting and limitation-period requirements |
| Server logs containing IP addresses | Up to 90 days |
9. Sending data outside Singapore
Much of what you submit through this site is processed outside Singapore. Cal.com, Web3Forms, Google Analytics and Anthropic process data mainly in the United States, and our email is hosted in Malaysia and the European Union. The SEO reporting tool's server is in Singapore. Where data leaves Singapore we take reasonable steps, as section 26 of the PDPA requires, to satisfy ourselves that the recipient protects it to a standard comparable to the PDPA, ordinarily through the contractual terms in our agreement with them.
10. How we protect it
This site and the SEO reporting tool are served over HTTPS, and the tool stores Google access tokens encrypted. Access to systems holding personal data is limited to the people who need it, and removed when they no longer do.
No system is perfectly secure, and we will not claim otherwise. If a data breach occurs that is likely to result in significant harm to you, or that affects 500 or more individuals, we will notify the Personal Data Protection Commission within three calendar days of assessing it as notifiable, and notify you as required under Part VIA of the PDPA.
11. Your rights
Under the PDPA you may ask us to do any of the following, and we will respond within 30 days or tell you when to expect an answer.
- Access: ask what personal data we hold about you and how it has been used or disclosed in the past year.
- Correction: ask us to correct anything inaccurate or incomplete.
- Withdraw consent: tell us to stop using your data for a stated purpose. We will act on it, and tell you plainly if it means we can no longer provide something.
- Deletion: ask us to erase data we no longer have a legal or business reason to keep.
Send any of these requests to the contact in section 14. We may need to verify your identity first. Access requests may attract a reasonable fee, and we will quote it before doing the work. If you are unsatisfied with how we have handled a request, you may refer the matter to the Personal Data Protection Commission at pdpc.gov.sg.
12. Marketing and the Do Not Call registry
We email you about the booking, event or enquiry you started. We do not add you to a mailing list unless you ask to join one, and any marketing email we send carries an unsubscribe link.
We check Singapore telephone numbers against the Do Not Call registry before sending marketing messages, unless you have given us clear and unambiguous consent in writing to contact you.
13. Children
This site sells business services and is not directed at children. We do not knowingly collect personal data from anyone under 13. If you believe a child has given us personal data, contact us and we will delete it.
14. Contact us
Our Data Protection Officer is the point of contact for anything in this policy, including access, correction and withdrawal requests, and complaints.
- Data Protection Officer: Darrel Liew
- Email: contact@cortexlab-ai.tech
- Telephone: +65 8991 1285
- Post: 3 Depot Close, #06-10, Singapore 109840
15. Changes to this policy
We update this policy when what we do changes. The effective date at the top always reflects the current version. Where a change materially affects how we use data you have already given us, we will tell you directly rather than rely on you noticing this page.