Privacy Policy

Who We Are

Hicortex is provided by Aironic Ventures Ltd. (Business ID: 3527806-1), a Finnish company ("we", "us"). For Hicortex Cloud, we act as the data controller for the personal data described below. Contact: support@gamaze.com.

This policy covers two offerings. Where you use only the self-hosted software, the Cloud-specific sections do not apply to you.

1. Self-Hosted Software (no Cloud account)

If you run Hicortex on your own hardware and have not created a Hicortex Cloud account: your data stays entirely on your machine. Your memories, identity files, and configuration never leave your infrastructure unless you configure a third-party language-model endpoint yourself, in which case that provider's terms apply. The software sends no data to us. It may send optional, anonymous usage telemetry (install identifier, version, mode, memory counts) unless you disable it in the configuration; this contains no conversation content and no personal identifiers beyond a random ID.

2. What Hicortex Cloud Collects

• Account data — your email address, name, and Google account identifier, obtained via Google Sign-In when you register or sign in.
• Memory content — to provide the Service, the sessions your agents capture are processed server-side in the EU: an automated, deterministic denoising step runs on your device, and the denoised text is sent to our servers, where it is distilled by a language model into stored memories. The raw session log is never persisted by us — only the distilled memories and their embeddings are stored.
• Billing data — payments run through Stripe; we receive your email, subscription status, and payment outcomes, but never your card details.
• Usage telemetry — anonymous install/run statistics (as in Section 1), never conversation content.
• Service logs — operational logs kept for reliability and security, minimized and access-restricted.

3. Processors We Use (Cloud)

We use carefully selected processors, all under data-processing terms, to operate the Service:

• Mistral AI SAS (France/EU) — language-model processing of denoised session text for distillation and consolidation. Our primary AI processing stays in the EU. Each AI provider is responsible for its own processing under its own terms; see the Terms of Service, Section 6.4.
• Google — sign-in (OAuth). We receive your email, name, and account identifier; we do not use your Google account for anything else.
• Stripe, Inc. — payment processing.
• Resend, Inc. — transactional email (trial notices, lifecycle warnings).
• EU hosting providers — servers holding account data, databases, and backups, located in the European Union.

We do not use your memory content to train any language model, ours or a provider's. We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Data Retention and Deletion (Cloud)

• Account data is retained while your account is active and up to 30 days after closure or deletion request.
• Memory data is retained while your subscription is active, through the trial, and through the dormant read-only period described in the Terms: dormant data is deleted 90 days after your last activity, with warning emails sent approximately 60 and 83 days after activity ceases. A final backup archive may be retained briefly for error recovery, then destroyed.
• Billing records are retained as long as required by accounting law.
• Telemetry is anonymous and retained in aggregate form.

On request: account and memory data are deleted within 30 days of a deletion or erasure request; billing records are retained as long as accounting law requires.

Deletion is permanent; data deleted under this policy cannot be recovered. Export your data regularly (see Terms, Section 2.4).

5. GDPR Compliance and Your Rights

Processing occurs on the following bases: performance of a contract (providing the Service), legitimate interests (security, reliability, service improvement of non-content telemetry), legal obligations (accounting), and consent where applicable (optional telemetry). You have the rights to access, correct, delete, restrict, and port your personal data, to object to processing based on legitimate interests, and to lodge a complaint with a supervisory authority. Finnish and EU consumer-protection law applies. To exercise any right, contact support@gamaze.com; we respond within statutory time limits. Business users can request our standard Data Processing Addendum.

6. Security

Data is stored on EU servers with access controls, encryption in transit, and per-tenant isolation. No system is perfectly secure; the Terms of Service disclaim warranties and limit our liability accordingly.

7. Cookies and Analytics

The Service uses a session cookie for sign-in and no advertising or tracking cookies. Our websites use privacy-respecting, aggregate analytics that do not profile you.

8. International Transfers

Our primary AI processing (Mistral) and hosting are in the EU. Sign-in (Google) and email delivery (Resend) may involve processors with global infrastructure; where data leaves the EEA, transfers rely on appropriate safeguards such as EU Standard Contractual Clauses.

9. Changes to This Policy

We may update this policy; material changes are announced by email or in-app at least 7 days before taking effect.

10. Contact

Aironic Ventures Ltd., support@gamaze.com.