Cortyne Privacy Notice
Cortyne is operated by Innovyance Ltd. This notice explains how personal information is handled when people use Cortyne, receive invitations, communicate with us or otherwise interact with the service.
Our role
Innovyance Ltd generally acts as controller for account administration, platform security, service administration, support and its own business operations, and is registered with the UK Information Commissioner’s Office (ICO) for its controller activities. Where an organisation instructs Cortyne to process personal information inside its proposal or collaboration workspace, Innovyance Ltd may act as processor for that organisation.
Information we process
- identity and professional contact details;
- organisation, capability, project and publication information;
- proposal participation, EOI, commitment, work, budget and input information;
- communications and support requests;
- login, audit, security, device and technical usage information;
- privacy-minimised product-learning events such as feature area, time spent, validation friction, repeated submissions, exports/downloads and help usage. Cortyne does not use this telemetry to capture keystrokes, field values, draft text, proposal narrative, email/message content, clipboard contents, screenshots, microphone or video.
Why we use it
We process information to provide and secure Cortyne, administer accounts, support proposal collaboration, send requested invitations and service messages, operate workflow and AI-assisted features, provide support, prevent misuse, meet legal obligations and establish or defend legal claims.
Lawful bases
Depending on the activity, lawful bases may include contract, steps requested before a contract, legitimate interests in operating and securing a professional collaboration platform, legal obligations and consent where consent is required.
Product improvement analytics
Cortyne uses first-party product-learning telemetry to understand whether real proposal workflows are clear and effective, identify repeated friction and prioritise product fixes. The telemetry is designed to minimise personal data and is reported to the Cortyne Team primarily as aggregated workflow evidence. Raw product-learning events are designed for a 90-day retention period before deletion or aggregation. You may object to this processing by contacting us using the privacy contact below.
AI-assisted features
When a user invokes an AI-assisted feature, task-relevant information is processed by Microsoft Azure OpenAI in a regional deployment in UK South. Customer data is not used to train AI models. When a user uploads an existing bid document to prefill a draft proposal, the document text is processed to suggest details from the source for review and correction before creating a proposal. AI output is decision support; Cortyne is not intended to make solely automated decisions about individuals that produce legal or similarly significant effects.
Where information is processed
Cortyne's database, sign-in and file storage are provided by Supabase in Frankfurt, Germany. The application runs in Microsoft Azure UK South, and Cortyne AI uses Microsoft Azure OpenAI in UK South. If a user chooses to link WhatsApp, messages they exchange with the Cortyne assistant are processed by Meta. The current list of providers is on our data protection page.
Recipients and international transfers
Information may be shared with authorised participants, the infrastructure, AI and communication providers described above, professional advisers, regulators or courts where required, and lawful successors. Transfers between the UK and the EU rely on the adequacy decisions each has made for the other. Where other restricted international transfers occur, an applicable transfer mechanism and safeguards are used.
Retention and security
Information is kept only as long as reasonably necessary for the relevant service, contractual, security, audit and legal purposes. Technical and organisational measures are used to protect information, although no internet service can guarantee absolute security.
Your rights
Depending on the circumstances, UK data-protection law may give you rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. The right to erasure is not absolute. You can start an authenticated request through our account deletion page. We will respond within the timeframe required by applicable data-protection law and explain any information we must retain. You can use our data protection complaints procedure, and you may also complain to the UK Information Commissioner's Office.
Contact
Innovyance Ltd, operator of Cortyne. Privacy enquiries: info@cortyne.com.