How account, content, browser, and AI-related information moves through Kortex.
Read this notice as a data journey: it begins with an account or browser action, follows information through optional AI and transfer features, and ends with the controls, retention periods, and legal rights that apply.
1. Scope and Product Relationship
This policy describes the personal information Kortex collects, the reasons for handling it, where it is kept, the circumstances in which it may be provided to others, and the choices available to you when you use the Kortex browser extension and related features (collectively, the "Services"). In this policy, "Kortex," "we," "us," and "our" refer to the provider of those Services.
Any information obtained through Google APIs is used in accordance with the Chrome Web Store User Data Policy, including its Limited Use requirements.
2. Follow the Information Through Kortex
Creating and maintaining an account
Registration supplies us with account information such as your email address and authentication data. Sign-in is handled by Firebase Authentication through Google OAuth or an email-and-password flow.
Paid access and lifetime licenses
For paid tiers, Kortex records your subscription status and a customer reference supplied by Dodo Payments. Card numbers are not stored by us. If you redeem an AppSumo lifetime offer, the AppSumo license key linked to your account is retained so access can be validated; AppSumo does not give us your email address.
Kortex also keeps your tier—Basic, Pro, or Lifetime Pro—along with counters such as exports, imports, prompts created and source views, the dates on which those counters reset, and broad feature-usage measurements. These records allow us to provide subscriptions, apply usage limits, and understand feature performance.
What "Lifetime" access means: "Lifetime" access means access for as long as the developer can reasonably support and maintain the project and as long as required third-party and reverse-engineered APIs continue to function. If those APIs change, become unavailable, or stop working, certain features (including transfer/export functionality) may be limited or unavailable.
Material saved for your private workspace
To organize your work and synchronize it across signed-in devices, the following user-created or organizational material is stored in your private, authenticated Firestore account:
- saved prompts, together with their folders and tags;
- source views; notes you write, including each note's title and full text; and note or source templates;
- tags, source folders, artifact folders, favorites, highlight colors, and short notes attached to a source;
- collection names and organization—but not the notebook material inside those collections;
- podcast and audio-overview metadata, plus the generated audio itself, which is held in Cloudflare R2 rather than Firestore; and
- automation rules and preferences.
Material that Kortex does not keep
We do not save your chat conversations on our servers. During a transfer, conversation content is handled in memory and sent to the destination account without being retained by us. We likewise do not store the underlying documents in your Gemini Notebook (formerly NotebookLM) sources or notebooks. A note you compose in Kortex is stored for synchronization; the source or conversation to which it refers is not.
Moving your content to Gemini Notebook
When you direct Kortex to place your material in a separate destination account, such as Google Gemini Notebook, we carry out that transfer on your instructions. Once the material reaches that account, the destination service's terms and privacy policy govern it.
Information received from other companies
Account and paid features result in limited third-party records: Firebase Authentication provides sign-in information, Dodo Payments supplies payment or customer references, and AppSumo provides a license key for a lifetime-deal redemption. AppSumo does not share the redeemer's email address with us.
Activity observed while Kortex is enabled
Kortex collects information about use of the Services, including interaction patterns, browser and device characteristics, and internet or network activity. Technical details may include browser and operating-system type, device identifier, language, time zone, and IP address, from which an approximate location can be inferred.
On an active tab where Kortex is enabled, the extension may read interface activity, page-structure changes, and page context needed to operate and improve the Services. Examples include the arrangement of a conversation on ChatGPT, Gemini, Claude, or Perplexity, or the layout of a Gemini Notebook workspace. What appears in that context can incidentally include personal or sensitive information. Password fields are removed when captured.
Backend communications also create diagnostic and server records, such as request time, the Service components involved, session length, failures, crashes, and performance measurements. If you turn on an enhanced feature, the information necessary for that feature may also be collected.
Apart from redacting password fields at capture, Kortex does not routinely de-identify or scrub personal information contained in captured page material.
3. Controls Before, During, and After Use
Immediate product controls
The in-product controls let you turn off data collection and opt out of model training and product improvement at any time. A feature that depends on the disabled processing may no longer work or may offer reduced functionality.
You also have direct, self-service control over your account and content:
- Delete Your Account: You can request account deletion by contacting us at kortexnotebooklm@gmail.com. This will delete your account data, but please note that subscription cancellations must be processed through the customer portal.
- Manage Subscriptions: Cancel or modify your subscription at any time through the extension's "Manage Subscription" feature, which takes you to the Dodo Payments customer portal.
- Export Your Data: You can export content you have created in Kortex, such as your saved prompts and source views, at any time through the extension.
Requests based on privacy law
Depending on local law, you may be able to obtain access to your personal information, ask that it be deleted or corrected, receive a portable copy, object to or restrict processing, withdraw consent when consent is the basis for processing, and complain to a data-protection regulator.
You or an authorized representative may submit a request to kortexnotebooklm@gmail.com. We may ask for information reasonably needed to confirm identity or authority. Requests are honored to the extent feasible, although security records, backups, and model-development information can present practical limits. If a request is refused, an appeal may be sent to the same address. Kortex does not penalize or discriminate against a person for using a privacy right provided by law.
4. AI and Model-Improvement Operations
Information collected through the extension is used for analytics, research, and AI or machine-learning development and improvement. As of this policy's effective date, that program may not yet be operating; if it is not active, this section states the intended practice going forward.
Training inputs and the notice shown to users
While Kortex is active on a tab, interface and interaction information—including material visible on the page—may be collected. Kortex does not make video recordings of your screen. Collected information, even when it incidentally includes personal information, may be used to build, train, test, evaluate, or improve Kortex models and models operated by AI processors for us. It may improve models generally, and information or derived datasets may be provided to third parties.
You may disable use of your information for training and product improvement at any time in Kortex's settings. When the extension is first installed, and when an updated version begins collecting data, Kortex opens a notice from which you can review and change those choices.
Raw page material and outside AI vendors
Active-page collection can include names, email addresses, financial-account information, health information, or other personal material displayed in the browser. Except for password fields removed on capture, the information is kept in the form received in access-controlled infrastructure in the United States. Access is restricted; Kortex does not otherwise strip or de-identify the information before storage or access.
Some AI requests are routed to third-party AI processors. Contractual no-retention and no-training terms prevent those processors from keeping request data beyond the time needed to answer it or using it to train their own models.
Automated output and regulated-use cautions
AI-generated results are produced automatically and can affect what Kortex shows or how a feature responds. They may be inaccurate and are not professional advice. Kortex does not use automated processing to make a decision about you that has legal or comparably significant consequences.
Laws in Illinois, Texas, Washington, and other jurisdictions may impose added requirements for collecting electronic activity, biometric identifiers, or on-screen information. Kortex captures interaction data from an active tab while enabled. If that tab is used in a professional or regulated setting—for example, one containing health, financial, employment, or similar regulated information—you are responsible for ensuring that your use is lawful. Questions about a jurisdiction may be sent to kortexnotebooklm@gmail.com.
5. How Information Can Leave the Kortex Environment
Operational vendors. Hosting, cloud, analytics, support, safety, communications, payment, compliance, and technical vendors receive only the information needed to work for us and must process it under our instructions and applicable law.
Business changes. Prospective purchasers, professional advisers, or a successor may receive information while a merger, sale, reorganization, bankruptcy, or comparable transaction is evaluated or completed.
Law, safety, and enforcement. Information may be disclosed to authorities or others when we reasonably believe disclosure is needed to obey law, cooperate with a valid investigation, protect a person or property, address fraud or security threats, enforce terms, or establish and defend legal rights.
Affiliated entities. A parent, subsidiary, or entity under common control may receive information and must follow this policy when handling it.
Connected services. A website, application, or platform you choose to use with Kortex receives information under its own terms and privacy practices. A connection or link does not by itself mean that Kortex endorses or partners with that third party.
Your direction. Information may be shared when you expressly authorize it or use a feature designed to send information elsewhere.
Licensed or shared datasets. Unless you opt out, personal information or derived datasets may be disclosed, licensed, or otherwise supplied to recipients or intermediaries, including data brokers, for uses such as AI and machine-learning development. We do not provide personal information to advertising networks for targeted advertising.
Named vendors and destinations
- Firebase / Google Cloud provides authentication, Firestore database storage, and backend functions. Firebase's privacy policy applies: https://firebase.google.com/support/privacy
- Dodo Payments handles subscription payments and processes payment information under PCI DSS requirements.
- Cloudflare R2 stores generated podcast and audio-overview files. Cloudflare's privacy policy applies: https://www.cloudflare.com/privacypolicy/
- AppSumo supports applicable lifetime purchases and validates their licenses. AppSumo's privacy policy applies: https://appsumo.com/privacy/
- Google Gemini Notebook is a destination to which you may send your own content; Google's privacy terms govern information in that account.
6. Processing and Storage Destinations
Cloud account storage. Account records, usage information, and synchronized content are stored in Google Cloud Firestore, part of Firebase, and are available only through authenticated access.
Audio storage. Generated podcast and audio-overview files are held in Cloudflare R2; their related metadata is kept in Firestore.
Device storage. The browser stores certain items locally, including authentication tokens used to reach a destination account, extension settings and preferences, and temporary cache information.
Live transfers. Chat conversations used in a transfer are processed in memory and pass from your browser to the destination account; Kortex does not retain them.
Other processing. Depending on the feature, content may be handled on your device or in our cloud environment. Requests involving AI can pass through our inference gateway or an outside AI processor.
7. Security Controls and Time Limits
Kortex uses measures intended to protect information: HTTPS/TLS encrypts transmissions to our servers, Firebase Authentication uses OAuth 2.0, payment data is handled by PCI DSS-compliant processors, and authenticated requests restrict access to user information. No security control can eliminate every risk, so absolute security cannot be promised.
Each principal category of personal information is kept for two years after collection under a fixed schedule. That period also covers activity and interaction logs, usage records, model-development data, AI prompts and outputs, backups, archives, and derived information. Information may be retained longer when needed to satisfy law, settle disputes, or enforce agreements. Removing the extension prevents new collection but does not shorten the period for information already collected. If you delete your account, account information is deleted or anonymized within 30 days; other information collected through the extension remains subject to the two-year schedule.
8. Why Kortex Handles Information
Kortex uses the information described above for the following business and operational purposes:
- operating, supporting, and improving the core Services and optional functionality;
- registering and administering accounts, processing paid access, applying feature limits, and responding to questions;
- research, analytics, troubleshooting, performance monitoring, and correction of technical problems;
- developing, training, testing, evaluating, and improving our own or provider-operated AI and machine-learning systems, subject to the opt-out described below;
- selling, sharing, licensing, or otherwise providing personal information—or datasets derived from it—to third parties, including for AI or machine-learning work, when you have not opted out;
- sending product notices, updates, and event information;
- detecting or investigating fraud, abuse, security events, and violations of our Terms of Service;
- complying with legal duties and protecting the privacy, safety, rights, and property of users, Kortex, and others; and
- enforcing the Terms of Service and other agreements.
Kortex does not use personal information for targeted advertising or cross-context behavioral advertising.
9. State-Law Disclosures
California category and rights register
A California resident may request the categories and specific pieces of personal information Kortex collected, its sources, the business reasons for collection, and the categories of third parties to which it was disclosed. California law may also permit requests for deletion or correction, subject to legal exceptions.
Kortex does not use or disclose personal information for cross-context behavioral advertising. Personal information, including licensed information or derived datasets, may be sold or shared with third parties for purposes such as AI and machine-learning development. You may opt out through the Kortex settings, a recognized preference signal such as Global Privacy Control, or kortexnotebooklm@gmail.com. If sale or sharing begins, Kortex will make an express opt-out method available and honor requests received through those same channels.
Because sensitive personal information can be collected incidentally from viewed pages, you may ask Kortex to limit its use to the purposes permitted by the California Privacy Rights Act. Kortex will not discriminate for exercise of a CPRA right. We also do not provide personal information to third parties for their own direct marketing under California's Shine the Light law.
A verifiable consumer request may be sent to kortexnotebooklm@gmail.com by you or your authorized agent. We respond within 45 days; when permitted, an additional 45 days may be taken after notice. A denial can be appealed at the same email address.
California category register — the following entries describe Kortex's collection during the twelve months preceding this notice.
- Commercial information — collected. Subscription details and payment references.
- Identifiers — collected. Email, authentication and account identifiers, together with identifiers that may appear on viewed pages.
- Inferences — collected. Insights inferred from use of the Services.
- Internet or network activity — collected. Browsing activity and interactions on active tabs.
- Sensitive personal information — collected incidentally. Financial, health, or other sensitive material that page collection may reveal.
- Session interaction and behavioral data — collected. Interface activity recorded through the extension.
Rights under other state laws
Residents of Colorado, Connecticut, Virginia, Texas, Oregon, Montana, and other states with comprehensive privacy statutes may have comparable rights to access, delete, correct, or obtain a copy of personal information and to opt out of designated processing, including certain profiling. Send a request to kortexnotebooklm@gmail.com; the response will follow the law of your state. The same address may be used to opt out of profiling used to support a decision with legal or similarly important effects.
10. Browser-Side Technology
Kortex uses a software development kit to operate features and gather usage or interaction information. Browser local storage holds preferences and other device-side items described above. These tools serve functional purposes and, where applicable, analytics. We do not deploy advertising technology or third-party advertising trackers. Rather than a separate cookie banner, consent to collection is handled through the installation or update notice and the in-product settings, where data collection can be disabled at any time.
11. Corporate Role, Minors, Revisions, and Contact
Our role. For information Kortex collects through the extension, Kortex is the business and controller that decides why and how it is processed. When Kortex moves your material into a destination account at your request, it acts on your instructions for that transfer. The Services support a worldwide user base and are principally operated from the United States.
Users under 18. Kortex is not designed for anyone younger than 18 and should not be used by a minor. We do not knowingly collect personal information from people under 18; information identified as belonging to such a person is deleted.
Revisions and contact. This policy may change. Installation and an extension update that introduces new collection practices open a notice so you can review the change and adjust settings. A material revision will appear in the posted policy with a new effective date. We review the policy at least once each year and whenever a new data practice is introduced. Questions may be sent to Kortex at kortexnotebooklm@gmail.com.