Privacy notice — release-notice emails

This notice explains how CortexBuild processes email addresses to send release-notice emails: upgrade notices to licensed developers, and release shareouts to organisation administrators. It covers this email service only, not CortexBuild product telemetry.

Effective: 2026-10-16

  1. Who is the controller

    Svakrit AI Private Limited (CortexBuild).

    WeWork Rajapushpa Summit, SY. 130P & 115/1P
    Nanakramguda Road, Financial District
    Manikonda Jagir
    Hyderabad, Telangana 500032, India

    For release-notice emails to organisation administrators, CortexBuild is the controller of the address, which belongs to the account the administrator holds with us. For licence-holder addresses, CortexBuild holds the address on behalf of the customer organisation that entered it (as processor) and sends its own release notices to it (as controller).

  2. What emails we send

    Release notices only: what changed in a CortexBuild release, the upgrade command, and links. They are sent from releases@updates.cortexbuild.dev, one message per recipient, when an operator triggers a release campaign. Replies are not read. We do not send promotional or marketing content through this service.

  3. What data we process

    • Your email address.
    • The organisation the address is associated with.
    • Licence state (for example active or assigned).
    • Send and delivery status for each message (for example queued, accepted, failed or suppressed).

  4. Where we got your address

    From your organisation's administrator: the person who issued or assigned your CortexBuild licence, or, for administrators, from the CortexBuild admin account you hold. We do not collect your address from you directly for this purpose.

  5. Why we process it, and our lawful basis

    To send service, upgrade and security notices about CortexBuild. The basis is legitimate interest (GDPR Art. 6(1)(f)). In summary:

    • you actively use a licensed CortexBuild tool;
    • upgrade and security notices serve your own interest, because you need to know about fixes and breaking changes;
    • content is limited to release notes;
    • frequency is low, once per release and operator-triggered;
    • the data used is minimal;
    • every email carries an unsubscribe link;
    • we do not track opens or clicks.

  6. No engagement tracking

    Emails contain no tracking pixels, no remote images and no wrapped links, and email engagement tracking is switched off on every send.

  7. Who else processes it

    Microsoft, as our email delivery processor, through Azure Communication Services. Data location: United States. Transfer mechanism: the Microsoft Data Processing Agreement and EU Standard Contractual Clauses, together with the EU-US Data Privacy Framework where Microsoft holds certification for the relevant service.

  8. How long we keep it

    • Send records are deleted after 13 months, by a job that runs daily. In the database they identify a recipient by a one-way hash of the address rather than the address itself. This is pseudonymous, not anonymous: anyone who already knows an address can compute its hash.
    • If you unsubscribe, we keep that same hash on a suppression list for as long as we must honour your opt-out, which is indefinitely. It exists only so we do not email you again.

  9. Your right to object, and how to unsubscribe

    Every email has a visible Unsubscribe link. Open it and press the confirm button; opening the link alone changes nothing. Unsubscribing is the fastest way to object (GDPR Art. 21). It stops release emails to that address, and is honoured for future sends immediately in practice. The emails also carry standard one-click unsubscribe headers, but the visible link is the mechanism we rely on. You can resubscribe by contacting support.

  10. Access, erasure and other rights

    To ask for access to, or erasure of, the data described here, contact support at docs.cortexbuild.dev/help and say that the request concerns release-notice emails. A CortexBuild platform operator then looks up and erases the records in a two-step process. Erasure removes the send records for that address within the organisation concerned; if the address is used in more than one organisation, it is handled for each. The suppression record described above is retained so that an opt-out is not undone by the erasure.

  11. Your right to complain

    You may lodge a complaint with your local data protection supervisory authority if you believe your data has been processed unlawfully.

  12. Where you will see this notice

    Every release-notice email links to this page in its footer, so you can check how we obtained your address.