Atendimento 24/7
Resposta imediata a qualquer hora, sem escalar o time nem a fila noturna.
Back to home
Artificial Intelligence Transparency Notice
How Cortex uses artificial intelligence agents (Atena and Apolo) in WebChat, with transparency, human oversight and the right to review provided by the LGPD (Lei nº 13.709/2018, Brazil's General Data Protection Law).
Summary
- Cortex operates artificial intelligence agents, Atena (support/operations) and Apolo (governance/reporting), in WebChat.
- When you talk to an agent, you are interacting with an AI, not with a person. At any time you can request human support (handoff).
- The AI uses a language model provider (LLM) that processes content outside Brazil (United States), with contractual and technical safeguards.
- The AI can make mistakes: it may generate inaccurate, incomplete or outdated answers. It does not replace human decisions in critical matters (for example, identity validation, withdrawals and compliance in the iGaming context).
- Cortex does not use B2B client data to train AI models, unless expressly and specifically authorized.
- You have the right to request a review of automated decisions that affect your interests (art. 20 of the LGPD).
- This Notice complements the Privacy Policy and the Service Agreement of Cortex. In case of conflict, the Agreement prevails.
1. What Cortex AI is
1.1. The Atena and Apolo agents
Cortex provides, in the B2B SaaS model, two artificial intelligence agents that operate in a WebChat-only model:
- Atena (operations): automated support, execution of configured flows (for example, identity validation, KYC, withdrawal screening, ticket classification/triage), prioritization and handoff to the client's human agents.
- Apolo (governance): generation of reports, alerts and executive communication, with operational and compliance indicators.
1.2. What the AI does
At a high level, the agents:
- interpret messages and questions in natural language;
- retrieve relevant context (for example, knowledge base and parameters configured by the client) to ground the answer;
- generate answers and classifications in natural language;
- execute automated flows under the B2B client's instruction, when contracted;
- route the conversation to a person when needed (human handoff).
1.3. What the AI does not do
Unless otherwise configured under contract by the client:
- the AI does not make final decisions on critical matters without the possibility of human review;
- the AI does not replace the compliance, content and journey obligations that are the responsibility of the Controller client;
- the AI does not guarantee the full correctness of its answers (see Section 4).
1.4. Who is responsible for your data (Controller and Processor)
The role of Cortex in processing your data depends on how you interact:
- Cortex institutional site and WebChat (www.cortex.je): Cortex is the Controller. In this context, there is no solely automated decision producing legal effects on visitors.
- WebChat embedded in a B2B client's product/service: the client is the Controller and Cortex is the Processor, processing data according to contractual instructions and the DPA (Annex III of the Agreement).
If you have any doubt about who the Controller of your interaction is, write to dpo@thecortex.digital; the request will be forwarded to the correct Controller within 5 business days. This distinction is the same as in the Privacy Policy (Sections 1 and 11).
2. How the AI works (high-level overview)
2.1. Language model (LLM) and context retrieval
To generate answers, the agents combine:
- a language model (LLM) from a third-party provider (currently OpenAI);
- context retrieval from knowledge bases, parameters and instructions configured for each client;
- rules and flows defined during implementation (Annex I of the Agreement).
The answer is built probabilistically from language patterns; it is not the result of a deterministic query against a database of fixed answers.
2.2. International data transfer
The LLM provider processes content outside Brazil (United States). This constitutes an international data transfer under the LGPD.
For these cases, Cortex adopts safeguards, standard contractual clauses, a transfer impact assessment (TIA), encryption in transit and access controls, as described in the Privacy Policy (Section 7, International transfers). When Cortex acts as Processor, the transfer details are set out in the client's DPA.
2.3. Suppliers (sub-processors)
The AI relies on suppliers (sub-processors) for LLM, infrastructure, WebChat/CDN, monitoring and security. These suppliers act under confidentiality, security and purpose-limitation obligations, to the extent necessary to operate the service. The list of sub-processor categories is described in the Privacy Policy and in the DPA.
3. Transparency: you know you are talking to an AI
3.1. AI identification
Cortex adopts, as a principle, that the end user knows they are interacting with an artificial intelligence agent, and not with a person. The agent's identification is presented in the support channel.
3.2. Human handoff
At any time during support, you can request transfer to a person (a human agent of the Controller client). Routing and availability hours depend on the configuration and the plan contracted by the client.
3.3. Easy access to information
In line with the principle of free access and transparency of the LGPD, this Notice, the Privacy Policy and the contact channels (Section 8) are available so that you understand how the AI processes information and how to exercise your rights.
4. AI limits and risks
4.1. The AI can make mistakes
AI technology is probabilistic and not deterministic. The AI may:
- generate inaccurate, incomplete or outdated answers (including hallucinations);
- misinterpret an ambiguous question;
- fail to reflect last-minute changes to the client's configuration.
4.2. The AI does not replace human decisions in critical matters
In sensitive flows, especially in the iGaming context, such as KYC, withdrawal screening and compliance/responsible gaming, the AI acts as operational support, and the final decision with relevant effects rests with a natural person of the Controller (or of Cortex, where applicable). Responsibility for content, offers, journeys and regulatory compliance in iGaming lies with the Controller client, under the terms of the Agreement (clauses 4.2.2, 12.3 and 16.4).
4.3. Review of outputs before external use
Under the Agreement (clause 9.7), Cortex adopts reasonable controls to mitigate the risk of infringing third-party rights through AI outputs, but does not guarantee that outputs are free of fortuitous coincidences. The final review of outputs before external use is the client's responsibility.
5. Automated flows and decisions (art. 20 LGPD)
5.1. Cortex institutional site and WebChat
On the Cortex institutional site and public WebChat, no solely automated decisions are made that produce legal effects on or otherwise significantly affect visitors. This position is consistent with the Privacy Policy (Section 11).
5.2. Automated flows in a B2B context (Processor)
When Cortex acts as Processor, it may operate automated flows under the B2B client's instruction, for example, KYC, withdrawal screening and ticket classification. In these cases, the client is the Controller of those flows and the decisions arising from them.
5.3. Right to review (art. 20 of the LGPD)
Article 20 of the LGPD assures the data subject the right to request the review of decisions taken solely on the basis of automated processing that affect their interests, including decisions intended to define a personal, professional, consumer and credit profile or aspects of personality. Paragraph 1 guarantees the data subject clear and adequate information about the criteria and procedures of the automated decision, subject to commercial and industrial secrets.
When an automated flow operated by Cortex results in a decision with relevant effects on the data subject, review by a natural person is assured, upon formal request:
- to the Cortex DPO: dpo@thecortex.digital; or
- directly to the Controller of the corresponding operation (B2B client).
Cortex will forward to the correct Controller any requests relating to flows operated as Processor, as set out in the Privacy Policy (Sections 10 and 11).
6. Privacy and minimization
6.1. Minimization and purpose limitation
Cortex seeks to process only what is necessary to generate answers, operate the service, maintain security and comply with legal obligations, applying minimization and purpose limitation.
6.2. User precautions
Avoid entering, during support, unnecessary personal data (documents, passwords, verification codes, banking data) and third-party data, except when expressly requested and necessary for the contracted flow (for example, KYC under the Controller's instruction).
6.3. Where to find the details
The legal bases, data categories, retention, sharing, international transfers and how to exercise your rights are detailed in the Cortex Privacy Policy. This Notice does not replace the Privacy Policy; it merely complements it regarding AI transparency.
7. Use of data for model training
Cortex does not use client data, content, messages, logs or metadata to train, fine-tune or improve models, whether its own or third-party, unless expressly, in writing and specifically authorized by the client in a Service Order (SO), as per clause 9.8 of the Agreement.
Aggregated and de-identified statistical metrics are permitted for operational improvement purposes.
The outputs generated by the agents from the client's prompts, data and instructions are licensed to the client for operational use, without prejudice to Cortex's ownership of the engine, proprietary prompts, models and flows (clause 9.6 of the Agreement).
8. Human oversight and AI governance
Cortex maintains governance practices applicable to AI operations, in line with its compliance-first positioning:
- Human oversight (human-in-the-loop): availability of handoff and of review by a natural person in decisions with relevant effects (Section 5);
- Security controls commensurate with the risk (encryption, RBAC, MFA, logs and monitoring), detailed in the Privacy Policy and in the Security White Paper (Annex V of the Agreement);
- Privacy governance: appointed DPO, records of processing (ROPA), transfer impact assessments (TIA) and formalized DPAs;
- Limitation on data use: prohibition on training models with client data (Section 7);
- Continuous improvement and monitoring of the quality and behavior of the agents.
Cortex does not guarantee full regulatory compliance of the client's operation (Annex V, item 3.1 of the Agreement), being limited to providing technology, controls and evidence as contracted.
9. How to talk to Cortex
- Data Protection Officer (DPO): dpo@thecortex.digital
- Security: security@thecortex.digital
- Legal: legal@thecortex.digital
To exercise LGPD rights (including review of automated decisions, art. 20), send an email to the DPO with the subject “LGPD Data Subject Rights”. Cortex may request identity validation. Response time: up to 15 days (extendable in complex cases). If the data is processed on behalf of a B2B client, the request will be forwarded to the corresponding Controller. The data subject may also petition the ANPD.
10. Related documents
- Cortex Privacy Policy (LGPD), in particular Section 7 (international transfers) and Section 11 (automated decisions and profiling).
- Service Agreement (B2B SaaS), in particular clauses 9.6 (AI outputs), 9.7 (non-infringement) and 9.8 (prohibition on training with client data).
- DPA (Annex III of the Agreement), when Cortex acts as Processor.
- Compliance and Security White Paper (Annex V of the Agreement).
11. Updates to this Notice
This Notice may be updated due to legal, technical or business changes (for example, a change of LLM provider or new automated flows). The current version will be available on the site, with an update date. Relevant changes may be communicated via a notice on the site.