Atendimento 24/7
Resposta imediata a qualquer hora, sem escalar o time nem a fila noturna.
Back to home
Cookie Policy
What cookies and tracking technologies are, which ones we use, what they are for and how you can manage them, in compliance with the LGPD.
1. Purpose and scope
This Policy explains, in a clear manner, what cookies and tracking technologies are, which ones we use, what they are for, how you can manage them and which legal bases we apply, in compliance with the General Data Protection Law (LGPD).
It applies to the use and browsing of the institutional website www.cortex.je, the customer service WebChat and the technical components integrated into the Cortex Agents (Atena and Apolo), which operate in a WebChat-only model.
2. What cookies and similar technologies are
Cookies are small text files stored in the browser or device when you visit a website. They allow basic features to work, remember preferences, measure performance and help personalize your experience.
In addition to cookies, the following may be used: local storage (Local Storage), Session Storage, WebChat session tags, device identifiers, pixels and tags for the measurement and metering of conversations started via WebChat.
These technologies are configured so as to respect the principle of data minimization.
3. Categories of cookies we use
We use cookies in a proportionate, limited to what is necessary and LGPD-compliant manner, grouped into the categories below:
1. Essential
Ensure the technical and secure functioning of the website and the WebChat.
Without these cookies, certain functions may not operate correctly.
Examples: keeping chat sessions active, authenticating the visitor, load balancing, fraud prevention, remembering security settings.
Legal basis: legitimate interest of the Controller and, where applicable, compliance with a legal obligation.
2. Functional
Improve the user experience by remembering preferences that are not strictly necessary, such as language, layout and history of anonymous conversations in the WebChat.
Examples: chat language, region, notice display status.
Legal basis: consent (when there is non-essential identification) or legitimate interest, with the option to refuse in the Preferences Center.
3. Analytics
Collect aggregated and statistical data to assess the performance of the website and the WebChat, helping us understand how visitors interact with the pages and conversations.
Examples: most visited pages, chat abandonment rate, average session time and WebChat message volume.
Legal basis: consent.
4. Marketing
Help to measure campaigns, personalize experiences and measure conversions in website and WebChat interactions.
Examples: measuring WebChat openings via campaigns, clicks on website buttons and recording the campaign source in the WebChat.
Third parties used: Meta Pixel (Meta/Facebook) and LinkedIn Insight Tag (LinkedIn), to measure conversions from Cortex campaigns — for example, clicking “Book a demo” — and enable remarketing audiences. Loaded only after consent to this category.
Legal basis: consent.
4. What data cookies may collect
Depending on the category and your consent choice, cookies and similar technologies may collect:
- Technical data: truncated IP, browser, device, OS, screen resolution, language, date and time of access, source URL, errors.
- Session identifiers: anonymous chat IDs, connection tokens and identifier of open WebChat sessions.
- Interactions: pages accessed, clicks, time spent, conversation events (opening, closing, sending).
- Preferences: language, dark/light mode, consent and configuration history.
All data follows minimization, purpose limitation and encryption during transit.
5. Consent management and control
You can accept, refuse or configure non-essential cookies through the banner displayed when accessing the website and later in the Preferences Center available at https://www.cortex.je/cookies, also accessible from the footer of all pages.
- Accept all: also enables analytics and marketing.
- Reject all: keeps only essential ones.
- Customize: enables or disables by category.
Before you choose, no analytics or marketing cookie is stored: Meta Pixel, LinkedIn Insight Tag and Google Analytics only load after consent. Google Analytics runs in Consent Mode v2 with every permission denied by default and, in that state, may send Google a cookieless aggregate signal — with no persistent identifier and flagged as “consent denied” — carrying only technical request data such as the IP address and the page visited. That signal supports statistical audience counting under legitimate interest (art. 7, IX, of the Brazilian LGPD), never ad personalisation. If you reject, the state stays denied; if you accept, full measurement is enabled.
You can also manage cookies directly in the browser (Chrome, Firefox, Edge, Safari, etc.).
Browser privacy signals (Do Not Track / Global Privacy Control) will be respected when technically feasible, but some features may not recognize them uniformly.
6. WebChat integration
Our WebChat uses technical identifiers to enable:
- Continuity of the conversation within the WebChat itself under the same Session ID.
- Measurement of performance, queues and WebChat messages.
- Understanding the source of the contact (for example, campaign, source page or website button).
These identifiers are temporary and do not track browsing outside the Cortex environment.
When the user rejects marketing cookies, conversion events will be recorded in an aggregated and non-identifiable manner, preserving the continuity of the operation without individual tracking.
7. Retention period
- Session cookies: expire when the browser is closed.
- Persistent first-party cookies: remain as defined by the issuer, limited to 12 months.
- Third-party cookies: respect the issuer's terms, indicated in the Cookie Table, and do not exceed 24 months.
The terms of each cookie will be listed in the Cookie Table (Annex A) and in the Preferences Center.
Whenever possible, we use rotating identifiers and moderate terms.
8. Sharing and providers
We use providers for hosting, analytics, security, consent management and metering (for example: cloud providers, CDN, WebChat and analytics tools).
All act under confidentiality agreements and data processing agreements (DPA), in accordance with the LGPD.
We do not commercialize personal data.
In the event of a merger, acquisition or reorganization, we will transfer data to the legal successors, maintaining the safeguards of this Policy and notifying data subjects at least 30 days in advance when the operation entails a material change in processing, with the right to object ensured.
9. International transfer
Some providers are based outside Brazil (for example, cloud providers, CDN, WebChat, LLM and analytics).
When analytics is consented to, Google Analytics (Google LLC) may process events on international infrastructure, including the United States. Google Analytics 4 does not store IP addresses, and the event- and user-data retention period configured on this property is 14 months.
When marketing is consented to, the Meta Pixel and the LinkedIn Insight Tag may process browsing data on the international infrastructure of Meta Platforms and LinkedIn (Microsoft group), including the United States.
In these cases, we apply standard contractual clauses, a TIA (Transfer Impact Assessment) and technical measures such as encryption and access control.
When we act as Processor for B2B clients, the terms of the specific DPA apply.
10. Legal bases and legitimate interest assessment
- Essential: legitimate interest and/or legal obligation (art. 7, IX of the LGPD).
- Functional, analytics and marketing: consent.
Whenever we assess legitimate interest, we document the purpose, necessity and proportionality, with opt-out available.
11. Information security
We adopt controls compatible with the risk, including:
- encryption in transit and, where applicable, at rest;
- access control and strong authentication;
- monitoring, logs and auditing;
- encrypted backups;
- segregation of environments.
The details are in the Information Security Policy and in the Security White Paper (Annex V of the Agreement).
12. Data subject rights
You can exercise your rights set out in art. 18 of the LGPD:
confirmation, access, correction, anonymization, deletion, portability, information about sharing, objection and review of automated decisions.
Send your request to dpo@thecortex.digital with the subject “LGPD Data Subject Rights”.
We will respond within 15 calendar days counted from the receipt of the complete request, pursuant to art. 19 LGPD, extendable for an equal period in complex cases upon formal justification.
Upon revoking consent, the corresponding cookies will be disabled.
You can delete cookies directly in the browser.
13. How to reach us
- DPO: dpo@thecortex.digital
- Security: security@thecortex.digital
Response within 15 calendar days after the receipt of the complete request, pursuant to art. 19 LGPD.
14. Updates to this Policy
We may update this Policy in accordance with legal, technological or business changes.
The current version will always be published with an update date.
Relevant changes may be notified on the website.
This Policy is part of Annex IV, Public Policies of the Services Agreement.
Annex A, Cookie and Technology Table (in production)
| Name | Category | Source | Purpose | Data collected | Duration | Sharing |
|---|---|---|---|---|---|---|
| cortex-webchat-login-v1 (session storage) | Essential | Cortex | Keep the player signed in during a WebChat session | WebChat session identifier | Until you close the tab | Not applicable |
| cortex-webchat-restore-v1 (local storage) | Essential | Cortex | Allow an interrupted WebChat conversation to be resumed | conversation identifier | Until you clear browser data | Not applicable |
| cortex-webchat-widget-v3 (local storage) | Functional | Cortex | Remember the widget state: open or closed, unread messages | conversation interface preferences | Until you clear browser data | Not applicable |
| cortex_cookie_preferences_v2 (local storage) | Essential | Cortex | Keep your cookie choice on this landing page | accepted categories and date of choice | Until you clear browser data | Not applicable |
| Vercel Web Analytics and Speed Insights | Analytics | Third party (Vercel) | Measure audience and real page speed; stores no cookie or identifier in your browser | page visited, referral source, country, browser, device and performance metrics, in aggregate | Not applicable (no cookie) | Vercel |
| Google Analytics (_ga and _ga_*) | Analytics | Third party (Google) | Measure audience and traffic sources on this landing page; loaded only after consent | cookie identifier, pages, referral source, anonymized IP | 12 months | |
| Meta Pixel (_fbp and related) | Marketing | Third party (Meta) | Measure Meta campaign conversions and enable remarketing; loaded only after consent | cookie and device identifiers, URL, browsing data | Up to 3 months | Meta |
| LinkedIn Insight Tag (li_adsId, lastExternalReferrer and related) | Marketing | Third party (LinkedIn) | Measure LinkedIn campaign conversions and enable remarketing; loaded only after consent | cookie and device identifiers, URL, browsing data | Up to 12 months |
Annex B, Cookie Preferences Center
The Preferences Center allows you to:
- View each category and its purpose;
- Enable or disable cookies by category;
- Consult the complete list with name, duration and source;
- Access this Policy and the Privacy Policy;
- See the status and date of consent;
- Withdraw consent or review settings at any time.
Annex C, Configuration best practices
- Load analytics and marketing scripts only after consent.
- Trigger tags and pixels conditionally on the user's choices.
- Mask IPs and rotate identifiers.
- Keep the Cookie Table always up to date.
- Record proof of consent (date, banner version, accepted categories).