PRIVACY STATEMENT — CORTLOGIC
Version 2.2 — 14 October 2026 (supersedes the version of 6 August 2026)
1. Who we are
CortLogic is the controller for the personal data described in this statement.
CortLogic, sole proprietorship Dutch Chamber of Commerce no. 42148916, Purmerend, the Netherlands Website: cortlogic.com Contact, including privacy enquiries: support@cortlogic.com
CORTLOGIC is a market intelligence platform for online retailers. It is built on a privacy-by-design principle: we limit the processing of personal data to the minimum needed to deliver the service, and filter out identifying details at the moment data enters our systems.
2. What data we process
2.1 Customer data
To provide the subscription and the platform we process: name and company name, business email address, country, webshop URL, login credentials, the settings and competitors you enter, invoicing and payment details, and your communications with our support, including any screenshots you send.
Payments are processed by Stripe. We do not ourselves receive or store full card or bank account numbers.
Legal basis: performance of the contract (Article 6(1)(b) GDPR) and legal obligations, including tax retention requirements (Article 6(1)(c) GDPR).
2.2 Visits to our website
We process the data you enter in our contact form, and technical data needed to operate and secure the website. For cookies and similar technologies, please see the cookie information on our website.
Legal basis: legitimate interest in a functioning, secure website (Article 6(1)(f) GDPR), and your consent where required.
2.3 Market and company data
On behalf of our customers we collect publicly available information about e-commerce businesses: webshop and brand names, URLs, product prices, assortment and availability, and general sector data. This is information about businesses and not personal data; the GDPR does not apply to it.
We do not build a searchable index of shops or shop owners, and we do not offer one.
2.4 Public reviews
For our review and reputation analysis we load public reviews from platforms such as Trustpilot and Google. A review may have been written by a natural person.
We filter this data on entry. Not stored: the reviewer's name, profile ID, avatar or profile picture, and the reviewer's location. Stored: the review text, the rating, the publication date, the source platform and the source URL.
2.5 Public comments on our customers' own channels
For our reputation analysis we load public comments on our customers' own social media channels (Facebook, Instagram, TikTok, YouTube). This happens only where the customer has given permission in their settings, and only for their own channels.
Not stored: the writer's name, username, profile URL or avatar. Stored: the text of the comment, the platform, a reference to the post, the date, the engagement counts, the outcome of the sentiment and theme analysis, and an encrypted key that lets us recognise repeat comments from the same writer without knowing who that is.
2.6 Public advertisements, posts and forum content
For market and opportunity analysis we process public advertisement texts from Meta's ad library, public posts from business accounts on social media, and public forum posts (Reddit).
For posts from business accounts we automatically remove email addresses, telephone numbers and @-mentions on entry. Free text may additionally contain names on occasion; these are not automatically recognised. For forum posts we store no username, author ID or profile link — only the title, the text, the subforum, the date and the link to the post.
2.7 Legal basis for 2.4 to 2.6: legitimate interest
For these public sources we rely on legitimate interest (Article 6(1)(f) GDPR). Our customers' interest in understanding market trends, competitive positions and consumer sentiment outweighs the limited impact on the writer. The material consists solely of texts the writer made public themselves intending others to read them, we do not establish their identity, we build no profile of individuals, and we use the data only in aggregate for analysis at company, sector and country level. Seeking prior consent from every individual would involve disproportionate effort (Article 14(5)(b) GDPR).
2.8 Pseudonymisation, not anonymisation
Because we do not store names and profile details, the data under 2.4 to 2.6 is pseudonymised: we cannot identify the writer. The original text does, however, remain on the source platform, so attribution remains theoretically possible. We therefore treat this data as personal data and handle it in accordance with this statement. Only the aggregated outcomes — scores, counts and trend lines — are fully anonymous.
3. Automated analysis using AI
To classify texts we use an AI model (Google Gemini, via the infrastructure of our build environment Lovable). For each text the model determines one thing only: what the text is about, drawn from a fixed list of topics, together with the language and whether it concerns a giveaway.
The model does not write text, does not assess individuals and makes no decisions. Opportunities and scores are calculated using fixed rules. There is no automated decision-making producing legal or similarly significant effects on individuals within the meaning of Article 22 GDPR.
Only the texts described under 2.6 — advertisement texts, business account posts and forum posts — are sent to the model, without author details. Reviews and comments under 2.4 and 2.5 are not sent to the model; those are classified using fixed word rules.
4. Who we share data with
We do not sell data. We engage the following categories of service providers:
- Hosting and application: Lovable, using Cloudflare infrastructure
- Database: Supabase, with storage in Frankfurt, Germany
- AI model: Google, via Lovable's infrastructure
- Payments: Stripe
- Email: Resend
- Data sources: DataForSEO, SociaVault, Zyte, Google (YouTube Data API) and Meta (ad library)
We also share data where a legal obligation requires it.
If you are a customer with a webshop on Shopify and move to our application in the Shopify App Store, your subscription and billing will from that point run via Shopify, and Shopify will process your data for that purpose under its own terms.
5. Storage and transfers
Our database is located within the European Union, in Frankfurt. Our application runs on a global network, which means processing may take place in the data centre closest to the visitor.
Some of our service providers are established outside the European Economic Area or process data there. We make agreements with our service providers on the processing of personal data, and where transfers outside the EEA take place we rely on the European Commission's standard contractual clauses, to the extent these are in force with the provider concerned. We are currently finalising this contractual documentation. If you have a question about this, we will answer it via support@cortlogic.com.
6. Security
Data belonging to different customers is strictly separated by row-level security in the database. Your data is not visible to other customers. Access is limited to what is required for administration and support.
7. How long we keep data
Customer data: for as long as your subscription runs. After the subscription ends we keep your data for a further seven days so that you can return. After that we automatically and irreversibly delete everything traceable to you: your account, the competitors and settings you entered, and all results and history collected and calculated for you.
Sign-ups that were not completed: if you started a sign-up but never paid, we delete the details entered after twenty-four hours.
Exception for webshops on Shopify: if you have a webshop on Shopify and became a customer directly before our Shopify application launched, we do not delete your data automatically after your subscription ends. We retain it until the transition to Shopify has been arranged, so that you do not lose the history you have built up before that transition is possible. Once the transition is complete or you decide against it, we delete your data. You may request deletion yourself at any time via support@cortlogic.com, and we will carry that request out.
Invoices and payment records: for as long as statutory tax retention obligations require.
Reviews: raw review texts are kept for a maximum of twelve months; after that only aggregated, anonymous outcomes remain.
Comments on own channels: for as long as the customer who owns the channel is a customer of ours, because the reputation analysis makes month-on-month, quarterly and annual comparisons. If the customer withdraws permission, this data is no longer used; when the subscription ends it is deleted in accordance with the period above.
Market and company data, advertisement texts and forum posts: these are kept as part of our market information at sector and country level. That information is not traceable to a customer and continues to exist after a subscription ends.
Retained after termination: anonymised market information at sector and country level, such as which product topics are active in a sector. It contains no information about you, your business or your account and is not re-linked to you.
8. Your rights
You have the right of access to your personal data, and the rights to rectification, erasure, restriction of processing, objection to processing and data portability. Where we rely on your consent, you may withdraw it at any time; this does not affect the lawfulness of processing before withdrawal.
You can submit a request via support@cortlogic.com.
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), PO Box 93374, 2509 AJ The Hague, autoriteitpersoonsgegevens.nl, or with the supervisory authority in your own country.
Did you write a review, comment or forum post?
We do not store your name or profile, but you may object to the processing of your public text in our analyses. Send a message to support@cortlogic.com with the link to the text concerned. We will then remove it from our data and exclude the source from future collection through our internal exclusion list.
9. Changes
We may amend this statement, for example where legislation, our services or our suppliers change. The current version is always available at cortlogic.com, with its version number and date.