Effective date: 2026-09-04. Version: 9.
This Policy explains what data NowDo.AI (the "Service") collects, why, and what your rights are. By signing in, you agree to the data practices described here.
The Service is operated by Cortiq Co., Ltd., the data controller, whose full details are under § 10. It uses a small set of third-party sub-processors, each under signed terms, to run the Service: Supabase (authentication, database and storage), Anthropic (the AI model provider), Vercel and Cloudflare (web hosting and delivery), Sentry (error monitoring), Plausible (a cookieless public-page count), Resend (transactional and newsletter email), Paddle (payments for the Pro plan on the web) and RevenueCat (validating Pro purchases made in the iPhone app). Each one sees only the data it needs for its job, and Sentry receives PII-stripped reports (see § 2).
The full, dated list of sub-processors, with each provider's purpose, the data it handles, and its region, is kept on the sub-processors page. That page is the maintained source of truth; we update it before a new sub-processor goes live.
Your data is stored in the United States (Supabase's US region). Where you are in the EU or UK, transfers of your personal data to the United States rely on the Standard Contractual Clauses in our agreements with the relevant sub-processors (Supabase and Anthropic both offer SCC-backed terms). We don't sell your data, we don't share it with advertisers, and we don't use it to train AI models.
Account data
Content data
Optional integration data
Operational metadata
The Service uses essential cookies only: the session cookie that keeps you signed in, and the auth refresh cookie managed by Supabase. No advertising or cross-site tracking cookies.
The public pages (the landing page, sign-in and the docs) run Plausible Analytics for a simple page-count. Plausible is cookieless by design. It sets no cookies, uses no persistent identifier, and anonymises your IP address, so it cannot follow you across sites or sessions. It runs on the public pages only, never inside the signed-in app, and it collects no personal data. Plausible processes this data in the European Union.
Because the Service sets only essential cookies and the page-count is cookieless, no consent banner is required in the EU under current guidance.
AI features are off until you allow them. The app asks for your permission in-app the first time you use one, and names what is sent and to whom. You can decline and keep using everything else, and you can turn AI off again in Settings → AI.
When you use AI features (chat, row enrichment, brain-dump):
Voice capture is the one AI-adjacent feature that sends nothing: your iPhone turns speech into text by itself. The text you then approve is treated exactly like a typed capture, so it goes to Anthropic under the terms above.
A small allowlist of operators (currently the founder) can read account-level data through an internal admin surface for the purposes of: (a) responding to bug reports and support requests, (b) sending project-update newsletters to subscribers, (c) investigating abuse, and (d) contacting users who have opted in to product research, to ask how they use the Service. That last one is off unless you turn it on in Settings → Notifications, it is separate from the project-updates newsletter, and it is never used to sell you anything. Every operator action (viewing the user list, opening a user's detail page, fetching the newsletter audience, drafting a newsletter, or overriding a newsletter opt-in) is recorded in an append-only audit log with the operator's email, the action, the target user (if any), and the timestamp. Operators cannot impersonate or sign in as you. They read data through service-role queries against the database. The audit log is the disclosure surface. Request a copy of operator access to your account at the contact address below.
You can:
If you're in the EU or UK you have additional statutory rights (portability, and the right to lodge a complaint with a supervisory authority). Contact us to exercise them.
If you are a California resident, you have the right to know what personal information we hold about you, to delete it, to correct it, and to opt out of its sale or sharing. You exercise the know and delete rights through the same controls as everyone else: Export my data and Delete account in Settings → Account.
We do not sell or share your personal information as those terms are defined under the CCPA/CPRA. We do not exchange it for money and we do not share it for cross-context behavioural advertising. Because there is no sale or sharing, no "Do Not Sell or Share My Personal Information" link is required, and we do not provide one.
We will not discriminate against you for exercising any of these rights.
The Service is not directed at children under 13 (or under 16 in the EU). Don't create an account for or upload data about anyone under that age.
We may update this Policy. If a change is material, you'll be asked to accept the new version on next sign-in. Continued use means you agree to the updated Policy.
Privacy questions, requests, or complaints: contact@cortiq.so. Business users can request a Data Processing Agreement (DPA) at the same address.
The data controller is:
Cortiq Co., Ltd. (코르티크 주식회사) 2F J4, 91 Baumoe-ro, Seocho-gu, Seoul, Republic of Korea Representative: Seong Joon Oh (오성준) Business Registration No. 516-88-03683 Mail-Order Sales Registration No. 제2026-서울서초-2081호 Tel: +82-70-8065-2031 Email: contact@cortiq.so
This is an early-access draft and is not a substitute for advice from a qualified lawyer in your jurisdiction.