Privacy Policy

We Respect Your Privacy

Last updated: October 3, 2026

1. Introduction

CortIQ ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect and use data when you use our analytics platform.

Processing on websites that use CortIQ falls into three tiers:

  • • Without consent — security, AI-bot and agent detection, and server/edge logs (section 3).
  • • With analytics (Statistics) consent — all visitor analytics, in both Cookieless and Full mode (section 5).
  • • With marketing consent — advertising click IDs and conversion feedback to ad platforms (section 5A).

2. Data Controller

Legal entity: Expandtalk Corporation AB

Product: CortIQ

Company registration number: 559358-8824

Registered address: Parmmätaregatan 4B, 417 04 Göteborg, Sweden

Email: info@expandtalk.se

For analytics data collected on our customers' websites, CortIQ acts as a processor on behalf of the site operator (the controller). For our own account, billing and platform data, CortIQ (Expandtalk Corporation AB) is the controller.

3A. Security & AI-Bot Detection (Without consent)

Security layer

Before any consent choice is made, the CortIQ script runs only a limited security and bot-detection layer:

  • AI bot and agent detection (e.g. ChatGPT Browser, Perplexity Comet, Claude Browser) based on the User-Agent string and browser capability signals
  • Crawler classification (training crawlers, citation crawlers, search engines, scrapers)
  • Bot probe — runs only when the client looks automated; ordinary browsers send nothing
  • Honeypot and canary links — invisible elements that only automated clients interact with
  • • No cookies are set and no analytics identifiers are stored by this layer. It uses a random identifier that exists only for the current page load.
  • • If a client is classified as automated, a page-depth counter (_ciq_adp) is kept in sessionStorage for that tab session.
  • • Data from this layer is used for security, abuse prevention and bot classification — not for advertising or visitor profiling.

Legal basis (our assessment): legitimate interest (GDPR Art. 6.1.f) in protecting websites against abuse and in identifying automated traffic. To the extent the script accesses information on the device, we consider this strictly necessary for the security of the service within the meaning of ePrivacy Directive Art. 5.3. This is our interpretation; supervisory authorities may take a different view, and site operators remain responsible for their own assessment.

3B. Server & Edge Logs (Without consent)

Operations & security

Every HTTP request produces a log entry on the web server, and — where the site operator enables the Cloudflare integration — at Cloudflare's edge. CortIQ processes these raw logs for technical operation, security and bot classification.

Data in a log entry

For requests classified as automated (crawlers, AI bots, scrapers, monitoring) CortIQ stores:

  • • Timestamp of the request
  • • HTTP method and URL path without query string (e.g. GET /products/product-123)
  • • HTTP status code (200, 404, 500)
  • • User-Agent (used for crawler and bot classification)
  • • Referrer
  • • Country, derived from the IP address
  • • Truncated IP address — the last octet is removed (/24 subnet) before CortIQ stores it; the full IP address is not stored
  • • Request identifier (e.g. Cloudflare Ray ID) and load time

For requests that look human or cannot be classified, CortIQ keeps only an anonymous count: timestamp, method, status code, country and whether it was a file request. No user agent, referrer, IP subnet, request identifier or URL is stored for those requests.

Retention: see section 9.

  • • Log processing sets nothing on the visitor's device.
  • • Log data is used to operate the service, detect errors and attacks, and classify crawlers and AI bots (which typically do not execute JavaScript and are only visible in logs).
  • • Log data is not used to build visitor profiles and is not shared with advertising recipients.

Legal basis (our assessment): legitimate interest (GDPR Art. 6.1.f) in operating and securing the service. Server logging does not involve storing or reading information on the visitor's device.

4. First-Party Data from Logged-In Users

Contractual basis

For logged-in users, we collect data necessary to provide the service:

  • Email address (from registration form)
  • CRM events (purchases, bookings, interactions)
  • User activity linked to your account
  • Data you consciously submit via forms
  • Platform usage to improve the service

Legal Basis:

  • • Contractual basis (GDPR Art. 6.1.b) - Necessary to provide the service
  • • Legitimate interest (GDPR Art. 6.1.f) - Improve platform based on user activity

Note: This covers account holders of the CortIQ platform. It is separate from the visitor analytics described in section 5, which always requires consent.

5. Visitor Analytics (Requires analytics consent)

With your approval

All visitor analytics starts only after you grant analytics (Statistics) consent. This applies in both Cookieless and Full mode:

  • Page views and most visited pages
  • AI referrals — when a visit arrives from an AI service such as ChatGPT or Perplexity (referring site, landing page with UTM parameters only, device type, time on page)
  • Referrers and traffic sources (including UTM parameters)
  • Sessions, device type, browser and country
  • Clicks and link clicks
  • Scroll depth and heatmaps
  • Form interactions (field content is not captured) and form submissions
  • E-commerce events and conversions

Cookieless mode

  • • No cookies
  • • No device fingerprinting
  • • No cross-visit or cross-site profile
  • • Session identifier held in memory only
  • • No advertising click IDs
  • • Still requires consent

Full mode

  • • Session identifier in sessionStorage (deleted when the tab closes)
  • • Visitor identification across page views, used to link sessions and conversions
  • • Marketing features only with marketing consent (section 5A)

Legal basis: consent (GDPR Art. 6.1.a; ePrivacy Directive Art. 5.3).

Withdrawal: you can withdraw consent at any time via the site's cookie settings. Tracking stops immediately, and the session identifier and any stored click IDs are cleared from your browser. Withdrawal does not affect processing carried out before it.

5A. Marketing & Advertising Measurement (Requires marketing consent)

With your approval

In Full mode, and only if you grant marketing consent, CortIQ may also process:

  • • Advertising click IDs from the page URL (gclid, fbclid, msclkid, ttclid, li_fat_id), kept in sessionStorage for the tab session and linked to conversions.
  • • Conversion feedback to advertising platforms (e.g. Google Ads Enhanced Conversions), using a SHA-256 hash of an email address submitted in a form together with the click ID (section 5B).
  • • Canvas/WebGL device signals for visitor identification — only where the site operator has explicitly enabled this feature.

None of the above runs in Cookieless mode or without marketing consent.

Legal basis: consent (GDPR Art. 6.1.a; ePrivacy Directive Art. 5.3).

5B. Third-Party Recipients & Processors

We use the following processors and, for consent-based advertising features, share data with the following recipients:

  • • Supabase (infrastructure / database hosting, EU region) — processor for all analytics data.
  • • Anthropic (AI assistant & GEO analysis, USA) — when the operator uses AI features with their own Anthropic API key, relevant analytics results are sent to the Claude API on the operator's instruction. Anthropic then acts under the operator's own agreement with Anthropic, not as CortIQ's subprocessor.
  • • Resend (email delivery, USA) — only when the operator sends a report export by email; the report and the recipient address are passed to Resend for delivery.
  • • Google Ads (Enhanced Conversions for Leads, USA) — when the operator enables conversion feedback and marketing consent was given, a SHA-256 hash of the email plus the ad click ID (gclid) and conversion value are uploaded. The raw email never leaves the browser.
  • • HubSpot (CRM lead-quality feedback, USA/EU) — when the operator connects HubSpot, lead-quality signals are exchanged to enrich conversion measurement.
  • • Cloudflare (edge logs & geo lookup, USA — EU-US DPF certified) — when the operator enables the Cloudflare integration, Cloudflare processes visitor IP addresses at its edge; CortIQ receives the country and a truncated IP address for security and bot classification (section 3B).

Note: a SHA-256 hash of an email address is still considered personal data (pseudonymised) under GDPR. Advertising uploads occur only where marketing consent was given at capture time.

5C. International Data Transfers

Some recipients above (Anthropic, Google, HubSpot, Cloudflare) process data in the United States. Where personal data is transferred outside the EU/EEA, we rely on the European Commission's Standard Contractual Clauses (Art. 46 GDPR) and, where applicable, the recipient's certification under the EU–US Data Privacy Framework, together with supplementary measures such as pseudonymisation (hashing) and data minimisation.

Core analytics infrastructure (Supabase) is hosted in the EU. AI, advertising and Cloudflare features that may involve US transfers are optional and enabled by the site operator; advertising transfers additionally require the visitor's marketing consent.

6. Cookies & Browser Storage

A. On websites that use CortIQ

The CortIQ tracking script and the CortIQ consent banner use the following. If the site operator uses a different consent tool, that tool's own storage applies instead of the consent items.

Necessary (always active)
  • • site_cookie_consent (localStorage) - Your consent choices, read by the tracking script before anything is measured (Lifetime: 12 months; you are then asked again)
  • • site_consent (cookie) - Mirror of your consent choices, set by the consent banner (Lifetime: 12 months)
  • • user_consent (sessionStorage) - Copy of your consent choices for the current tab, set by the consent banner (Lifetime: tab session)
  • • _ciq_adp (sessionStorage) - Page-depth counter, written only for clients classified as automated (Lifetime: tab session)
Analytical (requires analytics consent, Full mode only)
  • • cortiq_session_id (sessionStorage) - Per-session identifier (Lifetime: tab session). In Cookieless mode it is held in memory only and nothing is written.
Marketing (requires marketing consent, Full mode only)
  • • cortiq_click_ids (sessionStorage) - Ad click IDs from the landing URL (Lifetime: tab session)

B. On cortiq.se

Our own website does not load Google Analytics, advertising pixels or the CortIQ tracking script. It sets only:

  • • site_cookie_consent (localStorage), site_consent (cookie) and user_consent (sessionStorage) - Your consent choices, as above
  • • theme (localStorage) - Light/dark theme, only if you switch theme
  • • sb-…-auth-token (localStorage) - Login session for the dashboard, only when you log in

The only cookie CortIQ sets is the consent-choice mirror site_consent. Analytical and marketing storage is written only after the corresponding consent. Withdrawing consent removes cortiq_session_id and cortiq_click_ids.

7. Your Rights Under GDPR

You have the following rights:

  • ✓ Right of access (Art. 15 GDPR) - Request a copy of your data
  • ✓ Right to erasure (Art. 17 GDPR) - Request deletion of your data
  • ✓ Right to rectification (Art. 16 GDPR) - Correct inaccurate data
  • ✓ Right to object (Art. 21 GDPR) - Object to processing based on legitimate interest (section 3)
  • ✓ Right to data portability (Art. 20 GDPR) - Get your data in structured form
  • ✓ Right to withdraw consent (Art. 7.3 GDPR) - At any time, via the site's cookie settings

How to exercise your rights:

  1. 1. Send an email to: info@expandtalk.se
  2. 2. Include: Your name, email, and which right you want to exercise
  3. 3. We will respond within 30 days

You also have the right to lodge a complaint with a supervisory authority, in Sweden Integritetsskyddsmyndigheten (IMY).

8. Data Security

We use the following security measures:

  • 🔒 Encryption: All data is transferred via HTTPS/TLS
  • 🔒 IP truncation: IP addresses are truncated before storage
  • 🔒 Access control: Only authorized personnel have access; row-level security isolates each customer's data
  • 🔒 Supabase: Data storage in the EU

9. Data Retention & Automatic Deletion

Visitor analytics and AI-bot traffic

A daily job deletes data older than the site's retention period. One period per site applies to all of the following: page views, sessions, interactions, heatmap data, form analytics, conversion events (including hashed email and click IDs), visitor profiles, AI referral records, AI-bot traffic, and AI agent sessions and journeys.

  • • Retention period: the value in the site's GDPR settings (default 365 days)
  • • Sites without GDPR settings: 730 days

Security layer

  • • Server-log (Cloudflare) records: 90 days, or the site's retention period if shorter
  • • Bot detection records: 730 days
  • • Hourly bot statistics (aggregated): 365 days

Consent and data-subject requests

  • • Consent records (proof of consent): 2 years, to demonstrate consent under GDPR Art. 7.1. This is separate from how long a consent choice is valid: a consent choice expires after 12 months, after which you are asked again.
  • • Data-subject requests: 3 years, or 1 year after a request is completed

Hosting providers

Request logs held by our hosting providers (Supabase and, where enabled, Cloudflare) follow those providers' own log retention. Deleting a site from CortIQ deletes all of its data immediately.

You can request earlier deletion at any time by contacting info@expandtalk.se.

10. Techniques We Do Not Use Without Consent

Without consent, CortIQ does not use:

  • ❌ Analytics or advertising cookies (CortIQ does not set Google Analytics or Facebook Pixel cookies such as _ga or _fbp)
  • ❌ Visitor analytics of any kind (page views, sessions, clicks, scroll depth, heatmaps)
  • ❌ Device fingerprinting for identification (Canvas, WebGL, font detection)
  • ❌ Hash-based tracking (e.g. IP + User-Agent hash)
  • ❌ Advertising click IDs (gclid, fbclid, etc.)

Note: Cookieless operation does not remove the need for consent. Under the ePrivacy Directive, reading or storing information on a device for analytics requires consent regardless of whether cookies are used or the script runs on the site's own domain.

11. Contact Us

Email: info@expandtalk.se

Support: info@expandtalk.se

Quick Guide: What Runs When?

Summary only — sections 3 to 5C are authoritative.

Without consent

Security layer + logs

  • • AI bot & agent detection
  • • Crawler classification
  • • Bot probe, honeypot, canary
  • • Server & edge logs (operations, security)
  • No visitor analytics, no cookies
  • Basis: legitimate interest (Art. 6.1.f), our assessment

Analytics consent

Cookieless or Full mode

  • • Page views, pages, referrers, AI referrals
  • • Sessions
  • • Clicks, scroll depth, heatmaps
  • • Forms, e-commerce, conversions
  • Basis: consent (Art. 6.1.a)

Marketing consent

Full mode only

  • • Ad click IDs (gclid etc.)
  • • Conversion feedback to ad platforms
  • Basis: consent (Art. 6.1.a)