Home / Privacy
Privacy Policy
What Plant Cortex collects, why, who else touches it, and how to have it removed. Effective October 17, 2026, updated October 24, 2026.
Plant Cortex ("we", "us") provides a question-and-answer and operations app for industrial plants, as a website (app.plantcortex.ai) and an Android app (ai.plantcortex.app). It is a business tool: accounts are created for people who work at a plant or are invited to a pilot. Questions about this policy: gaurav@plantcortex.ai. We are based in Hartford, Connecticut, USA.
1. What we collect
Account details. Username, email address, and optionally your full name, phone number and job designation. Your password is stored only as a salted hash, never in readable form. If you turn on two-step login, we store the secret needed to check your codes.
What you enter in the app. Questions you ask, the answers you receive, and records you create: work permits, near-miss reports, downtime and stoppage logs, shift logs, spare-parts stock, purchase requests, checklists and their results, comments and notes. Each record is tied to your account and the time it was made.
Photos and documents. Only photos you choose to take or attach (for example to a near-miss report or a checklist step) and documents you upload for analysis. The app asks your permission to use the camera or photo library, and only when you use those features. Photos are reduced in size on your phone before they are sent. A document you upload for analysis is read to answer your question and is not saved. Its text is sent to our AI model provider to produce the answer, so please do not upload anything confidential.
App error reports. If the phone app breaks, it sends a short report to our own server: the time, the app version, the phone type and operating system version, which screen you were on, and the error text. It contains no names, emails or plant records, and it carries a random code for the installation that we store only in scrambled (hashed) form, so we can tell whether one phone or many are affected. Reports are kept for 30 days and are never shared with an outside service.
Device and sign-in information. When you sign in we record the device name you give or your browser type, the IP address, and when the device was last used, so you can see and sign out your own devices and so we can detect misuse. We keep a security log of sign-ins, failed attempts, password changes and similar events.
Notification token. If you allow notifications on the Android app, Google Firebase Cloud Messaging gives your phone an identifier (a token) that we store so we can send you alerts.
On your phone. To work without signal, the app keeps an encrypted copy of lists you have viewed, manual text you downloaded, and actions waiting to be sent. Signing out removes this data from the phone.
What we do not collect. We do not collect your location, contacts, or advertising identifier. We do not run advertising or sell personal information, and there are no third-party advertising or analytics trackers in the app.
2. How we use it
- To answer your questions from your plant's own manuals and show where each answer came from.
- To run the registers (permits, near-misses, downtime, shift logs and so on) for your plant, including showing records to the colleagues your plant authorises.
- To send account emails (verification, password reset) and, if you opt in, daily or weekly summaries.
- To send alerts you have allowed, such as a high-severity near-miss.
- To keep the service secure, prevent abuse and fix problems.
We do not use your records or questions to train AI models.
3. Who else handles data
We use a small number of service providers, only to run the service:
- Oracle Cloud Infrastructure (United States): hosts the servers and database.
- An AI model provider, accessed through OpenRouter: when you ask a question, the question and the relevant manual excerpts are sent to a language model to write the answer. Do not put personal or confidential information that is not needed for the work into questions. The provider processes the request under its own terms.
- Zoho Mail: sends our emails to you.
- Google Firebase Cloud Messaging: delivers notifications to Android phones.
Within a plant, records you create can be seen by other users of that plant according to their role (for example, near-miss reports are visible to colleagues unless you mark yours anonymous, in which case your name is hidden from other users but not from administrators). We may disclose information if the law requires it, or to protect people from harm.
4. Security
Traffic is encrypted in transit (HTTPS). Sign-in tokens are stored hashed, passwords are hashed with a slow algorithm, repeated failed logins are blocked, and administrators can use two-step login. The phone app encrypts its local database. No system is perfectly secure, but we treat plant data as sensitive and review our security regularly.
5. How long we keep it
Records are kept while your plant's account is active, because permits, incidents and logs are safety and audit records. Sign-in sessions expire after a period of inactivity. When an account is deleted, its personal profile is removed; records that form part of a plant's safety log may be kept without your name where the plant needs them.
6. Your choices and rights
- See and edit your profile, change your password, and sign out any device in Settings (Me tab in the phone app).
- Turn notifications and summary emails on or off in Settings.
- Ask us to access, correct or delete your personal information by emailing gaurav@plantcortex.ai from your account email. We will respond within 30 days. You can also ask your plant's administrator to delete your account.
- Depending on where you live (for example California), you may have additional rights under local privacy law. We honour them on request. We do not sell or share personal information for advertising.
7. Children
Plant Cortex is a workplace tool for adults. It is not directed to anyone under 16 and we do not knowingly collect their information.
8. Changes
If we change this policy in a meaningful way we will update the date above and, for significant changes, tell account holders by email or in the app.
9. Contact
Plant Cortex, Hartford, CT, USA ยท gaurav@plantcortex.ai