Last updated: March 24, 2026
HX OS and the CORA platform are operated by:
We collect only the minimum data necessary to provide the platform:
We do not collect: biometric data, health records, neural data (as defined by California SB 1223), sensitive demographic tracking, or customer personal records from your own customer base.
SB 1223 Notice (California): HX OS does not collect, process, or store "neural data" — information generated by measuring activity of the central or peripheral nervous system. This policy explicitly excludes neural data from all processing activities.
| Processing activity | Legal basis |
|---|---|
| Account creation and service delivery | Contract performance (Art. 7 LGPD / Art. 6(b) GDPR) |
| Billing and payment | Contract performance + legal obligation |
| Platform analytics and improvement | Legitimate interest (Art. 7 LGPD / Art. 6(f) GDPR) |
| Marketing communications | Consent (Art. 7 LGPD / Art. 6(a) GDPR) |
| Legal compliance and audit logs | Legal obligation (Art. 7 LGPD / Art. 6(c) GDPR) |
We do not sell personal data to third parties. This applies under CCPA, LGPD, and all other applicable regulations.
We retain personal data for as long as your account is active. Upon account deletion:
HX OS operates on infrastructure provided by Base44 (cloud infrastructure). Data may be processed in servers located in the United States and/or European Union. All transfers comply with applicable data protection law:
Regardless of your location, you have the following rights:
| Right | Description |
|---|---|
| Access | Request a copy of your personal data |
| Correction | Correct inaccurate or incomplete data |
| Deletion | Request deletion of your personal data (right to erasure / right to be forgotten) |
| Portability | Export your data in a machine-readable format |
| Objection | Object to processing based on legitimate interest |
| Restriction | Request temporary restriction of processing |
| Withdraw consent | Withdraw consent for consent-based processing at any time |
To exercise any of these rights, contact: privacy@coracodex.xyz. We respond within 15 business days.
You may also exercise rights directly from your account settings under Privacy Dashboard.
We use essential cookies required to operate the platform, and optional analytics cookies. You can manage cookie preferences at any time. See our Cookie Policy for details.
We implement industry-standard technical and organizational security measures including:
In the event of a data breach affecting your rights, we will notify affected users within 72 hours of becoming aware, in accordance with GDPR Art. 33 and LGPD Art. 48.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
We do not sell personal information to third parties. To submit a CCPA request, email privacy@coracodex.xyz.
This policy complies with Lei Geral de Proteção de Dados (Law 13.709/2018). The Data Controller is identified in Section 1. Our Data Protection Officer (DPO) is reachable at privacy@coracodex.xyz.
You may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.
For users in Singapore (PDPA), Australia (Privacy Act 1988), Japan (APPI), and South Korea (PIPA), equivalent data protection rights apply. Contact privacy@coracodex.xyz to exercise your regional rights.
| Processor | Purpose | Location |
|---|---|---|
| Stripe | Payment processing | USA / EU |
| Base44 | Platform infrastructure, database | USA / EU |
| Google (Analytics) | Anonymous usage analytics | USA |
All processors are bound by Data Processing Agreements meeting GDPR Article 28 standards.
We may update this Privacy Policy. Material changes will be communicated by email and posted on this page with an updated "Last updated" date. Continued use of HX OS after changes constitutes acceptance.