This policy describes how Cortado Group (“Cortado”, “we”) collects, uses, and protects information through the Portfolio Intelligence platform (the “Service”) and this website.
Information we collect
We collect three kinds of information:
- Account information you or your organization provide when a teammate is invited to the Service — name, work email, and role.
- Portfolio data synced from your CRM. When you connect Salesforce, HubSpot, or another supported CRM, we import account, contact, and opportunity records under your organization’s authorization so the Service can compute cross-sell overlap, ICP overlap, and related analytics. We never request or store your CRM username/password — connections use OAuth, and the resulting access tokens are encrypted at rest.
- Usage and analytics data from the public marketing pages and blog only (never from the authenticated application) — see our Cookie Policy for what’s collected and how to opt out.
How we use information
We use the information above to operate and improve the Service: to compute the analytics you request, to authenticate teammates, to send transactional email (e.g. invite links), and to understand how the public site is used. We do not use portfolio CRM data to train any model shared across customers, and we do not sell personal information.
Who we share it with
We share data only with the sub-processors needed to run the Service — our hosting provider, and Resend for transactional email — each bound by its own confidentiality and data-protection terms. CRM data is never shared between portfolio companies or customer organizations; every account is scoped to a single tenant.
Data retention
CRM data and account records are retained for as long as your organization’s subscription is active, and deleted (or anonymized) within 90 days of a written request to disconnect an integration or close an account.
Your rights
You can request a copy of, or the deletion of, data associated with your account by emailing team@cortadogroup.ai. Teammates can disconnect a CRM integration at any time from Settings, which stops further syncing and deletes the stored access token.
Security
CRM OAuth tokens are encrypted at rest, sessions use HTTP-only cookies, and all traffic is served over HTTPS. See our Cookie Policy for cookie-specific details.
Changes to this policy
If we make material changes to this policy, we’ll update the date at the top of this page and, where appropriate, notify account admins by email.
Contact
Questions about this policy: team@cortadogroup.ai.