How Cortena handles your data.

Account and identity data: name, work email, company details, role, authentication information, and session data when you sign in (including via Google, Microsoft, email magic link, or other supported identity providers).

Customer content you provide or connect: invoices and related PDFs or documents, supplier and payment details needed for bookkeeping, bank and accounting connection data when you enable an integration, and messages you send to support or our forms.

Technical and security data: IP address, browser and device information, application logs, and diagnostic events needed to run, secure, and troubleshoot the service.

We do not sell personal data. We do not use your finance content for advertising.

We use personal data to provide and operate Cortena, authenticate users, process invoices and related finance workflows, support integrations you enable, keep the service secure, meet legal and bookkeeping obligations, and respond to support requests.

Customer content is processed to deliver the features you use (capture, coding, approvals, reconciliation, exports to your ledger, and related workflows). Where AI features help prepare bookings or extract fields, they operate on data needed for that purpose inside the Cortena product.

We limit use of product user data to providing, securing, and improving Cortena. We do not use that data for unrelated profiling or ads.

Cortena product data (accounts, invoices, documents, and related records) is stored on Cortena systems hosted in the European Union, including application databases and object storage for documents such as invoice PDFs.

Data in transit to Cortena services is transmitted over HTTPS. Access is controlled by authentication, tenant permissions, and operational access controls.

We share personal data only as needed to provide Cortena: with subprocessors that host or operate parts of the service (for example EU cloud hosting, email delivery, error monitoring), and with third-party integrations you connect (for example accounting, banking, or expense tools) when you enable those connections.

We may disclose data if required by law, to protect against abuse or security threats, or in connection with a merger or acquisition with appropriate notice where required.

We do not sell personal data to data brokers or advertising platforms.

A current subprocessors list is published publicly. A data processing agreement is available from compliance@cortena.ai.

We keep account and product data while your account is active and as needed for legal, tax, and bookkeeping retention (including GoBD where applicable).

On request and where the law allows, we delete or return customer data according to your agreement and applicable retention rules.

When you click Sync invoices: invoice PDF files downloaded from the billing provider and uploaded to Cortena Payables for your selected tenant.

When you click Report invoice page: page URL, title, and a sanitized HTML snapshot (scripts and inline event handlers removed), plus capture diagnostics needed to review the page. This happens only when you explicitly report a page.

On matching billing pages: invoice numbers used to show sync status. Locally cached extraction rules, synced invoice numbers, and tenant preferences in browser extension storage.

We do not capture full page DOM content unless you click Report invoice page. We do not track browsing history outside the extension's disclosed billing-sync purpose. We do not sell extension user data or use it for advertising.

Synced PDFs are handled as invoice intake in Cortena Payables under your tenant permissions, so the invoices appear in your Cortena workspace.

Site reports are handled by Cortena only to review unsupported billing portals and to build or maintain extraction rules.

The extension periodically downloads signed extraction-rule configuration from Cortena. Rules are declarative configuration, not remote executable code, and do not include personal data in the rules request itself.

Permissions such as storage, tabs, scripting, alarms, activeTab, and webNavigation (and equivalent permissions on other browsers) are used only to operate the disclosed sync and reporting features.

Invoice uploads and site reports from the extension are stored in Cortena EU-hosted systems, alongside your Payables tenant data.

Limited caches live in browser extension storage on your device (for example rules, synced invoice numbers, and tenant preferences). Transmission to Cortena uses HTTPS.

Extension data is shared with Cortena as the provider of Payables so we can process synced invoices and review optional page reports.

It is not sold, not used for advertising, and not shared with advertising platforms or data brokers.

If a synced invoice becomes part of your Cortena workspace, further sharing follows Part 1 (for example integrations you enable).

Synced invoices follow the same retention rules as other Payables documents in Part 1.

Local extension caches can be cleared by removing the extension or clearing extension storage.

Site reports are retained as needed to investigate and improve portal support, then deleted or minimized when no longer required.

Cortena's use of information received from Google APIs and Chrome extension user data adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

User data obtained through Cortena Payables Sync is used only to provide or improve the extension's disclosed single purpose: syncing invoices into Cortena Payables and, when you choose, reporting unsupported billing pages so we can improve extraction support. We do not transfer that data for advertising, credit scoring, or sale to data brokers.