At COSMOS-X, your privacy is a core priority. This Privacy Policy explains how COSMOS-X Technology OÜ, acting as the Data Controller, collects, uses, and protects your personal information when you use our AI productivity workspace — AI chat and voice assistants, tasks, notes, boards, documents, calendar, mindmaps, direct messages, flows — and related services.
Name, email address, and credentials. For third-party logins (Google, GitHub), we collect your unique ID and profile picture URL.
Content you create in the Service: AI chat conversations (text inputs, file uploads, and AI-generated outputs), notes, tasks, boards, documents, calendar entries, mindmaps, flow configurations, and direct messages / channel messages you exchange with other users. This content is stored securely to provide you with history and continuity.
If you use voice features, your audio is processed by our AI providers to generate transcripts and responses. Transcripts are stored as part of your conversation history.
IP address, browser type, device identifiers, and interaction logs (timestamps, features used). We also collect first-party product analytics (which features are used — event metadata only, never the content of your conversations or documents), aggregate performance metrics (web vitals), and error reports.
Handled exclusively by Stripe, Inc. We do not store credit card numbers. We only receive confirmation of payment and metadata (e.g., last 4 digits) for billing support. If you participate in our referral program, payout onboarding (identity and bank details) is handled by Stripe Connect; we do not store those details.
If you choose to connect an optional integration (e.g., Telegram or Zapier), we process the account identifiers and message/action content needed to operate that integration. Data you send through an integration is also subject to that provider's own privacy policy.
Under the GDPR, we process your data based on the following:
To provide the Service — your workspace, conversations, and wallet.
To prevent fraud, ensure network security, and improve our platform's performance and features through the aggregate analytics described above.
To retain accounting and tax records as required by Estonian law.
For marketing communications and optional integrations you choose to connect. You can withdraw consent at any time.
We do not sell your data. We share data with the following categories of processors, only to the extent needed to provide the Service:
Your prompts (and, for voice features, audio) are sent to the AI provider serving your request in order to generate a response: OpenAI, Anthropic, Google, Groq, xAI, Perplexity, OpenRouter, Cerebras, Fireworks AI, DeepInfra, Baseten, and SambaNova. Web-search features send your search queries to Tavily and Perplexity. We use API tiers whose terms exclude this data from being used to train the providers' public models.
Vercel (hosting and cookie-free web analytics), Neon (database), Cloudflare R2 (file storage), Upstash (job queues and caching), Ably (real-time messaging delivery), and E2B (isolated sandboxes for code-execution features).
Clerk (authentication), Stripe (payments and referral payouts), and Resend (transactional email).
Telegram and Zapier, only if you connect them.
We may disclose data to Estonian or EU authorities if legally mandated.
Some of the processors listed above are located in, or process data in, the United States and other countries outside the European Economic Area. Where data leaves the EEA, we rely on the safeguards required by Chapter V of the GDPR: an adequacy decision (including the EU–U.S. Data Privacy Framework for certified providers) or the European Commission's Standard Contractual Clauses, together with data processing agreements with each provider.
Your conversations are NOT used to train our models or third-party models. We use API tiers whose terms exclude customer content from provider model training.
We use only strictly necessary cookies: authentication/session cookies (set by Clerk) and payment security cookies (set by Stripe during checkout). We do not use advertising or cross-site tracking cookies. Our web analytics (Vercel Analytics) is cookie-free. If we ever introduce non-essential cookies, we will ask for your consent first.
We employ "Security by Design" principles:
TLS 1.3 for data in transit and AES-256 for data at rest.
Strict internal "least-privilege" access for our developers and administrators.
You can view, correct, or delete your personal data and account at any time.
You can ask us to restrict processing of your data while a dispute about it is resolved.
You can request a machine-readable export of the personal data you have provided to us by contacting us; we will provide it within the GDPR's statutory deadline.
You can object to processing based on our legitimate interests.
Where processing is based on consent (e.g., marketing), you can withdraw it at any time without affecting prior processing.
To exercise these rights, contact our Data Protection team at support@cosmosx.ai. We respond within one month.
Retained as long as your account is active.
Product analytics events and error reports are retained for 90 days; only aggregate statistics (which contain no personal content) are kept longer.
Retained for 7 years to comply with Estonian accounting and tax laws.
Data is purged from our active systems within 30 days of a deletion request. Residual copies in encrypted backups expire within our backup retention window (currently 7 days).
The Service is not directed at, and may not be used by, anyone under 18 years of age. We do not knowingly collect personal data from minors; if we learn that we have, we will delete it.
We may update this Privacy Policy from time to time. For material changes we will notify you by email or in-app notice before the changes take effect. The "Last Updated" date above always reflects the current version.
If you believe we have infringed upon your privacy rights, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). Website: www.aki.ee
Questions about our privacy practices?
Contact us at support@cosmosx.ai