The short version
- We collect what Kosmo needs to work: your account, your conversations and prompts, and usage events that never include your text.
- We do not sell your data, share it for advertising, or use it to train AI models.
- Analytics cookies are used only if you accept them, and you can change your choice at any time.
- When you delete your account it can be restored for 30 days. After that your content is permanently deleted.
A summary for convenience. The full text below is what applies.
This policy explains what personal data Kosmo collects, why, who receives it, how long we keep it, and the choices and rights you have. It applies to askkosmo.com and the Kosmo app.
1Who is responsible
Kosmo is run by Harshal Dorlikar, an individual based in India, who decides how your personal data is used (the "controller" under the GDPR and the "data fiduciary" under India's Digital Personal Data Protection Act).
Contact for anything in this policy: legal@askkosmo.com. Grievance officer: Harshal Dorlikar (see section 13).
2What we collect
Account details. Your email address, and your name and profile picture if you sign in with Google or another provider. Collected when you sign up, through our sign-in provider.
What you give Kosmo. Your messages, your answers to Kosmo's questions, the prompts Kosmo writes for you, the ideas you save, and the names of your threads. Please do not include other people's personal data or sensitive information (such as health data) unless you need to.
Usage information. Events such as "a compile completed" or "the paywall was shown", with details like the tool you are writing for, how long a step took and error codes. These records never include the text you typed or the prompts produced. We also keep server logs (IP address, browser type, requests) for security and to fix problems.
Analytics (only if you accept). If you click Accept on the cookie banner, our analytics provider, PostHog, records which pages you visit, the product events above and reports of errors on the website (the error message and the page it happened on), linked to your account ID and your plan. If you decline, PostHog records the same things anonymously, without storing anything on your device and without identifying you across visits.
Payments. When you buy credits or a plan, Razorpay or Lemon Squeezy collects your payment details. We receive only what we need to give you your credits: what you bought, the amount, the currency, the status and a reference. We never see or store your full card number.
Waitlist. If you join our waitlist, your email address (and your name, if you give it), used only to tell you when you can start using Kosmo.
Emails with us. If you email us, we keep that conversation.
We do not collect data from children (section 10), and we do not buy data about you from other sources.
3How we use it, and our legal basis
| What we do | Data used | Legal basis (EU/UK GDPR) |
|---|---|---|
| Create and run your account, sign you in | Account details | Performing our contract with you |
| Turn your requests into prompts, keep your history and ideas | What you give Kosmo | Performing our contract with you |
| Sell and deliver credits and plans, send receipts | Payments, email | Performing our contract; legal obligation (tax records) |
| Tell you about important changes and new versions of Kosmo | Our legitimate interest; you can unsubscribe from any update email | |
| Keep the Service secure, prevent abuse and fraud, fix errors | Usage information, server logs | Our legitimate interest in a secure, working service |
| Understand which features help, measured by usage events on our own servers | Usage information | Our legitimate interest in improving Kosmo |
| Browser analytics with PostHog cookies | Analytics | Your consent (you can withdraw it at any time) |
| Anonymous analytics when you decline cookies, with nothing stored on your device | Analytics, not linked to you | Our legitimate interest in understanding how Kosmo is used |
| Answer you when you contact us | Emails with us | Our legitimate interest; performing our contract |
| Meet legal duties (tax, accounting, lawful requests) | As required | Legal obligation |
Under India's DPDP Act, we process your data with your consent, given when you sign up and when you accept analytics, and for the legitimate uses the Act allows.
We do not sell your personal data, we do not share it for advertising, and we do not use your content to train AI models. Kosmo makes no decisions about you with legal or similarly significant effects.
4Who receives your data
We share personal data only with the providers that run Kosmo for us, under contracts that require them to protect it and use it only on our instructions.
| Who | What it receives | Where it processes data |
|---|---|---|
| Our sign-in provider | Account details, sign-in sessions | United States |
| Our database provider | Your account, content, credits and usage records | Mumbai, India |
| Our hosting provider | All web traffic and server logs | United States |
| AI model providers | Your messages and requests, to generate Kosmo's replies and prompts | Data centres that may be outside your country, including the United States |
| Search and documentation services | Search queries derived from your request, never your account details | United States |
| Our email provider | Your email address, receipts and update emails | United States |
| Razorpay | Payment details for purchases in Indian rupees | India |
| Lemon Squeezy (seller of record for other currencies) | Payment and billing details | United States |
| PostHog (analytics) | Page views, product events and error reports; your account ID and plan only after you accept | European Union |
We use AI providers only under business terms that do not allow them to use your data to train or improve their models. They may keep a request for up to 30 days to detect abuse, and may hold it in memory for up to 24 hours to answer faster. When Kosmo searches the web, the search provider may keep the query, not linked to you or to us, for up to 3 days.
You can ask us at legal@askkosmo.com for the current list of the providers we use and where each one processes data.
We may also disclose data if the law requires it, to protect people's safety or our rights, or to a business that takes over Kosmo (you will be told first).
5International transfers
Kosmo is run from India, and some providers process data in the United States and elsewhere. Where the law of your country requires a safeguard for this:
- for providers in the United States, we rely on the EU-US Data Privacy Framework and its UK Extension where the provider is certified, and on the European Commission's standard contractual clauses (with the UK addendum) in our agreements with them;
- PostHog processes analytics data in the European Union.
You can ask us for more detail about the safeguard used for any provider.
6How long we keep it
| Data | How long |
|---|---|
| Account details, your content (chats, prompts, ideas, thread names) | While your account is open. When you delete your account, it can be restored for 30 days; after that this data is permanently deleted. You can delete individual chats at any time from the sidebar. Saved ideas can be archived in the app; to have one deleted, email us. |
| Usage records | While useful for running and improving Kosmo. When your account is deleted, they are no longer linked to you. |
| Payment and billing records | As long as tax and accounting law requires. They are kept after account deletion, with your email removed. |
| Server logs | A short period set by our hosting provider, for security and troubleshooting. |
| PostHog analytics | Up to 12 months, and deleted sooner when you delete your account. |
| Support emails | As long as needed to help you, then deleted. |
| Backups | Deleted data leaves our database backups within 7 days. |
If you want your data deleted straight away, without the 30-day restore window, email legal@askkosmo.com and we will do it.
8Your rights
Wherever you are, you can ask us to:
- give you a copy of your personal data;
- correct data that is wrong;
- delete your data (in-app for your account, or by email);
- stop or limit certain uses, and object to uses based on our legitimate interests;
- give you your content in a portable format;
- withdraw consent (for example to analytics) at any time, without affecting what happened before.
Email legal@askkosmo.com. We may need to confirm it is you. We answer within one month (India: within the times the DPDP Act and its Rules set). We will not treat you differently for using your rights.
9Security
Your data is encrypted in transit and at rest by our providers, access to it is limited to what is needed to run Kosmo, and database access is restricted per user. No service can promise perfect security; if a breach affects your personal data, we will tell you and the authorities as the law requires.
10Children
Kosmo is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, email legal@askkosmo.com and we will delete it.
11Region-specific information
European Union and United Kingdom. You can complain to your local data protection authority (in the UK, the Information Commissioner's Office), though we would like the chance to help first.
India. You also have the right to nominate someone to exercise your rights if you die or become unable to, and the right to complain to the Data Protection Board of India after using our grievance process.
United States, including California. We collect the categories of data in section 2 for the purposes in section 3. We do not sell or share personal information, as those terms are defined in California law, and we do not use or disclose sensitive personal information for inferring characteristics about you. You can use the rights in section 8.
Brazil. You have the rights in Article 18 of the LGPD; contact us at legal@askkosmo.com.
12Changes to this policy
When we make a material change, we will tell you by email or in the app before it takes effect. The date at the top shows the latest version.
13Contact and grievance officer
Grievance officer: Harshal Dorlikar, founder, Kosmo
Email: legal@askkosmo.com
Address: Nagpur, Maharashtra, India
We acknowledge privacy complaints within 48 hours and resolve them as quickly as we can, and in any case within the time the law allows.
Questions about this policy?
Write to us and we will reply. We acknowledge every message within 48 hours.