Legal
Privacy Policy
The short version
- We collect as little as we can, and we keep it in the EU.
- This website uses no cookies, no analytics and no tracking pixels. Fonts are served from our own server.
- We never sell your data and never use it to train AI models.
- You can see, export or delete your data at any time by writing to privacy@kosmly.app.
1. Who we are
The data controller is Kosmly Ltd, a company registered in England and Wales (company no. [number]), registered office [address], VAT [GB number] ("Kosmly", "we"). Contact: privacy@kosmly.app. Data Protection Officer: [name and contact, if appointed].
We are registered with the UK Information Commissioner's Office (ICO), registration number [ZA000000]. Because we serve people in the European Union, our representative in the EU under Article 27 of the EU GDPR is [name, address in an EU country, email].
We process personal data under the UK GDPR and the Data Protection Act 2018 and, for people in the EU and EEA, under the EU GDPR (Regulation 2016/679). In this policy "GDPR" means both.
2. What this policy covers
This policy covers kosmly.app, the Kosmly waitlist, and the accounts of merchants who use Kosmly. When our agents process data about your store's customers, you are the controller and we act as your processor. That processing is governed by our Data Processing Agreement, not by this policy.
Visits from AI assistants. When a visitor reaches a store from an AI assistant (for example ChatGPT, Perplexity, Gemini, Copilot or Claude), the Kosmly plugin or app counts the visit: only the day, the assistant and the landing page. No cookie is set, no IP address and no visitor identifier are stored, so this count contains no personal data. The counters are deleted together with the store’s account.
IndexNow. When a page changes, the WordPress plugin and the PrestaShop module tell search engines through IndexNow (api.indexnow.org) by sending only the public address of that page. No personal data is sent.
Google Merchant Center (optional). If a merchant connects their Google Merchant Center account, Orion reads only its price reports: market prices of products, with no personal data. Connecting it is optional and the merchant can disconnect it at any time.
Email deliverability. When an email we send bounces for good or is marked as spam, our email provider (Brevo) tells us and we stop writing to that address. We keep only a hash (SHA-256) of the address and the reason, not the address itself. This is pseudonymised personal data, kept under our legitimate interest in not sending unwanted mail and in respecting objections; we keep it even after an account is deleted, because otherwise we could write to that address again.
3. What we collect, why, and for how long
| Purpose | Data | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Waitlist and launch news | Email address, date and proof of double opt-in | Consent, Art. 6(1)(a) | Until you unsubscribe, or 12 months after public launch |
| Your Kosmly account | Name, email, store URL, platform, plan, settings | Contract, Art. 6(1)(b) | For the life of the account, then 30 days |
| Billing and invoices | Company details, VAT number, invoices | Legal obligation, Art. 6(1)(c) | 6 years, as required by UK tax law (HMRC) |
| Account emails (welcome, proposals waiting, plan and usage notices, incidents) | Name, email, language, store URL | Contract, Art. 6(1)(b) | For the life of the account |
| Onboarding tips (days 1, 3 and 7 after sign-up) | Name, email, language | Legitimate interest, Art. 6(1)(f); one-click opt-out in every email | Until you opt out or close the account |
| Brand Scan of your website | Public pages of your site (contact details are masked before analysis) | Contract, Art. 6(1)(b) | For the life of the account |
| Support requests | Messages and attachments you send us | Contract or legitimate interest, Art. 6(1)(b)/(f) | 24 months after the request is closed |
| Security of the website and service | IP address, browser, time of request | Legitimate interest, Art. 6(1)(f) | 30 days |
| Service records (sign-in sessions, emails sent, AI usage, history of actions) | Session and link tokens, email address and subject, model, tokens and cost of each AI call (no text), who did what and when | Contract and legitimate interest, Art. 6(1)(b)/(f) | Expired sessions and links 1 day; emails 90 days; AI usage 90 days in detail, then monthly totals for 13 months; action history and audit log 24 months |
4. Cookies
kosmly.app sets no cookies and loads nothing from third-party servers, so no cookie banner is needed. If we ever add analytics, we will use a cookie-free, EU-hosted tool or ask for your consent first, and we will update this page.
5. Who we share data with
Only with service providers that help us run Kosmly, under a written data processing agreement, and only for the purposes above:
- Brevo (Sendinblue SAS, France): waitlist and account emails.
- Scaleway SAS (Paris, France): application hosting, database and backups.
- Amazon Web Services EMEA SARL (Frankfurt, Germany), Google Cloud EMEA Limited (Vertex AI, EU regions), Microsoft Ireland Operations Limited (Azure OpenAI, Paris), Mistral AI SAS (France) and Scaleway SAS (Paris): AI models that run the agents, inside the EU, with no training on your data. Requesty Ltd routes the calls to them through its Frankfurt endpoint.
- DataForSEO OU (Estonia): search data, receiving only keywords and domains. Cloudflare, Inc.: DNS and hosting of this website.
- Paddle.com Market Ltd (United Kingdom): our reseller for online payments. Paddle sells the subscription to you as merchant of record, handles payment details and VAT and acts as an independent controller under its own privacy policy. We never see your full card details.
- The app marketplaces (Shopify, WordPress.org, PrestaShop Addons) when you install or buy through them.
The full, current list is in our sub-processor list. We never sell personal data.
6. Where your data is stored
We store and process data in the European Union. Our company is in the United Kingdom, which the EU recognises as providing adequate protection, and the UK recognises the EU in the same way, so data can move between them lawfully. If a provider ever needs to access data from another country, we only allow it under an adequacy decision (such as the EU-US Data Privacy Framework and its UK Extension), the European Commission's Standard Contractual Clauses or the UK International Data Transfer Agreement or Addendum, with a transfer risk assessment.
7. Artificial intelligence
We do not use your personal data, or your customers' data, to train AI models, and our AI providers are contractually barred from doing so. Kosmly does not make decisions about individuals that have legal or similarly significant effects (GDPR Art. 22). Read more in our AI transparency statement.
8. Your rights
You can ask us to access, correct, delete, restrict or export your data, object to processing based on legitimate interest, and withdraw consent at any time (every email has a one-click unsubscribe link). Write to privacy@kosmly.app. We answer within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or, if you are in the EU, to the data protection authority in your country (in Italy, the Garante).
9. Security
Encryption in transit and at rest, access on a need-to-know basis with two-factor authentication, audit logs, encrypted backups in two EU locations (France and the Netherlands) with a monthly restore test, and a tested data breach procedure. Backups are kept at most 35 days: data you delete is gone from every backup within 35 days. Details are in Annex II of the DPA.
10. Changes
If we change this policy in a way that matters, we will tell you by email before the change applies. The date at the top always shows the latest version.