Privacy Policy

1. Introduction

Welcome to Cosmos ("we," "our," or "us"), operated by Cosmos Technologies Inc. We are committed to protecting the privacy and security of your business data, team information, and client details. This Privacy Policy explains how we collect, use, process, and safeguard your personal and commercial data across our platform, website, and related services.

2. Information We Collect

We adhere to the principle of data minimization and collect only the data necessary to provide professional B2B invoicing, project milestone management, digital contracting, and secure client portal access:

• Account & Workspace Identity: First and last name, email address, corporate legal business name, billing address, tax identification numbers (VAT, GSTIN, PAN, EIN), phone number, company logos, and payout bank account details.
• Client Records: Contact person, company name, billing address, client email address, telephone number, and tax identification for clients you onboard.
• Invoicing, Expenses & Contracts: Project milestones, deliverables, billing items, payment receipts, bank transfer references, e-signature timestamps, signer IP logs, and cryptographic document hashes.
• Technical & Audit Data: Login timestamps, browser metadata, hashed authentication tokens, and platform audit trail logs.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or UK, our legal bases for collecting and processing your personal data include:

• Performance of a Contract: Processing necessary to provide our invoicing software, manage your workspace, and honor our service agreements.
• Legitimate Interests: Improving platform reliability, preventing fraudulent account creation, ensuring network security, and communicating essential system updates.
• Legal Obligations: Retaining financial transaction records and invoice copies as required by statutory commercial, corporate, and tax legislation.
• Consent: Where you have explicitly opted into marketing updates or waitlist notifications (which you may revoke anytime).

4. Third-Party Sub-Processors

We partner with select, enterprise-grade cloud sub-processors to deliver core platform services. All sub-processors are bound by strict Data Processing Agreements (DPAs):

• Neon Database: Serverless PostgreSQL database hosting with encryption at rest and in transit.
• Cloudflare R2: Encrypted object storage for generated invoice PDFs, contract archives, and workspace brand assets.
• Resend & Nodemailer: Transactional email delivery for invoice notifications, verification OTPs, and password reset instructions.
• Google OAuth: Optional federated authentication for one-click login.
• Sentry: Real-time application error logging and performance crash diagnostics.
• PostHog: Privacy-preserving aggregated product usage analytics.

5. Cookies & Local Storage

We use strictly necessary cookies for session security (such as HTTP-only refresh tokens and CSRF protection) as well as functional local storage to remember your theme and language preferences. For full details on cookie categories and opt-out options, please review our dedicated Cookie Policy.

6. Security, Encryption & Data Retention

• Encryption: All traffic is encrypted in transit via TLS 1.3. Databases and document storage pools use AES-256 encryption at rest.
• Account Deletion & Data Erasure: When an account or workspace is deleted, personal data is immediately anonymized and sessions are terminated. Background cleanup cascades remove orphaned files within a 30-day grace schedule.
• Statutory Retention: In compliance with global tax and financial record-keeping laws, issued invoices and payment ledgers may be preserved in anonymized archive formats for the statutory accounting period required by local jurisdictions.

7. Your Rights (GDPR & CCPA/CPRA)

Depending on your jurisdiction, you have the following privacy rights:

• Right of Access & Portability: Request an export of your stored business and billing records.
• Right to Rectification: Update inaccurate business, client, or profile details in your workspace settings.
• Right to Erasure ("Right to be Forgotten"): Permanently delete your user account or workspace via Settings or via our Support Center.
• Right to Restrict or Object to Processing: Opt out of non-essential communications or marketing updates with a single click.
• Non-Discrimination (CCPA): We will never discriminate against you or degrade your service for exercising your privacy rights.

8. Children's Privacy & Age Restrictions (COPPA)

Cosmos is a commercial B2B platform intended exclusively for professional business use. Our services are not directed to children under 18 years of age (or under 16 in the EEA). We do not knowingly collect personal information from children. If you believe a minor has created an account, please notify us via our Support Center for prompt deletion.

9. Contact & Business Entity Details

If you have questions or wish to exercise your data protection rights, please contact our Data Protection Office: