Legal
Privacy Policy
The short version
- We collect as little as we can, and we keep it in the EU.
- This website uses no cookies, no analytics and no tracking pixels. Fonts are served from our own server.
- We never sell your data and never use it to train AI models.
- You can see, export or delete your data at any time by writing to privacy@kosmly.com.
1. Who we are
The data controller is Kosmly Ltd, a company registered in England and Wales (company no. [number]), registered office [address], VAT [GB number] ("Kosmly", "we"). Contact: privacy@kosmly.com. Data Protection Officer: [name and contact, if appointed].
We are registered with the UK Information Commissioner's Office (ICO), registration number [ZA000000]. Because we serve people in the European Union, our representative in the EU under Article 27 of the EU GDPR is [name, address in an EU country, email].
We process personal data under the UK GDPR and the Data Protection Act 2018 and, for people in the EU and EEA, under the EU GDPR (Regulation 2016/679). In this policy "GDPR" means both.
2. What this policy covers
This policy covers kosmly.com, the Kosmly waitlist, and the accounts of merchants who use Kosmly. When our agents process data about your store's customers, you are the controller and we act as your processor. That processing is governed by our Data Processing Agreement, not by this policy.
3. What we collect, why, and for how long
| Purpose | Data | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Waitlist and launch news | Email address, date and proof of double opt-in | Consent, Art. 6(1)(a) | Until you unsubscribe, or 12 months after public launch |
| Your Kosmly account | Name, email, store URL, platform, plan, settings | Contract, Art. 6(1)(b) | For the life of the account, then 30 days |
| Billing and invoices | Company details, VAT number, invoices | Legal obligation, Art. 6(1)(c) | 6 years, as required by UK tax law (HMRC) |
| Account emails (welcome, proposals waiting, plan and usage notices, incidents) | Name, email, language, store URL | Contract, Art. 6(1)(b) | For the life of the account |
| Onboarding tips (days 1, 3 and 7 after sign-up) | Name, email, language | Legitimate interest, Art. 6(1)(f); one-click opt-out in every email | Until you opt out or close the account |
| Brand Scan of your website | Public pages of your site (contact details are masked before analysis) | Contract, Art. 6(1)(b) | For the life of the account |
| Support requests | Messages and attachments you send us | Contract or legitimate interest, Art. 6(1)(b)/(f) | 24 months after the request is closed |
| Security of the website and service | IP address, browser, time of request | Legitimate interest, Art. 6(1)(f) | 30 days |
4. Cookies
kosmly.com sets no cookies and loads nothing from third-party servers, so no cookie banner is needed. If we ever add analytics, we will use a cookie-free, EU-hosted tool or ask for your consent first, and we will update this page.
5. Who we share data with
Only with service providers that help us run Kosmly, under a written data processing agreement, and only for the purposes above:
- Brevo (Sendinblue SAS, France): waitlist and account emails.
- Scaleway SAS (Paris, France): application hosting, database and backups.
- Amazon Web Services EMEA SARL (Frankfurt, Germany) and Mistral AI SAS (France): AI models that run the agents, inside the EU, with no training on your data.
- Paddle.com Market Ltd (United Kingdom): our reseller for online payments. Paddle sells the subscription to you as merchant of record, handles payment details and VAT and acts as an independent controller under its own privacy policy. We never see your full card details.
- The app marketplaces (Shopify, WordPress.org, PrestaShop Addons) when you install or buy through them.
The full, current list is in our sub-processor list. We never sell personal data.
6. Where your data is stored
We store and process data in the European Union. Our company is in the United Kingdom, which the EU recognises as providing adequate protection, and the UK recognises the EU in the same way, so data can move between them lawfully. If a provider ever needs to access data from another country, we only allow it under an adequacy decision (such as the EU-US Data Privacy Framework and its UK Extension), the European Commission's Standard Contractual Clauses or the UK International Data Transfer Agreement or Addendum, with a transfer risk assessment.
7. Artificial intelligence
We do not use your personal data, or your customers' data, to train AI models, and our AI providers are contractually barred from doing so. Kosmly does not make decisions about individuals that have legal or similarly significant effects (GDPR Art. 22). Read more in our AI transparency statement.
8. Your rights
You can ask us to access, correct, delete, restrict or export your data, object to processing based on legitimate interest, and withdraw consent at any time (every email has a one-click unsubscribe link). Write to privacy@kosmly.com. We answer within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or, if you are in the EU, to the data protection authority in your country (in Italy, the Garante).
9. Security
Encryption in transit and at rest, access on a need-to-know basis with two-factor authentication, audit logs, regular backups and a tested data breach procedure. Details are in Annex II of the DPA.
10. Changes
If we change this policy in a way that matters, we will tell you by email before the change applies. The date at the top always shows the latest version.