Privacy Policy

01Data we collect#

Account data: your email address and, if you sign in with Google, your basic OAuth identity. Authentication data: session records and tokens.

Service data: API keys (stored only as hashes), top-up records, and request metadata: timestamps, model called, token counts, status, cost.

Technical data: IP address and similar signals used for security, rate limiting, and abuse prevention.

02Prompt & response content#

To fulfil a request, the content you send is transmitted to the model provider serving that model. We act as a pass-through.

We do not use your prompt or output content to train our own models, and we do not sell it.

Do not submit personal or confidential data you are not authorized to share.

03Basis & purposes of processing#

We process data to run and secure the service, authenticate you, meter usage, operate credits, prevent abuse and fraud, provide support, and meet legal obligations.

Our legal bases: performing our contract with you, our legitimate interest in operating a secure service, and compliance with law, in line with UU PDP.

04Sharing & subprocessors#

Data is shared only with providers who process it on our behalf: the model providers serving your requests, hosting and infrastructure providers, and the payment providers we engage to process top-ups.

We may disclose data where required by law or to protect rights, users, or the security of the service. We do not sell personal data.

05Security#

We apply technical and organizational safeguards: API key hashing, encrypted transport, access controls, and audit logging of administrative actions. No system is perfectly secure, but we are committed to protecting your data and responding to incidents.

06Data retention#

Personal data is kept only as long as needed for the purposes in this policy or as required by law. Account data is retained while your account is active; request logs and usage records are kept for a reasonable operational period, then deleted or aggregated.

07Your rights#

Under UU PDP you may request access to, correction of, or deletion of your personal data, and object to or restrict certain processing. Contact us at support@cosmosin.io to exercise your rights. We may need to verify your identity first.

08International transfers#

Because the model providers and infrastructure we rely on may operate outside Indonesia, your data may be processed in other countries. Where we transfer data internationally, we take steps to ensure an appropriate level of protection under applicable law.

09Children#

CosmosIn is not directed to individuals under 18, and we do not knowingly collect their personal data. If you believe a minor has provided us data, contact us at support@cosmosin.io so we can address it.

10Changes to this Policy#

We may update this Policy from time to time; the date above will change, and for material changes we will provide notice where appropriate.