> For the complete documentation index, see [llms.txt](https://docs.kosmoslabs.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.kosmoslabs.ai/legal/privacy-policy.md). # Privacy Policy *Last updated: July 17, 2026 · Effective: July 2026* *** ### 1. Introduction Your privacy is important to us. This policy explains how we handle your data. This Privacy Policy describes how Kosmos AI Labs, Inc. ("Kosmos," "we," "us") collects, uses, and shares personal information when you use our website and Services. ### 2. Information We Collect #### Information You Provide * **Account information:** Name, email address, company name, job title, and professional credentials provided during registration. * **Payment information:** Processed securely by our payment processor; we do not store full payment card details. * **Communications:** When you contact us, request support, or participate in surveys or research. * **System & Telemetry Data:** As part of our INGEST and CORRELATE phases, we process read-only technical logs, API metadata, and system performance metrics you provide to the platform. This data is governed by our Data Processing Agreement and used solely to deliver the Services. #### Information Collected Automatically * **Usage data:** Features used, actions taken, time spent, and interactions with the platform. * **Device and technical information:** Browser type, operating system, IP address, and referral URLs. * **Cookies:** See the "Cookies" section below. ### 3. How We Use Your Information We use your information to: * Provide, maintain, and improve the Services, including executing the preventative intelligence lifecycle (INGEST, CORRELATE, SURFACE, ACT, and LEARN) * Enable API access so you can retrieve your data and integrate the Services with your own systems * Process transactions and send related confirmations * Send technical notices, security alerts, and support messages * Respond to your comments, questions, and requests * Monitor and analyze trends, usage, and performance of the Services * Detect, investigate, and prevent fraudulent, unauthorized, or illegal activity * Train and improve our AI models (in aggregated, anonymized form — see "AI and Model Training" below) * Comply with applicable legal obligations #### AI and Model Training Because the Kosmos platform uses AI and machine learning to deliver preventative intelligence, we adhere to the following principles: * **Purpose limitation:** Customer Data is used solely to deliver the Services to that Customer. * **Anonymization for model improvement:** Where we use operational data to train or improve our general AI models, such data is first aggregated and anonymized so that individual Customer patterns are not identifiable. * **Opt-out:** Customers who do not wish their data to be used for general model training may opt out by contacting us at . * **Automated decisions:** Our platform generates AI-driven Root Cause Analysis (RCA) findings, risk scores, and recommendations. These outputs are informational and are not substitutes for human judgment. We do not make legally or similarly significant decisions about individuals solely by automated means. You retain full control over how you act on AI-generated outputs. ### 4. Data Sharing & Third Parties We do not sell your personal information. We may share information with: * **Service providers:** Third-party vendors who perform services on our behalf (e.g., cloud hosting, analytics, payment processing) solely to operate, support, and improve the Services. These vendors are bound by data processing agreements and may only use your data for specified purposes consistent with this Privacy Policy. * **Professional advisors:** Lawyers, auditors, and consultants under confidentiality obligations, as needed to operate our business. * **Legal compliance:** When required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Kosmos, our users, or the public. * **User-authorized third-party access:** When you use third-party products to access the Services via our API, as described in our API Usage Terms. * **Business transfers:** In connection with a merger, acquisition, financing, reorganization, or sale of all or substantially all of our assets, subject to the acquirer's agreement to honor this Privacy Policy. #### Cookies We use cookies and similar tracking technologies to: * Keep you logged in to the Services * Remember your preferences and settings * Understand how you and others use our Services * Measure the effectiveness of our features and communications * Improve the Services over time For detailed information about the cookies we use and how to manage or opt out of them, see our Cookie Policy. #### Analytics and Experimentation We use analytics tools to understand how visitors interact with our website, measure marketing effectiveness, and run controlled experiments on our pages. These tools process data we collect as a data controller from website visitors and prospects (including email addresses provided on marketing forms), which is distinct from Customer Data processed under our Data Processing Agreement. A current list of analytics tools and third-party processors is available upon request at . You can opt out of analytics cookies at any time via our Cookie Policy or by adjusting your browser settings. ### 5. Data Retention We retain personal information for as long as necessary to provide the Services and fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law. Upon termination of your subscription, we will make Customer Data available for export for 30 days, after which it will be deleted. You may contact us for specifics regarding retention periods for particular data categories. #### Security We implement appropriate technical and organizational security measures — including encryption in transit and at rest, strict internal access controls, and regular security reviews — designed to protect your information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure. We encourage you to use strong passwords and notify us promptly of any suspected unauthorized access to your account. In the event of a data breach affecting your personal information, we will notify you and applicable regulators as required by law. ### 6. Your Rights & Choices Depending on your location, you may have the right to: * Access the personal information we hold about you * Correct or update inaccurate information * Request deletion of your personal information * Object to or request restriction of certain processing activities * Receive a copy of your data in a structured, portable format (data portability) * Withdraw consent where processing is based on consent To exercise any of these rights, contact us at . We will respond to verified requests within 30 days (or within the period required by applicable law). #### California Residents (CCPA/CPRA) Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the following additional rights: * **Right to know:** The right to know what personal information we collect, use, disclose, and sell (we do not sell personal information). * **Right to delete:** The right to request deletion of personal information we have collected, subject to certain exceptions. * **Right to correct:** The right to request correction of inaccurate personal information. * **Right to opt out:** We do not sell or share personal information for cross-context behavioral advertising. * **Right to non-discrimination:** We will not discriminate against you for exercising your CCPA rights. To submit a California privacy rights request, contact us at . We will respond within 45 days, with a possible 45-day extension where reasonably necessary. **Categories of personal information collected:** Identifiers (name, email, IP address); commercial information (subscription and payment records); internet and network activity (usage data, logs); and professional information (company name, job title). **Purposes for collection:** Service delivery, product improvement, security, legal compliance, and communications. We do not sell personal information to third parties. #### European and UK Residents (GDPR/UK GDPR) For individuals located in the European Economic Area (EEA) or United Kingdom, we process personal information on the following legal bases: * **Performance of a contract:** Processing necessary to deliver the Services you have subscribed to. * **Legitimate interests:** Processing for fraud prevention, security, product improvement, and communications about the Services, where those interests are not overridden by your rights. * **Consent:** Where we rely on your consent (e.g., for optional marketing communications), you may withdraw it at any time. * **Legal obligation:** Processing required by applicable law. You have the right to lodge a complaint with your local data protection supervisory authority. A list of EU supervisory authorities is available at . The UK supervisory authority is the Information Commissioner's Office (ICO) at . #### International Data Transfers Kosmos is based in the United States. If you access our Services from outside the United States, your personal information may be transferred to and processed in the United States or other jurisdictions. For transfers of personal data from the EEA or UK to the United States, we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs) as approved by the European Commission, or other transfer mechanisms in accordance with applicable law. Details are available in our Data Processing Agreement. #### Data Privacy Framework (DPF) Kosmos AI Labs, Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF as set forth by the U.S. Department of Commerce. Where applicable, Kosmos adheres to the EU-U.S. DPF Principles with regard to personal data received from the European Union and the United Kingdom. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles, the Principles shall govern. To learn more about the DPF Program, visit . * **Independent recourse:** In compliance with the DPF, Kosmos commits to cooperate with EU data protection authorities and the UK ICO regarding unresolved complaints about our handling of personal data received under the DPF. * **FTC enforcement:** Kosmos is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC). * **Binding arbitration:** Individuals may, under certain conditions, invoke binding arbitration to address complaints not resolved through other dispute resolution mechanisms, as provided under Annex I of the DPF Principles. * **Government access:** Kosmos may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. #### Anti-Spam Kosmos does not send unsolicited commercial communications. All marketing emails are sent only to recipients who have opted in to receive them, in compliance with applicable law including the CAN-SPAM Act and GDPR. Every marketing email includes a functional unsubscribe link. If you believe you have received an unsolicited message referencing Kosmos, please report it to . #### Children The Services are designed for business use by adults. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA). If we become aware that we have inadvertently collected such information, we will delete it promptly. If you believe we have collected information from a minor, please contact us at . #### Changes to This Policy We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and revising the "Last updated" date at the top of this page. For significant changes, we will provide at least 30 days' advance notice via email or a prominent notice on our platform. Continued use of the Services after the effective date constitutes acceptance of the revised policy. ### 7. Contact Us For questions about this Privacy Policy, to exercise your data rights, or to submit a data subject request: **Kosmos AI Labs, Inc.** 1918 N. Mendell St. Chicago, IL 60642 *** **Questions?** Contact | [app.kosmoslabs.ai](https://app.kosmoslabs.ai/) © 2026 Kosmos AI Labs, Inc.