Legal

Privacy Policy

Effective: 11 July 2026Last updated: 11 July 2026Controller: Cosmos Innovation Ltd

This policy explains what data CosmosPro collects, why we collect it, how we protect it, and your rights over it. Cosmos Innovation Ltd is the data controller. We do not sell your data, share it with advertisers, or use it for any purpose other than providing the CosmosPro service.

Who we are

Cosmos Innovation Ltd is a company registered in England and Wales. We operate the CosmosPro platform — a capture-to-commerce application for MSMEs, exhibitors, and field sales teams.

Registered office: United Kingdom
Contact: privacy@cosmospro.uk
Website: cosmospro.uk

What data we collect and why

Category	Examples	Purpose	Legal basis
Account data	Name, email address, password (hashed)	Create and manage your account	Contract
Workspace data	Captures, contacts, orders, products, RFQs	Provide the CosmosPro service	Contract
Camera & photos	QR codes scanned, business card images, product photos	AI extraction and media storage — only when you initiate a scan	Consent
Device data	OS version, device model, locale, currency	Format currency, detect language, diagnose crashes	Legitimate interest
Usage data	Screens visited, features used, sync timestamps	Improve the product and monitor service health	Legitimate interest

We do not collect precise location, financial payment data, or any biometric data.

How we store and protect your data

All data in transit is encrypted via TLS 1.2 or higher.
Data at rest is stored on Neon (PostgreSQL) with encryption enabled.
Media files are stored in Cloudflare R2 — public URLs are time-limited signed URLs.
Locally captured data is stored in SQLite on your device and synced when online.
Passwords are hashed using bcrypt and never stored in plain text.
Access to production data is restricted to authorised Cosmos Innovation personnel only.

Who we share data with

We do not sell your data. We share data only with the following processors, strictly to provide the service:

Neon — PostgreSQL database hosting
Cloudflare R2 — media file storage
Vercel — API and web app hosting
OpenAI — AI extraction of business card data (images sent for processing, not stored by OpenAI per their API data policy)

All processors operate under GDPR-compliant frameworks.

Data retention

We retain your data for as long as your account is active. If you close your account or request deletion:

Personal account data is deleted within 30 days.
Workspace data is deleted within 30 days unless another workspace member retains shared data.
Media files are permanently deleted within 30 days.
Anonymised aggregate analytics may be retained indefinitely.

Your rights

Under UK GDPR and the Data Protection Act 2018, you have the right to:

Access — request a copy of your personal data.
Rectification — correct inaccurate data.
Erasure — request deletion ("right to be forgotten").
Portability — export your data via Privacy Settings in the app.
Restriction — limit how we process your data.
Object — object to processing based on legitimate interest.
Withdraw consent — withdraw camera or media consent via your device settings at any time.

To exercise any right, email privacy@cosmospro.uk. We will respond within 30 days.

Children

CosmosPro is a business tool intended for users aged 18 and over. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, contact privacy@cosmospro.uk and we will delete it promptly.

Cookies and local storage

The CosmosPro web app uses a single session cookie for authentication. No third-party tracking, advertising, or analytics cookies are used. The mobile app uses on-device SQLite storage for offline data — this is local to your device and is not a cookie.

Changes to this policy

We will notify you of material changes by email or via an in-app notice at least 14 days before the change takes effect. The “Last updated” date at the top of this page always reflects the current version.

Contact and complaints

For any privacy question or to exercise your rights:
Email: privacy@cosmospro.uk

If you are not satisfied with our response, you may lodge a complaint with the Information Commissioner's Office (ICO):
ico.org.uk/make-a-complaint · 0303 123 1113