Privacy notice

1. Who is responsible

The controller for the processing in this notice is:

Registered seat: Zug. Managing director: Nepomuk Crhonek.

For every question about this notice or about your data, and to exercise your rights, write to hello@cosmind.si, with "Privacy" in the subject line, or by post to the address above. We have not appointed a data protection officer, because no law requires one for our processing.

We have not appointed a representative in the European Union (GDPR art. 27), because the exception of GDPR art. 27(2) applies to us: our processing of personal data of people in the EU is occasional, as it concerns business contacts at firms we work with or talk to; it does not include special categories of personal data or data on criminal convictions on a large scale; and it is unlikely to result in a risk to their rights and freedoms. People in the EU can reach us directly at hello@cosmind.si.

2. What this notice covers

2.1 Data we hold as controller

This notice covers personal data about:

• visitors to our website, cosmind.si;
• people who use app.cosmind.si to find their firm's workspace;
• people at firms we are in contact with about Cosmos: prospects, clients and their staff;
• people who sign a contract with us, or for whom we prepare one;
• the billing contacts of our clients, and card payments;
• anyone who writes to us, including for support;
• people who work with us and sign in to our own tools;
• the logs we keep to run and protect all of the above.

2.2 Your firm's workspace

Each client firm has its own Cosmos workspace. The data in it ("Client Data"), such as user accounts, the documents, files and e-mails the firm connects, meeting recordings, transcripts and summaries, and the workspace's logs, we process only on the firm's behalf, as its processor, under the data processing terms of our contract with the firm (FADP art. 9; GDPR art. 28). The firm is the controller, and its own privacy notice applies. The contract lists the subprocessors we use for workspaces, such as Amazon Web Services for hosting and AI models, Microsoft for the sign-in app and, once a firm switches on the notetaker, Recall.ai for recording and transcribing meetings.

If you use a workspace, or appear in its content, for example as a participant in a meeting that a firm records, please contact that firm. If you contact us about Client Data, we pass your request on to the firm without delay.

Firms use Cosmos from an AI assistant of their choice. That assistant runs under the firm's own contract with its provider; the provider is not our service provider and this notice does not cover it.

We give every client firm our user training, for its users to read before they first use Cosmos. It explains, among other things, what belongs in Cosmos and what does not, how to tell the participants of a meeting that it is recorded, and how to report an incident.

3. What we process, why, and for how long

For each activity we say which data we process, where it comes from, why we process it, on what legal basis under the GDPR, and how long we keep it. Swiss law does not require a legal basis for each processing; we follow the principles of the FADP (art. 6) and, where Swiss law asks for a justification, rely on the same grounds (FADP art. 31). Where we keep data because Swiss law requires it, the legal basis under the GDPR is our legitimate interest in complying with the law that binds us (GDPR art. 6(1)(f)).

3.1 Visiting our website

• Data. Your IP address, the time, the page you ask for, and the technical details your browser sends with every request, such as the browser type, its language and the referring page.
• Purpose. To deliver the website and to protect it against attacks and overload. A firewall counts the requests from each IP address over five minutes and turns away an address that sends too many.
• Legal basis. Our legitimate interest in a working and secure website (GDPR art. 6(1)(f)).
• How long. We keep no access logs of the website. The firewall keeps a small sample of recent requests, with their IP addresses, for up to three hours, which we may look at to understand an attack.
• Good to know. The website sets no cookies, uses no analytics or tracking, and loads nothing from other companies, such as fonts or videos. It is delivered through the network of Amazon Web Services, so your request is answered by the AWS location nearest to you (section 6).

3.2 Finding your firm's workspace

• Data. The work e-mail address you enter on app.cosmind.si, and the short name of your firm's workspace.
• Purpose. To send you to your firm's workspace and hand your address to Microsoft's sign-in, so that you need not type it again. A cookie remembers your firm's workspace, so that the page can take you there directly next time.
• Legal basis. Our legitimate interest in offering the sign-in path you ask for (GDPR art. 6(1)(f)).
• How long. We do not store the address you enter. It travels to your firm's workspace in the link we send you to, and so appears in the workspace's access logs, which are kept for 30 days and belong to your firm's Client Data, like everything your firm's workspace processes once you sign in (section 2.2). The cookie lasts 180 days.

3.3 Prospects, clients and their contacts

• Data. The name, firm, role, business e-mail address and phone number of the people we are in contact with at a firm, and whether one of them signs contracts for it; the e-mail address of the person your firm names as the first administrator of its workspace; notes of our calls and meetings, such as what was discussed, what we promised and when we plan to call next; our view of how the relationship is going; the stage of the relationship and who at Cosmind looks after it; and a history of changes to these records, with who made each change. For clients, we also see counts of how the firm's workspace is used, such as the number of active users; they contain no names.
• Sources. You; colleagues at your firm; people who introduce us to you; and public sources, such as your firm's website, the commercial register and professional networks.
• Purpose. To talk to firms that may become clients, to prepare, conclude and run our contracts, and to look after our clients.
• Legal basis. Our legitimate interest in business relationships with firms and in presenting our service to them (GDPR art. 6(1)(f)); where you contract with us in your own name, the contract (GDPR art. 6(1)(b)).
• How long. As long as talks with your firm go on or it is our client. When talks end, or the firm's contract ends, we close the firm's record; 24 months later we delete its contacts, notes and history of changes. Signed contracts are kept for their own period (section 3.4). You can ask us to delete your contact details earlier (section 8).
• Where. In our sales application, hosted by Amazon Web Services in Zurich.

3.4 Contracts and electronic signing

• Data. The name, function and business e-mail address of the person who signs for the client, and of our own signatory; the contract and its terms; and the record of our signing platform: when the offer was sent, opened, and signed or declined, that the signer confirmed a one-time code sent to their e-mail address and that they may bind the firm, the IP address and browser details of each step, and the signature itself.
• Sources. You, and your firm, which names its signer.
• Purpose. To conclude the contract electronically, to be able to prove who signed it and when, and to keep it as a business record.
• Legal basis. Our legitimate interest in concluding the contract with your firm and in proving it (GDPR art. 6(1)(f)), or the contract itself where you sign in your own name (GDPR art. 6(1)(b)); and our duty to keep business records under Swiss law (Code of Obligations art. 958f; GDPR art. 6(1)(f), see the start of this section).
• How long. The signed contract, the signing record and the terms as sent are stored write-once until 10 years after the end of the calendar year in which the contract ends, and in any case until 10 years after the end of the year of the last invoice under it. We keep the signed contract as a business record (Code of Obligations art. 958f) and, with its signing record, to prove the contract until claims under it are time-barred (Code of Obligations art. 127; GDPR art. 17(3)(e)). We therefore keep them even if you ask us to delete your data. Offers that were never signed (declined, expired or withdrawn) are deleted together with the firm's contacts (section 3.3), or earlier if you ask us.
• Where. Our signing platform, sign.cosmind.si, is our own installation of the open source software DocuSeal on Amazon Web Services in Zurich; no other company runs it or receives this data. Its e-mails, the invitation and the one-time code, are sent through Amazon Web Services in Zurich.

3.5 Billing and card payments

• Data. The names and e-mail addresses of your firm's billing contacts; the firm's legal name, billing address, VAT number and purchase-order reference; and the invoices, credit notes, payments, refunds and disputes, with the notices and payment links we send. You enter card details only on a page run by Stripe; card numbers never reach us. We keep only Stripe's reference to the card, its brand, the last four digits, the expiry date, the issuing country and whether it is a credit, debit or prepaid card.
• Sources. Your firm, which names its billing contacts in the contract, and Stripe.
• Purpose. To charge the fees under the contract, issue invoices and credit notes, handle failed payments, refunds and disputes, and keep our accounts.
• Legal basis. Our legitimate interest in performing the contract with your firm and in being paid (GDPR art. 6(1)(f)), or the contract itself where you contract in your own name (GDPR art. 6(1)(b)); and our duties to keep accounting and VAT records under Swiss law (Code of Obligations art. 958f; VAT Act art. 70; GDPR art. 6(1)(f), see the start of this section).
• How long. Invoices, credit notes, the charges behind them and the contracts kept with them until the end of the 10th year after the year they were issued; the billing contacts as long as these records name them. The card stays saved for your firm while its billing account runs and for 90 days after it ends, so that a new contract signed in that time needs no new card; then we detach it in Stripe, so that it can no longer be charged, or at once if your firm withdraws its consent to charges. A contract signed after the previous one ended is charged to that card only if the authorisation given when it was saved covers a later contract, as ours does since its version of 2026-10-16; otherwise we detach the card once the new contract is signed, and your firm saves a new one. Stripe keeps its own payment records. The card details above stay in the record of each payment made with the card for as long as that record is kept.
• Where. Our billing system on Amazon Web Services in Zurich; our payment pages, pay.cosmind.si, set no cookies. Stripe processes the card, the payments, the firm's legal name and address and the first billing e-mail address outside Switzerland (section 6); on its checkout page it also receives the cardholder's name and technical data about the device used to pay. For some purposes, such as preventing fraud and meeting its own duties as a payment provider, Stripe acts as a controller in its own right, under its own privacy policy at stripe.com/privacy.

3.6 E-mail, support and other contact

• Data. Your name, your e-mail address, what you write to us and any attachments, with the time, and our replies.
• Purpose. To answer you, to give the support our contracts provide, and to keep track of our correspondence.
• Legal basis. Our legitimate interest in answering you and in our business correspondence (GDPR art. 6(1)(f)); where we owe support under a contract with you, the contract (GDPR art. 6(1)(b)).
• How long. As long as the matter needs it. E-mails that form part of our business records, such as those about a contract or an invoice, are kept as long as those records (sections 3.4 and 3.5). We delete other e-mails once we no longer need them for the matter, for questions that may follow from it, or to establish, exercise or defend legal claims.
• Where. In our Microsoft 365 mailboxes, in Switzerland and the EU. Automatic e-mails from our sales, signing and billing systems are sent through Amazon Web Services in Zurich; your replies reach our Microsoft 365 mailboxes. E-mail that reached us before 9 October 2026 was received by Amazon Web Services in Frankfurt, Germany; those copies are deleted there 90 days after they arrived. If you send us content from your firm's workspace for support, we handle that content as your firm's processor (section 2.2).

3.7 Signing in to our own tools

• Who. Our platform administrators, salespeople and others who work with us and use our admin page, our sales application, our monitoring, the administration of our signing platform or our cloud account.
• Data. Name, work e-mail address and Microsoft account identifiers from our own Microsoft tenant; the time of each sign-in; and a record of the changes each person makes, with their name.
• Purpose. To let only authorised people in, and to know who changed what.
• Legal basis. The employment or service contract with the person (GDPR art. 6(1)(b)) and our legitimate interest in security and accountability (GDPR art. 6(1)(f)).
• How long. A sign-in lasts at most 8 hours on our admin page and sales application, 12 hours in our cloud account and 24 hours in the administration of our signing platform. The record of changes is kept as long as the records it belongs to; the audit trail of our cloud account for 400 days.
• Not here. People who sign in to their firm's workspace do so through their firm's own Microsoft tenant; that sign-in belongs to Client Data (section 2.2).

3.8 Security, operation and logs

• Data. For every request to our own services, such as app.cosmind.si, our sales application, the signing platform and the payment pages: the IP address, the time, the address of the request, the browser details and our response. Technical logs of our applications, written to hold as little personal data as possible. The audit trail of actions in our cloud account. Findings of our threat detection, which watches our whole cloud account. Logs of requests to a firm's workspace are that firm's Client Data (section 2.2); the website is covered in section 3.1.
• Purpose. To run our services, find and fix errors, detect and stop attacks and misuse, and investigate security incidents.
• Legal basis. Our legitimate interest in running secure services (GDPR art. 6(1)(f)).
• How long. Access logs of our load balancer: 30 days. Firewall logs of requests it blocked or flagged: 30 days, with sign-in credentials and cookies removed. Application logs: 30 days. The audit trail of our cloud account: 400 days. Threat detection findings: 90 days. If we need logs to investigate an incident or to establish, exercise or defend legal claims, we keep the entries concerned until that is done.
• Where. Amazon Web Services in Zurich. Sign-ins to the global services of our cloud account are processed by Amazon Web Services in the United States (section 6).

3.9 Backups

We back up our databases so that we can restore them after an error. Data we delete in a live system leaves the backups within 35 days.

4. Cookies

We use cookies only where a page needs them to work, or to remember a choice you made (your firm on app.cosmind.si), never for advertising or analytics. You can delete cookies in your browser at any time; a page that needs one then asks you to sign in or choose again.

5. Who receives your data

We do not sell personal data and do not use it for advertising. Within Cosmind, only our staff who work on sales, contracts, billing or operations can see it. We use the following service providers, who process it on our behalf under their data processing terms, which bind them to our instructions, to confidentiality and to protect it:

Each provider's data processing terms are part of our agreement with it, and each covers personal data from Switzerland:

• Amazon Web Services: the AWS Data Processing Addendum and its Swiss Addendum, both part of the AWS Service Terms. The Swiss Addendum applies where the FADP governs the processing, and it includes the EU Standard Contractual Clauses as amended for Switzerland, for transfers to a country without adequate protection.
• Microsoft: the Microsoft Products and Services Data Protection Addendum, part of Microsoft's Product Terms. It puts transfers of personal data out of Switzerland under the EU Standard Contractual Clauses, and Microsoft undertakes to meet the requirements of Swiss data protection law for personal data from Switzerland.
• Stripe: the Stripe Data Processing Agreement and its Data Transfers Addendum, part of the Stripe Services Agreement. Stripe, LLC receives personal data from Switzerland under the Swiss-US Data Privacy Framework; where the EU Standard Contractual Clauses apply, they are read for Switzerland, with the FDPIC as the competent authority. Stripe passes data on to its affiliates and service providers in other countries under the same agreement and addendum: the EU Standard Contractual Clauses adapted for Switzerland, with the FDPIC as the competent authority.

We also disclose personal data, as far as needed, to:

• other people at your firm, where our work with the firm requires it: for example, the firm's signer and billing contacts receive the contract and the invoices that name you;
• banks involved in a payment, for example when your firm pays an invoice by bank transfer;
• our accountant, auditors and legal and tax advisers, who are bound to confidentiality;
• authorities and courts, where the law requires it, or to establish, exercise or defend legal claims;
• a buyer of all or part of our business, and its advisers, if we sell or merge it, under a duty to handle the data as this notice says.

Our signing platform is our own installation of open source software; the company that publishes it receives no data from us.

6. Data processed outside Switzerland

We keep your data in Switzerland where we can. Some of our service providers store or process it in other countries, as section 5 lists: member states of the EU and the EEA, the United Kingdom, the United States, the other countries where Stripe's affiliates and service providers work (section 5) and, for delivering the website to visitors there, other countries in Europe and North America, such as Canada and Mexico, and Israel. Your data goes abroad only on one of these grounds:

• Adequate protection. The country is one whose law the Swiss Federal Council considers to protect personal data adequately (Annex 1 to the Data Protection Ordinance), such as the member states of the EU and the EEA, the United Kingdom, Canada and Israel; where the GDPR applies, the European Commission has decided the same for these countries and for Switzerland.
• Data Privacy Framework. For the United States, the recipient is certified under the Swiss-US Data Privacy Framework and, for data under the GDPR, the EU-US Data Privacy Framework, as Amazon Web Services, Microsoft and Stripe are.
• Standard contractual clauses. Otherwise, for example for Mexico, the EU Standard Contractual Clauses as recognised by the Federal Data Protection and Information Commissioner, with the adaptations Swiss law requires, are in place with the recipient, as part of its data processing terms. For Stripe's transfers to its affiliates and service providers in other countries, these are the clauses in Stripe's Data Processing Agreement and its Data Transfers Addendum, adapted for Switzerland, with the FDPIC as the competent authority.

You can ask us for a copy of the safeguards that apply to your data at hello@cosmind.si.

7. How we protect your data

We protect personal data with technical and organisational measures that fit the risk. Among them: every connection to our services is encrypted, and our databases and files are encrypted at rest; only the people who need it have access, signing in through our own Microsoft tenant, and our cloud account has no long-lived access keys; administrative actions are recorded; signed contracts are stored write-once; and firewalls with rate limits protect our services.

Everyone who works for us is bound by confidentiality obligations: our employees, partners and managing director by law (Swiss Code of Obligations art. 321a, 803 and 812), and contractors by the law of mandate (art. 398) or by a written confidentiality undertaking, which they sign before they get access.

8. Your rights

Your right to object. Where we process your data on the basis of our legitimate interest, you may object at any time for reasons that arise from your particular situation. You may object at any time, without giving reasons, to our contacting you about our service; we then stop.

Under the FADP and, where it applies, the GDPR, you have the right:

• to know whether we process data about you, and to receive a copy of it (FADP art. 25; GDPR art. 15);
• to have incorrect data corrected (FADP art. 32; GDPR art. 16);
• to have your data deleted (FADP art. 32; GDPR art. 17);
• to have the processing restricted (GDPR art. 18);
• to object to the processing of your data (FADP art. 30 and 32; GDPR art. 21), and in particular to our contacting you about our service, which we then stop at once;
• to receive the data you gave us in a common electronic format, or have it sent to someone else (FADP art. 28; GDPR art. 20).

To use these rights, write to hello@cosmind.si. We may ask you to prove your identity. We answer within 30 days, or tell you within that time why we need longer, and free of charge unless the law allows a fee for an excessive request. We may refuse or limit a request where the law allows it, for example for records we must keep (section 3.4) or to protect the rights of others; we then tell you why.

9. Complaints

We would like to hear from you first, at hello@cosmind.si. You may also complain to a data protection authority at any time:

• in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch;
• in the EU and the EEA, the supervisory authority of the country where you live or work or where you think the GDPR was infringed (GDPR art. 77); the European Data Protection Board lists them at edpb.europa.eu.

10. No automated decisions

We do not take decisions about you that rest solely on automated processing and have legal effects on you or affect you similarly (FADP art. 21; GDPR art. 22), and we do not use your data for profiling. Stripe may check card payments automatically to prevent fraud, under its own privacy policy.

11. Do you have to give us your data?

No law requires you to. But a firm cannot sign a contract with us without naming its signer and its billing contacts, and we cannot answer you without your e-mail address.

12. Changes to this notice

We update this notice when our processing changes. The version and date at the top show which version applies. We keep earlier versions and send them to you on request.

• Version 1.0 of 2026-10-13: first version.
• Version 1.1 of 2026-10-13: why we have no representative in the EU (section 1); our user training for client firms (section 2.2); the data processing terms of Amazon Web Services, Microsoft and Stripe, and what each covers for data from Switzerland (section 5); how the people who work for us are bound to confidentiality (section 7).
• Version 1.2 of 2026-10-15: the countries where Stripe's affiliates and service providers work, and the safeguard for those transfers (sections 5 and 6); what happens to the saved card at the end: we detach it in Stripe (section 3.5).
• Version 1.3 of 2026-10-17: a contract signed after the previous one ended is charged to the kept card only when the authorisation given when it was saved covers a later contract (section 3.5).
• Version 1.4 of 2026-10-18: our address and registered seat, now in Zug (section 1).