Last updated: October 2026
This policy explains how CosmiRoNex AI collects, uses, shares and retains information about website visitors, our business customers, and the people who use our customers' AI assistants. Please also read our Terms & Conditions.
CosmiRoNex AI is operated as an Indian sole proprietorship registered under Udyam (MSME), Registration No. UDYAM-KR-03-0740511. You can view our verified Business Registration Details.
Contents
CosmiRoNex AI ("CosmiRoNex AI", "we", "us" or "our") provides business-to-business AI software-as-a-service (SaaS) from Bengaluru, Karnataka, India. CosmiRoNex AI is a sole proprietorship; it is not a company or limited liability partnership.
This Privacy Policy explains how we collect, use, share and retain information in connection with our website at cosmironexai.com and our AI assistant platform. It applies to three groups of people:
For website and Customer account information, we decide how the information is used. When we process End User information through a Customer's assistant, we do so to provide the service to that Customer and on its instructions. The Customer is responsible for its own privacy notice to its End Users. If you are an End User and have questions about how a business uses your information, please contact that business first; we will support it as appropriate.
The information we collect depends on how you interact with us:
Website visitors and enquiry forms
Our website forms are processed by Formspree, a third-party form service, which delivers your submission to our business email inboxes so that we can respond.
Customer account information
Payment information
Payments are processed by Razorpay, our payment processor. Payment details you enter at checkout are collected and processed by Razorpay under its own terms and privacy policy. We receive information about the transaction, such as the order and payment references, amount, currency, plan or credit pack purchased, and payment status.
Customer Content
End User interactions with a Customer's assistant
End Users can type or say anything in a free-text question, including personal information such as names, contact details, or health or financial information. Customers should discourage End Users from sharing sensitive information through an assistant, and End Users should avoid doing so.
Technical and service data
We use information to:
CosmiRoNex AI does not train its own general-purpose AI models on Customer Content or End User conversations. Our AI service providers' handling of data is described in Section 4.
Our platform uses third-party AI services to process Customer Content and End User interactions. Information is sent to these providers to generate the requested result, such as a response, a transcript or synthesised speech.
Google AI and cloud services are central to our platform. Depending on the feature, we use:
Other AI providers
Our platform also contains integrations with OpenAI models for certain functions, such as interpreting and normalising questions before searching Customer Content, generating conversation titles, suggesting product categories from Customer Content, and generating some responses in signed-in portal features. These integrations are not part of our primary Google-based answer path, and our current production configuration is intended to keep them inactive.
Our platform also contains legacy speech features that are switched off unless enabled by configuration: an OpenAI-based speech transcription path and a Microsoft Azure AI Speech text-to-speech fallback. Text sent to the Azure fallback is masked for common contact details before it is sent.
If any of these integrations is used, the information needed for that function — such as a question, excerpts of Customer Content, or text to be spoken — is sent to OpenAI or Microsoft, as applicable, and processed under their terms. We review our AI providers from time to time and will update this policy when our provider arrangements change materially.
How AI providers handle data
AI providers process the information we send them under their own terms. Depending on the provider and service, they may retain data for a limited period, including for abuse monitoring, safety, security or legal compliance. These practices are controlled by the providers, not by us, and we do not represent that any provider retains no data or never uses data to improve its services.
Customers can deploy our assistants through different channels. How information is processed depends on the channel and on the features a Customer enables:
Website chat widget and QR assistants
Messages are sent to our servers, processed with the AI services described in Section 4, and the response is returned to the End User. Interaction records are handled as described in Section 6.
Browser Voice
Where supported, Browser Voice uses speech recognition and speech synthesis features built into the End User's web browser. Depending on the browser, the browser provider may process audio on its own servers under its own terms. We receive the resulting text, not the audio.
Cloud Voice
When an End User starts a Cloud Voice interaction and grants the browser microphone permission, audio is sent through our servers to Google's Gemini service for transcription, and responses may be converted to speech using Google Cloud Text-to-Speech.
Gemini Live
Gemini Live provides real-time voice conversation. When an End User starts a Gemini Live session and grants microphone permission, audio is streamed to Google's Gemini Developer API, which may happen directly from the End User's browser using a short-lived credential that we issue.
Audio retention
Our platform is not designed to store raw audio recordings of voice interactions in our databases. We may store text transcripts of what was said and the assistant's responses, as described in Section 6. Third-party providers that process audio — including Google, browser providers and any other provider used for a voice feature — handle it under their own terms and may retain it according to their own policies.
Notices and consent
Customers decide where and how our assistants are deployed. Each Customer is responsible for telling its End Users that they are interacting with an AI assistant, explaining how their information is handled, and obtaining any consent required by applicable law — including consent required before voice communications are processed or recorded.
Depending on the channel and the Customer's configuration, we store records of End User interactions grouped by session. These records can include questions, assistant responses, voice transcripts, timestamps, session identifiers and related interaction events.
Authorised administrators of a Customer's account can view analytics about their own assistants, which may include the text of End User questions and assistant responses. Our access controls are designed so that each Customer can access only its own account's data, and Customers must access and use this data only as they are authorised to.
Conversation records are not anonymous. Even when an End User does not register or sign in, a record may contain personal information the End User chose to share, and may be linkable to an individual through session identifiers, device information or other context. We treat raw conversation records as information that may identify individuals.
We may also produce aggregated or de-identified statistics, such as question counts, popular topics and usage trends, that do not reasonably identify an individual End User. Only information that has genuinely been aggregated or de-identified in this way is treated as non-personal.
We do not sell raw conversation records or End User personal information to third parties.
Some parts of our platform apply automated, pattern-based masking that attempts to detect and hide common contact details — such as email addresses, phone numbers and certain numeric codes — in specific places, such as some service logs and some text sent to speech services.
Masking has important limits. It does not apply to all data or all features. It can miss personal information that does not match the expected patterns, such as names, addresses, or details written in unusual formats or languages. It may not apply to the conversation records that authorised Customer administrators can view. Masking is a risk-reduction measure only and does not make data anonymous.
Customers own the business documents and other content they upload. We process Customer Content only to provide, secure, maintain and support the service for that Customer, as described in this policy and in our Terms & Conditions — including sending relevant content to the AI service providers described in Section 4 so that they can generate responses.
Customers are responsible for ensuring they have the rights to upload their content, and should not upload personal information that is not needed for their assistant.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We share information only as follows:
Service providers process information for us under their own terms and privacy policies. Some may act as independent controllers of certain information, such as payment information handled by Razorpay.
We retain information for as long as it is reasonably needed for the purposes described in this policy, including delivering the service, providing historical reporting and analytics to Customers, maintaining account continuity, security, resolving disputes and meeting legal obligations. Retention is subject to applicable privacy rights and legal requirements. We do not currently apply a fixed automatic deletion schedule to Customer accounts or conversation records. In general:
Cancelling a subscription is not the same as permanently closing an account. Customers can ask us to delete specific uploaded documents or to permanently close their account and delete associated information by emailing founder@cosmironexai.com. We will handle valid requests as required by applicable law, but we may retain information where we are legally required or permitted to, such as billing records or information needed to resolve disputes. Copies may remain in backups or logs for a period after deletion. We do not currently offer a self-service deletion tool.
We use reasonable technical and organisational measures designed to protect information. These include encrypted connections (HTTPS), hashed passwords, access controls that separate each Customer's data, server-side handling of service credentials, and rate limiting to reduce abuse.
No system is completely secure, and we cannot guarantee the security of information. Customers should use strong credentials, limit administrator access to people who need it, and tell us promptly about any suspected security issue.
Depending on where you live, you may have rights to request access to, correction of, deletion of, or a copy of your personal information, to object to or restrict certain processing, to withdraw consent, and to appeal a decision about your request. We will not discriminate against you for exercising these rights.
To make a request, email founder@cosmironexai.com. We may need to verify your identity before acting on a request, and an authorised agent may make a request on your behalf where the law allows. We will respond within the time required by applicable law.
If you are an End User and your request concerns information held in a business's assistant, we may refer your request to that business, because it decides how that information is used. We will support the business in responding as appropriate.
Some U.S. states give residents specific privacy rights, including the rights described in Section 12. The categories of personal information we collect, the sources, the purposes and the categories of recipients are described in Sections 2, 3 and 9. We do not sell personal information or share it for cross-context behavioural advertising, and we do not intentionally collect sensitive personal information, although End Users may choose to share it in free-text questions.
When we process End User information on behalf of a Customer, we act as that Customer's service provider or processor. Requests about that information should generally be directed to the Customer.
Some U.S. states require the consent of every party before a communication is recorded or intercepted, and some regulate biometric information. Customers that deploy chat or voice features are responsible for providing the notices and obtaining the consents those laws require. We do not use voice data to create voiceprints or to identify individuals by their voice.
CosmiRoNex AI is based in India, and our service providers operate in multiple countries. Information may be processed in India, the United States and other countries where we or our service providers operate. Those countries' data protection laws may differ from the laws where you live.
We do not guarantee that information will be stored or processed in any particular country. Where applicable law requires safeguards for international transfers, we rely on the safeguards available under our arrangements with our service providers.
Our website and Customer accounts are intended for adults acting for businesses and other organisations. Some Customers, such as schools and other education providers, may deploy assistants that students — including children — and parents use. When they do, we process that information on the Customer's behalf to provide the service, as described in this policy.
Customers that deploy assistants for students or other young people are responsible for deciding whether that use is appropriate, for providing any required notices, and for obtaining any parental or other consent required by applicable law. We do not represent that the platform satisfies any particular children's or student privacy law, and we encourage education Customers to contact us before deploying an assistant to younger children.
If you believe a child has provided personal information through an assistant without appropriate consent, please contact the relevant school or organisation, or email founder@cosmironexai.com.
We may update this Privacy Policy to reflect changes in our services, service providers, data practices or applicable law. We will post the updated policy on this page with a revised "Last updated" date, and where a change is material we will take reasonable steps to notify Customers, such as by email or an in-product notice.
CosmiRoNex AI (sole proprietorship), Bengaluru, Karnataka, India.
For privacy questions, requests or complaints, email founder@cosmironexai.com.
© 2026 CosmiRoNex AI. All rights reserved.
For privacy-related enquiries, email founder@cosmironexai.com.