Privacy policy — kosmobids.com

1. Who is responsible

The service at kosmobids.com (the “Service”, “Kosmo”) is operated by Piotr Osiński, trading as Code Fibers, ul. Tyszkiewicza 14/24/61, 01-182 Warszawa, Poland, NIP 5222853697, REGON 362492920 (the “operator”, “we”). The operator is the controller of the personal data described in this policy.

Contact for anything in this policy, including a request about your data: hello@kosmobids.com, or by post to the address above. We have not appointed a data protection officer, because the processing we carry out does not meet the conditions that make one mandatory. Questions about data protection go to the same address and are answered by the operator.

If you use the Service on behalf of an employer or another organisation, that organisation decides which documents and accounts are uploaded. In that case the organisation is the controller of that content and we process it as a processor under our data processing agreement; we are the controller of your account data and of the messages you send us directly.

2. What we process

Category	What it includes
Account data	Name, work email address, organisation, role, password hash or single sign-on identifier, language and time-zone settings.
Company content	Documents and text you upload or connect: product documentation, certificates, references, price lists, tender documents you are working on, and the drafts produced from them.
Conversations	The prompts, files, instructions and responses exchanged with Kosmo, in the web app, by email, or in Slack.
Usage data	Log data needed to run the Service: timestamps, requests, error reports, features used, and a record of which tender notices were read or sent to you.
Billing data	Plan, invoice history and tax identifiers. Card details are handled by our payment provider; we do not store full card numbers.
Communications	Messages you send to support or sales, and our replies.

Please do not upload special categories of data (for example health data or data about criminal convictions) unless a tender genuinely requires it. If you do, you are responsible for having a lawful basis for it. Public tender documents often name individuals — that is normal for this work, and it is processed as part of the document you gave us.

3. Why we process it, and on what basis

To provide the Service — searching tenders, reading documents, checking requirements against your company knowledge, producing drafts. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
To keep the Service secure and working — authentication, abuse prevention, debugging, capacity planning, audit logs. Legal basis: our legitimate interest in operating a reliable and secure service (Art. 6(1)(f)).
To improve the product — we look at aggregated measures of how the Service is used (which screens, which features, which errors) and at support conversations, to fix what is broken and simplify what is confusing. Legal basis: legitimate interest (Art. 6(1)(f)). We do this on metrics and on messages you chose to send us; we do not mine your uploaded documents for product development, and you can object at any time (section 10).
To bill you and meet our legal obligations — invoicing, tax and accounting records, responding to lawful requests. Legal basis: legal obligation (Art. 6(1)(c)) and performance of a contract.
To contact you — service notices, security notices, and (only with your consent or an existing customer relationship) product news, which you can stop at any time. Legal basis: contract, legitimate interest, or consent (Art. 6(1)(a)).

We do not sell personal data, and we do not use your company content or conversations to train or fine-tune any model — ours or anyone else's.

4. AI processing

Kosmo reads documents and drafts text with large language models. We run that computation ourselves, on infrastructure we operate, in a data centre in the European Union, using open-weight models. Your documents, prompts and drafts are not sent to a third-party model provider — the model runs inside our own environment, so there is no provider on the other side of your content.

What happens to your content when a model reads it:

it is processed in memory to produce the answer, and stored only as part of your workspace (your conversation, your draft), where you can see and delete it;
it is never used to train or fine-tune a model, and it is not retained by any model supplier for abuse monitoring, because no model supplier receives it;
we do not use one customer's content to answer another customer's question, and workspaces are kept apart;
when you delete a document or a conversation, it stops being available to the model as context.

Model weights are downloaded once from their public publisher. Our GPU compute is provided by infrastructure suppliers, who run the machines but do not receive your documents as a separate processing purpose; they are listed as subprocessors in section 6 and in our data processing agreement.

Automated output can be wrong. It is a draft for a person to check, not an answer to submit unseen — see section 7 of our terms.

5. Cookies and similar technologies

This website uses only what is needed to serve the pages: no advertising cookies, no cross-site tracking pixels and no third-party analytics scripts. The web application sets a session cookie (or an equivalent token) to keep you signed in, and stores your interface preferences locally in your browser. If we add optional analytics later, it will be off until you agree to it, and this section will say so before that happens.

6. Who can see your data

Access inside our organisation means the operator, and anyone we engage who needs it to run, support and secure the Service, always under confidentiality obligations. Outside that, your data reaches these suppliers and nobody else:

Supplier	Purpose	Where
Cloudflare	Serving this website, TLS, and protection against attacks and abuse	Global edge network; EU processing for the data we send it
Novita AI / RunPod	GPU compute that runs the open-weight models — machines only, no separate purpose of their own	EU regions
Email and messaging providers	Delivering shortlists and service notices, and the email/Slack channels when you talk to Kosmo there	EU or US under standard contractual clauses
Payment and accounting providers	Billing, invoices and bookkeeping	EU
Professional advisers and authorities	Where the law requires it, or to establish or defend a legal claim	As required

This list is also published, with the processing agreement that covers it, at kosmobids.com/dpa. Paid customers are told by email at least 30 days before a new subprocessor is added, and may object (section 6 of the DPA).

7. How long we keep it

Account data — while your account exists, then up to 30 days while it can be restored, then deleted.
Company content and conversations — while your account exists, and for 30 days after it ends, so you can export it. After that they are deleted from live systems within 30 days and from backups within 90 days.
A trial that does not become a subscription — content is kept for 30 days after the trial ends, so you can export it, then deleted on the same schedule.
Usage and security logs — up to 12 months, unless a security investigation needs them longer, in which case they are kept until it closes.
Billing records — for the period required by tax and accounting law (in Poland, five years from the end of the tax year).
Support correspondence — up to 24 months after the last message.

You can delete individual documents and conversations at any time; deletion from live systems is immediate, and copies leave the backup cycle within 90 days.

8. Security

Data is encrypted in transit and at rest, access is role-based and logged, separate customer workspaces are kept logically apart, and production access is limited to the operator. We run backups, monitor for abuse, and keep dependencies patched.

Being straightforward about the rest: we do not hold ISO 27001 or SOC 2 certification, and we do not claim one. If a certification becomes a condition of your contract, tell us — we would rather say what we have than describe controls as if they came with an audit behind them.

No system is perfect. If a personal-data breach affects you, we notify you without undue delay after we become aware of it, and the supervisory authority where the law requires it.

9. Where your data goes

Your content is processed and stored in the European Union. Some suppliers in section 6 are based in the United States (email delivery, in particular). Where personal data leaves the European Economic Area, the transfer is covered by a European Commission adequacy decision or by standard contractual clauses under Art. 46 GDPR, with a transfer impact assessment where one is required. You can ask us which mechanism applies to a particular supplier.

10. Your rights

Under the GDPR you can ask us to:

confirm what personal data we hold about you and give you a copy (access);
correct data that is wrong or incomplete (rectification);
delete data we no longer need (erasure);
restrict or object to processing, including to processing based on legitimate interest;
receive your data in a portable format, or have it transmitted to another controller;
withdraw consent you have given, without affecting processing that already happened.

Write to hello@kosmobids.com and we will answer within one month, extending it by up to two further months where a request is complex. We may need to verify your identity first. You also have the right to complain to a data protection supervisory authority — in the country where you live, where you work, or where the alleged infringement took place. In Poland that is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa.

11. Children

The Service is a business tool and is not intended for anyone under 16. We do not knowingly collect data from children.

12. Changes to this policy

We date every version at the top of this page. If a change affects what we do with your data or your rights, we tell account owners by email at least 30 days before it takes effect, unless a legal requirement or a security fix makes a shorter period unavoidable — in which case we explain why.

13. Contact

Piotr Osiński, trading as Code Fibers, ul. Tyszkiewicza 14/24/61, 01-182 Warszawa, Poland — hello@kosmobids.com. See also our terms & agreements and our data processing agreement.