Privacy
Cosmos AI Mobile App and Platform — Privacy Policy
Effective date: September 14, 2026 · Last updated: September 14, 2026
This Privacy Policy explains how Cosmos Board Yazılım ve Mühendislik Ltd. Şti. ("Cosmosboard", "we", "us") processes personal information through the Cosmos AI iOS application and the web platform at ai.cosmosboard.com (together, the "Service"). Cosmosboard is a company organized under the laws of the Republic of Türkiye. This Policy is written to satisfy Türkiye’s Personal Data Protection Law No. 6698 ("KVKK") and to give users in the United States and elsewhere the disclosures they are entitled to under applicable law.
1. Who We Are
Cosmos Board Yazılım ve Mühendislik Ltd. Şti. · Ankara, Türkiye · [email protected] · https://cosmosboard.com
2. The Service and Our Roles
Cosmos AI is a business-to-business operations-intelligence service sold to organizations such as restaurant chains and car-rental operators ("Customers"). The people who use the Service ("Users", "you") are employees or authorized personnel of a Customer. Accounts are created only by a Customer’s administrator; there is no self-service sign-up in the app.
- Account and app-operation data (Sections 3.1–3.3): Cosmosboard is the data controller (in U.S. terms, the "business").
- Customer business data (Section 3.4: POS, reservation, inventory and cost records, which may include information about the Customer’s own customers): the Customer is the controller and Cosmosboard is a processor / "service provider" acting on the Customer’s documented instructions under our service agreement and data-processing terms. The Customer is responsible for the lawful basis of collecting that data. Requests about it should go to the Customer; we will help the Customer respond.
3. Information We Process
3.1 Account and identity data — First and last name, business e-mail address, job title/role, the Customer and branch permissions you are assigned, password (stored only as a one-way hash), session tokens. This information is entered by your Customer’s administrator.
3.2 Device and technical data — IP address, device model, operating-system and app version, language setting, access timestamps and server access logs. If you enable notifications, the device token issued by the Apple Push Notification service (APNs). The app does not collect location, contacts, photos, camera or advertising identifiers, and contains no third-party analytics or crash-reporting SDK.
3.3 Chat assistant content — The questions you type to the chat assistant, the assistant’s answers, and the context needed to answer (selected branch, period, and the relevant summary figures). Chat history is retained for audit-trail and service-quality purposes.
3.4 Customer business data (as processor) — Sales, check, product, cost, waste, fleet and reservation records ingested server-side from the Customer’s POS, reservation, inventory and accounting systems. Most of this data is not personal information. Depending on the Customer’s systems — particularly car-rental reservations — it may contain end-customer names, contact details or driver-license fields. Whether such fields are sent to the Service is controlled by the Customer’s integration configuration. Cosmosboard uses this data solely to provide reporting and analysis to that Customer.
4. Purposes and Legal Bases
| Purpose | Data | Legal basis (KVKK art. 5) |
|---|---|---|
| Authenticate you, manage your account, provide the Service | 3.1, 3.2 | Performance of a contract |
| Deliver the morning briefing and alert notifications | 3.2 (APNs token) | Performance of a contract; notification permission is controlled by you in iOS |
| Answer chat-assistant questions | 3.3, 3.4 | Performance of a contract |
| Security, abuse prevention, troubleshooting | 3.2, 3.3 | Legitimate interests |
| Maintain audit trails, comply with legal obligations | 3.1, 3.3 | Legal obligation; establishment and defense of legal rights |
| Measure and improve the Service (aggregated, de-identified) | 3.2, 3.3 | Legitimate interests |
We do not use personal information for advertising, profiling for marketing, or sale to third parties. We do not knowingly process sensitive personal information; Customers must not send such fields to the Service.
5. Processing by AI Model Providers
The chat assistant explains, in natural language, figures that are computed by Cosmosboard’s own deterministic engine; the AI model does not compute the numbers. To generate the explanation, your question and the context needed to answer it are sent to third-party AI model providers (Anthropic, OpenAI and Google). These providers act as our processors/service providers: they process the content only to return a response and, under their enterprise API terms, do not use it to train their models. Account data such as your name and e-mail is not included in what is sent; only the question text and the relevant business-data summary are.
6. How We Share Information
- Hosting and infrastructure providers (Türkiye) — to run the Service.
- AI model providers (Anthropic, OpenAI and Google) — natural-language processing as described in Section 5.
- Apple Inc. — delivery of push notifications (APNs).
- E-mail delivery provider — account and system notifications.
- Your Customer — administrators of the organization you belong to can see their users’ account and usage information in the admin console.
- Authorities — where required by law, court order or to protect rights, safety and property.
- Successors — in a merger, acquisition or asset sale, subject to this Policy.
We do not sell personal information and we do not share it for cross-context behavioral advertising.
7. International Transfers
Cosmosboard is located in Türkiye and the Service is hosted in Türkiye. AI model providers may process data in the United States and/or the European Union. If you use the Service from the United States or another country, your information will be transferred to and processed in these locations. Transfers out of Türkiye are made under the safeguards provided by KVKK Article 9, including standard contractual clauses published by the Turkish Personal Data Protection Authority. You can request information about the transfer mechanism in use at [email protected].
8. Retention
| Data | Retention |
|---|---|
| Account data (3.1) | For the term of the Customer agreement; deleted or de-identified within 90 days after termination, except records we must keep under Turkish commercial and tax law for the statutory period. |
| Server access logs (3.2) | 12 to 24 months, as required by Turkish Law No. 5651. |
| APNs device token | Deleted when you disable notifications or your session ends. |
| Chat history (3.3) | 24 months (audit trail and report-to-answer reconciliation); a shorter period may be set in the Customer agreement. |
| Customer business data (3.4) | As set in the Customer agreement; returned or deleted on the Customer’s instruction at termination. |
9. Security
Data is encrypted in transit (TLS) and at rest. In our multi-tenant architecture each Customer’s data is isolated at the database level with row-level access control, so a user of one Customer cannot technically reach another Customer’s data. Access is role-based and logged. Our personnel are bound by confidentiality obligations. In the event of a data breach we notify the Turkish Personal Data Protection Authority, affected Customers and, where required by applicable law, affected individuals and U.S. state regulators.
10. Your Rights and Choices
Subject to applicable law, you may request access to the personal information we hold about you, correction of inaccurate information, deletion, information about the third parties it has been disclosed to, and a portable copy; you may object to processing based on legitimate interests and to decisions based solely on automated processing. To exercise these rights, e-mail [email protected] or write to Ankara, Türkiye. We respond within 30 days and do not charge a fee. Because your account is created by your Customer’s administrator, we coordinate deletion requests with the Customer; records subject to a contractual or legal retention obligation are kept only for that period.
Notifications can be turned off at any time in iOS Settings › Notifications › Cosmos AI.
11. Notice to U.S. Residents
Cosmosboard does not sell personal information, does not "share" it for cross-context behavioral advertising, and does not use it for targeted advertising or profiling that produces legal or similarly significant effects. If you reside in California, Colorado, Connecticut, Texas, Virginia or another state with a comprehensive privacy law, you may have the rights to know/access, correct, delete, obtain a portable copy, and appeal a decision we make on your request, and you have the right not to be discriminated against for exercising them. Submit requests as described in Section 10; to appeal, reply to our response with "Appeal" in the subject line. We will verify requests using your account e-mail and, where needed, your Customer’s administrator. An authorized agent may submit a request on your behalf with written authorization. The categories of personal information collected in the last 12 months, their sources, purposes and recipients are described in Sections 3, 4 and 6 of this Policy.
12. Children
The Service is not directed to anyone under 18, and we do not knowingly collect personal information from children.
13. Changes to This Policy
Material changes will be announced in the app and/or by e-mail at least 15 days before they take effect. The current version is always available at https://cosmosboard.com/privacy.
14. Contact
Cosmos Board Yazılım ve Mühendislik Ltd. Şti. · Ankara, Türkiye · [email protected]