Privacy Policy

CosmoOps (OPC) Private Limited ("CosmoOps", "we", "us", or "our") is a company incorporated in India. We operate the CosmoOps Platform, a cloud-based business communication and telephony management service ("Platform").

For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") and applicable data protection laws, CosmoOps is the Data Fiduciary in respect of personal data processed through the Platform.

We collect the following categories of personal data:

• Account data — name, email address, phone number, role within your organisation.
• Organisation data — organisation name, GSTIN, CIN (for private limited companies), LLPIN (for LLPs), PAN, and registered address.
• KYB documents — GST Registration Certificate, Certificate of Incorporation, and PAN Card images you upload during onboarding.
• Usage data — log files, IP addresses, browser/device type, pages visited, and feature interactions.
• Communications data — call records, message logs, and telephony metadata generated through the Platform.

We process your personal data for the following purposes:

• Providing and operating the Platform under our contract with you.
• Identity verification and KYB compliance required by Indian telecom regulations (TRAI).
• AI-assisted extraction of registration numbers and address details from uploaded KYB documents (see Section 5).
• Sending transactional and service communications (e.g. magic-link login emails).
• Security, fraud prevention, and abuse detection.
• Improving the Platform through aggregated, anonymised analytics.
• Complying with legal obligations under applicable Indian law.

We rely on the following legal bases under the DPDP Act:

• Consent — for AI-assisted extraction of KYB document data and for optional marketing communications. You may withdraw consent at any time by contacting us.
• Contractual necessity — for operating your account and delivering the services you have subscribed to.
• Legitimate interests — for security monitoring, fraud prevention, and product analytics, where those interests are not overridden by your rights.
• Legal obligation — where required by Indian law, court order, or regulatory directive.

When you upload KYB documents during onboarding, we use Google Gemini (via Google Cloud Vertex AI) to automatically extract structured data such as your GSTIN, CIN (for private limited companies), LLPIN (for LLPs), PAN number, business name, and registered address. This avoids manual data entry errors and speeds up the verification process.

Document images and their contents are transmitted to Google's servers located in the United States for this extraction. Google processes your data as a Data Processor acting on our documented instructions under a Data Processing Agreement. Google does not use this data to train its AI models.

The raw document images are stored in Google Cloud Firebase Storage within the asia-south1 region. Extracted fields are stored in Google Cloud Firestore within the same region.

We share data with the following categories of third parties as Data Processors:

• Google LLC — Firebase (Auth, Firestore, Storage, Cloud Functions), Vertex AI / Gemini. Data Processing Agreement in place.
• Plivo Inc. — Telephony infrastructure for call routing and SMS. Data Processing Agreement in place.
• Resend Inc. — Transactional email delivery (magic-link emails).

We do not sell your personal data to third parties.

We may disclose your data to law enforcement or regulatory authorities when required by law or a valid legal process.

Some sub-processors (including Google LLC and Plivo Inc.) are located outside India. Where personal data is transferred outside India, we ensure appropriate safeguards are in place, including contractual clauses consistent with applicable data protection law.

• Account and organisation data — retained for the duration of your subscription plus 7 years (as required by Indian accounting and tax law).
• KYB documents — retained for a minimum of 5 years from the date of submission, as required by telecom and AML regulations.
• Call and message records — retained for 2 years, or longer if required by TRAI regulations.
• Session and log data — retained for 90 days.

Under the DPDP Act and applicable law, you have the right to:

• Access — obtain a summary of personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data, subject to legal retention requirements.
• Grievance redressal — raise a complaint with our Grievance Officer via our Grievance Redressal mechanism.
• Nominate a nominee — designate a person to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, contact our Data Protection and Grievance Officer at grievance@cosmoops.com.

You may also lodge a complaint with the Data Protection Board of India once it is operational under Section 20 of the DPDP Act, 2023.

We implement industry-standard technical and organisational measures to protect your personal data, including encryption at rest and in transit, role-based access controls, audit logging, and regular security reviews. However, no system is completely secure and we cannot guarantee absolute security.

The Platform uses session cookies strictly necessary for authentication. With your consent, we also use Google Analytics through Google Tag Manager to understand website usage. Analytics is not loaded until you accept it in our cookie banner, and you can change your choice at any time through Cookie Settings.

The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors.

We may update this Privacy Policy from time to time. Material changes will be notified to you by email or via an in-app notice at least 15 days before they take effect.

CosmoOps (OPC) Private Limited
General Inquiries: hello@cosmoops.com
Support: support@cosmoops.com
Grievance Officer: grievance@cosmoops.com (See Grievance Redressal)