Skip to main content
CosmiAI

Privacy Policy

Version 2.0 — effective 13 October 2026. This policy covers the website cosmiai.com, the app at app.cosmiai.com and the API at api.cosmiai.com (together, "CosmiAI"). It is written under Vietnam's Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP. The Vietnamese version prevails if the two differ.

1. Who processes your data

CosmiAI is operated by ERPFIT COMPANY LIMITED (CÔNG TY TNHH ERPFIT, "ERPFit", "we") — tax code 0317567782, 134/33C Nguyen Thi Thap, Tan Thuan Ward, Ho Chi Minh City, Vietnam. Personal data contact: [email protected].

CosmiAI is a workplace tool for organisations, so there are two roles:

  • For account data (name, email, sign-in) and website data, ERPFit is the data controller.
  • For content inside a workspace (messages, files, documents, HR records), the organisation that owns the workspace is the controller. ERPFit processes that content only on the organisation's instructions, to provide the service. Requests about it should go to your workspace administrator first; we help the organisation act on them.

2. Data we process

  • Account: name, email, password (stored only as a hash), and anything you add yourself, such as phone number, avatar, cover photo, gender, date of birth and bio. We also record when you accepted these terms and this policy, and which version.
  • Sign-in and security: IP address, browser/device information, sign-in times.
  • Content you create: messages, files, documents, comments, reactions, polls, tasks.
  • Contacts: connections between users and contact tags.
  • Activity: online status, last seen, read receipts, notifications.
  • Calls: time, duration and participants; a recording only when a participant chooses to record.
  • HR (when an organisation uses the HR module): employee details, attendance (which can include location when check-in is location-based), leave, reviews, payslips. The organisation enters and manages this data.
  • The contact form on cosmiai.com: name, email, company and message. They are forwarded to our contact mailbox so we can reply, and are not stored in CosmiAI's database.

We use no third-party analytics or advertising tools on CosmiAI, and only the cookies needed to keep you signed in.

3. Purposes and legal basis

  • Providing the service you or your organisation signed up for — accounts, messaging, calls, file storage, search — on the basis of your consent at sign-up and the service contract.
  • Account security and preventing abuse.
  • Necessary email: address verification, workspace invitations, password resets, and notification digests if you turn them on.
  • Meeting our legal obligations.

We do not sell personal data, do not use it for advertising, and do not use workspace content to train AI models.

4. Where data is stored, and who processes it for us

CosmiAI's database and files are stored on servers operated by ERPFit in Vietnam. The call relay server (turn.cosmiai.com) is also in Vietnam.

Processors acting for us:

  • Cloudflare, Inc. (United States): domain names, TLS encryption and the connection to our servers. All traffic to CosmiAI passes through Cloudflare's network. Cloudflare also forwards mail sent to @cosmiai.com addresses.
  • Resend, Inc. (United States): sending the service's email. Resend receives the recipient's email address, name and the email content.

When an organisation turns on an integration (for example a webhook, ERPNext or Google Drive), data is sent to that service as the organisation configures it.

The AI assistant is currently switched off: no content is sent to any AI provider. We will update this policy before AI features are switched on.

5. Transfers outside Vietnam

Cloudflare and Resend process data outside Vietnam. We are preparing the cross-border transfer impact assessment dossier for these processors, as the Personal Data Protection Law requires.

6. How long we keep data

  • Account data: for as long as the account exists.
  • Sign-in sessions: valid for 30 days; session records are kept for as long as the account exists.
  • Workspace content: until a user or an administrator deletes it, or the workspace is deleted. The organisation decides how long its content is kept.
  • Email verification codes and password reset links: short-lived and single-use.

When an account is deleted, its account data is removed from the live system. Messages you sent in an organisation's workspace remain under that organisation's control.

7. Your rights

You have the right to be informed, to consent or withdraw consent, to access, correct and delete your data, to restrict or object to processing, to receive a copy of your data, and to complain, report and claim compensation as the law provides.

You can edit your profile yourself in Settings. For anything else — including deleting your account or getting a copy of your data — email [email protected] from the address on your account. We confirm receipt within 72 hours and act within the time the law sets. If you own a workspace, transfer its ownership or delete it before deleting your account.

Withdrawing consent does not affect processing done before, but it may mean we can no longer provide the service to you.

8. Security

Data is encrypted with TLS in transit. Passwords are stored only as hashes. Integration credentials are encrypted at rest. Server access is limited to the technical staff who need it. Messages are not end-to-end encrypted today: the server can read content in order to store, search and sync it across devices.

If a personal data breach occurs, we notify the specialised personal data protection authority (Ministry of Public Security) within 72 hours and inform the affected organisations and users.

9. Children

CosmiAI is a tool for organisations and working adults. We do not knowingly collect data from children under 16.

10. Changes to this policy

Each version carries a version number and an effective date at the top. We announce significant changes in CosmiAI before the new version takes effect.

11. Contact

Personal data: [email protected]. General questions: [email protected]. Address: ERPFIT COMPANY LIMITED, 134/33C Nguyen Thi Thap, Tan Thuan Ward, Ho Chi Minh City, Vietnam.