Data Protection and Privacy Policy

1. Introduction

1.1 This Privacy Policy is intended for users of the online platform ("Cosmx" or the "Platform") offering Astrology, Tarot, Fortune Telling, Numerology, Vastu, Energy Alignment, Life Coaching, Interpretive and Healing Sciences, Wellness, and Counselling services in India, and an AI companion called cosmx Intelligence. The Platform handles personal data in accordance with the Information Technology Act, 2000 and the rules made under it (including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011), and the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, to the extent and from the dates they come into force.

1.2 The Platform is owned and operated by Sobreva Ventures Private Limited ("we", "us", "the Company"), which is the Data Fiduciary for the personal data described in this policy.

2. Data Collection and Processing

2.1 The Platform collects, processes, stores, and discloses personal data such as name, contact details, date of birth, time and place of birth, gender, payment information, and service usage to provide the stated services. If you use cosmx Intelligence, we also process the messages you send, the replies generated for you, any mood or wellbeing inputs you choose to share, and the preferences and context that cosmx Intelligence retains from your conversations (see Section 3A). We also collect device and usage data such as app events, device identifiers and approximate location derived from your IP address, for analytics, attribution and security.

2.2 Information is collected with your consent, which we obtain through notices in plain language and through your actions in the app, such as tapping "Accept & Continue". We may keep a record of when and how you gave or withdrew consent.

2.3 The Platform, including cosmx Intelligence, is only for persons aged 18 or above. We do not knowingly collect personal data of children. If we learn that an account belongs to a person under 18, we may suspend the account and delete the associated personal data, except where we are required or permitted by law to retain it. Any payments made to the effect of such accounts and the services applied for, the amounts lying credit or unused shall be forfeited without any further claims or liability thereof on the part of the platform.

3. Purpose of Data Use

3.1 Data is used for providing services, providing cosmx Intelligence, user support, personalisation, marketing (with your consent where required), internal analytics, testing, evaluating and improving our offerings, keeping users safe (including detecting and responding to conversations that indicate a risk of harm), securing the Platform, preventing fraud and misuse, enforcing our terms, establishing or defending legal claims, and complying with applicable law.

3.2 The purposes for which data is collected will be made available in notices at the time of collection. We may use trusted third-party service providers to help us deliver and operate the Platform, as described in Section 7.

3A. cosmx Intelligence

3A.1 What it is. cosmx Intelligence is an AI companion available inside the cosmx app. Its replies are generated by artificial intelligence models. It is not a human and it is not a Guide.

3A.2 What we process. To provide cosmx Intelligence we process: (a) the messages you type or select; (b) the replies generated for you; (c) your date, time and place of birth from your profile, to calculate charts and readings you ask for; (d) basic profile details such as your name and the life-stage information you have given us, to make replies relevant; (e) session data such as time spent, the daily free window used and your subscription status; and (f) any feedback you give on replies.

3A.3 Your consent. Before your first chat, we show you a short notice that links to this policy. You need to tap "Accept & Continue" to use cosmx Intelligence. If you tap "Later", you can still use the rest of cosmx, including bookings and Guide sessions.

3A.4 Memory. cosmx Intelligence may store and use your past conversations and the preferences and context you share, so that it can give you more relevant replies over time without you repeating yourself. To ask us to stop remembering you or to delete what has been remembered, write to support@cosmx.app and we will act on your verified request as set out in Section 6.

3A.5 Evaluation, safety and improvement. We may use conversations internally to test, evaluate, secure and improve the quality and safety of cosmx Intelligence and our services. This may include authorised cosmx personnel reviewing samples of conversations. Where practicable, we remove direct identifiers such as your name, phone number and email address before such review. We do not sell your conversations, and our arrangements with our AI infrastructure providers are intended to restrict them from using your conversations to train their own models.

3A.6 Safety review. If a conversation suggests that you or someone else may be at risk of serious harm, it may be flagged and reviewed by authorised cosmx personnel or a support partner we appoint, so that we can share appropriate support resources with you or take other steps we consider appropriate. We may keep flagged conversations for safety, security and legal purposes and to improve our safety measures. We do not guarantee that every such conversation will be identified or reviewed, and cosmx Intelligence is not an emergency service.

3A.7 Where your data goes. cosmx Intelligence currently runs on cloud infrastructure provided by Amazon Web Services (AWS), with servers located in India. To calculate astrological charts we share the date, time and place of birth you provide with an astrology data provider. We do not intend to send the text of your cosmx Intelligence conversations, or your name, phone number or email address, to our analytics or attribution providers, and we use settings intended to keep personal data that identifies you directly out of their tools. They are meant to receive app usage events and device identifiers only. To the extent permitted by law, we are not responsible for anything a provider receives unintentionally or for a provider's own independent acts, and we will take reasonable steps to have unintended data removed once we become aware of it. Our service providers and their locations may change from time to time.

3A.8 Guides. Guides cannot see your cosmx Intelligence conversations or any summary of them. If we later offer a feature that lets you share a summary with a Guide, we will ask for your consent before anything is shared.

3A.9 What not to share. Please do not share passwords, bank or card details, government ID numbers, or personal details of other people in your conversations.

4. User Rights

4.1 You have the right to access, correct, update and delete your personal data, to withdraw consent at any time, and to nominate an individual to exercise your rights in certain cases, subject to applicable law. You can exercise these rights by writing to support@cosmx.app from the email address or phone number linked to your account. We may need to verify your identity before acting on a request.

4.2 We will respond to requests within a reasonable period and in any case within the time required by applicable law.

4.3 If you withdraw consent, we may no longer be able to provide the related service, including cosmx Intelligence. Withdrawal does not affect processing that took place before you withdrew, and does not apply to processing we are required or permitted by law to continue.

4.4 If you are not satisfied with our response, you may write to our Grievance Officer (Section 9). If your grievance is not resolved, you may approach the Data Protection Board of India once it is constituted and the relevant provisions are in force.

5. Data Security and Breach Notification

5.1 We take reasonable security measures to protect personal data against unauthorised access, misuse or loss. These may include encryption, access controls and logging, appropriate to the nature of the data. No system is completely secure, and we cannot guarantee absolute security.

5.2 In the event of a personal data breach, we will inform affected users and notify the Data Protection Board of India and other authorities as and when required by law, and take remedial steps.

6. Data Retention and Deletion

6.1 We retain personal data for as long as we consider reasonably necessary or useful for the purposes in this policy, including providing and improving the Platform, our business operations, safety, security, fraud prevention, resolving disputes, enforcing our terms, establishing or defending legal claims, and complying with law, and for longer where the law permits or requires.

6.2 Data of users inactive for more than 3 years may be deleted or anonymised, and users will be notified at least 7 days in advance, except where we need to keep it for a purpose in 6.1.

6.3 cosmx Intelligence conversations and memory are kept while your account is active and you continue to use cosmx Intelligence, and afterwards for the periods and purposes in 6.1 and 6.2.

6.4 When we receive your verified request to delete your data or withdraw your consent, we will delete or anonymise the personal data we hold about you within 90 days, except the following, which we may retain: (a) your name, contact details, and account, communication, transaction and payment records (such as payment references, amounts, dates, invoices and tax details), for tax, accounting, audit, regulatory and dispute purposes; (b) conversations flagged under Section 3A.6 or connected with a complaint, claim or investigation; (c) data we must keep under any law, court order or direction of an authority; (d) data that has been de-identified or aggregated. De-identified data means information from which your name, phone number, email address and other direct identifiers have been removed or masked, such as usage statistics, analytics records and conversation samples prepared in this way. To the extent permitted by law, we may retain and use de-identified and aggregated data for evaluation, safety, research, analytics, product improvement and other lawful purposes, and we are not required to delete it; and (e) copies in backup systems until they are overwritten in the ordinary course.

6.5 We do not store your full card details. Payments are processed by our payment partners and the app stores in line with applicable payment regulations.

7. Disclosures to Third Parties

7.1 Data is not shared with third parties except as required for service delivery, safety, legal compliance, or with your consent. We use service providers who process data on our behalf under contract, including: cloud hosting and AI infrastructure (currently Amazon Web Services, AWS); astrology chart calculation (birth details); payment processing (including our payment gateway partners and, where you purchase through them, Google Play or the Apple App Store); analytics and attribution; and messaging, communication and customer support providers. We do not sell personal data. Where the law requires, we will share details of our service providers with you on a verified written request.

7.2 Any transfer of personal data outside India will comply with applicable law. Some service providers, such as analytics providers, may process data outside India. cosmx Intelligence currently runs on Amazon Web Services (AWS) infrastructure located in India.

7.3 We may also disclose personal data where required by law, court order or a government authority, to protect the rights, safety or property of users, us or others, or in connection with a merger, acquisition or sale of assets, in which case the recipient will be bound to protect your data in line with this policy.

8. Changes to this Policy

8.1 We may update this policy from time to time. Please review it periodically. If we make a material change, especially to how cosmx Intelligence uses your data, we will tell you in the app or on the website and, where the law requires, ask for your consent again. Disclaimers, limitations of liability, crisis information and external links are set out in our Terms and Conditions.

9. Contact and Grievance Officer

For questions about this policy or your personal data, or to exercise your rights, write to support@cosmx.app. For any grievance, data or policy breach concern, or dispute, please contact our Grievance Officer, Sobreva Ventures Private Limited, at support@cosmx.app, marked "Attention: Grievance Officer". Registered office: Sobreva Ventures Private Limited, A-202, Symphony, Link Road, Kandivali (W), Mumbai 400 067.

By using this Platform, users acknowledge that they have read, understood, and agree to this Privacy Policy. Consent for cosmx Intelligence is asked for in the app.