Privacy Policy

• Kosmik Compute s.r.o.*

Effective date: 9 June 2026

1. Who we are

This Privacy Policy explains how Kosmik Compute s.r.o. ("Kosmik Compute", "we", "us", or "our") processes personal data and handles customer content in connection with our website, APIs, dashboards, billing flows, support channels, and AI compute services.

Controller identity

Controller: Kosmik Compute s.r.o.

Legal form: společnost s ručením omezeným, a Czech limited liability company

Registered seat: Karla Dvořáčka 608/1, 68323 Ivanovice na Hané, Czech Republic

Company ID / IČO: 29645301

Contact email: info@koscompute.com

Data Protection Officer: attorney Rostislav Buczyk

DPO contact: via info@koscompute.com or by postal mail to our registered seat, marked for the attention of the Data Protection Officer.

2. Scope

This Policy applies to:

• visitors to our website and landing pages
• customers and prospective customers
• account holders and workspace administrators
• end users whose data is submitted to our services by a customer
• anyone who contacts us by email, form, chat, or other support channel
• customer content processed through our APIs, dashboards, and AI compute services

This Policy covers both ordinary account/business data and customer content processed through Zero Data Retention endpoints. These categories are treated differently and are described separately below.

3. Definitions

• Customer content* means data submitted to or generated through our AI compute services for a customer, including prompts, completions, inputs, outputs, files, audio, images, video, generated media, tool payloads, and other request or response content.

• Operational metadata* means technical, security, routing, billing, and usage data about a request, excluding customer content.

• Zero Data Retention endpoint or ZDR endpoint* means an endpoint where customer content is processed only transiently for the purpose of completing the request and is not written to persistent storage, logs, analytics systems, monitoring systems, backups, support systems, queues, object storage, third-party model providers, or third-party cloud inference providers.

• Business records* means account, billing, tax, support, legal, security, and compliance records that we need to operate the business. Business records must not contain customer content unless the customer deliberately includes customer content in a support message or other business communication outside the inference request path.

4. Roles under data protection law

For customer content processed on a customer's documented instructions, Kosmik Compute acts as a processor or subprocessor, as applicable.

For account administration, billing, tax, security, legal compliance, our website, our own communications, and our own business operations, Kosmik Compute acts as a controller.

Where we process customer content as a processor or subprocessor, we will assist the relevant customer or controller with data subject requests as required by applicable law. We will not independently decide the purposes of processing customer content.

If required for a customer's use case, we may enter into a separate data processing agreement.

5. Data we process

Depending on how you interact with us, we may process the following categories of personal data:

• identification and contact data, such as name, email address, company name, billing details, and role
• account data, such as login details, organization membership, access rights, API keys, and authentication events
• billing and transaction data, such as invoices, payment status, payment references, credits, tax records, and billing allocation
• technical and device data, such as IP address, browser type, device identifiers, timestamps, user agent, and request metadata
• service usage data, such as request count, endpoint or model identifier, token count, request size, response size, latency, HTTP status, error code, rate-limit decision, and region
• support data, such as support messages, attachments, and correspondence with our team
• website interaction data, such as strictly necessary cookies and preference cookies
• customer content, as defined above, when submitted to or generated through our services

6. Why we process data

We process personal data for the following purposes:

• to provide, operate, secure, and maintain our website and services
• to create and manage accounts, organizations, API access, and permissions
• to authenticate users and protect accounts
• to process payments, invoices, refunds, credits, tax records, and billing allocation
• to deliver AI compute, inference, generation, and related infrastructure services requested by customers
• to monitor availability, quota, rate limits, performance, and operational reliability
• to prevent fraud, abuse, security incidents, unlawful use, and unauthorized access
• to provide support and respond to inquiries
• to comply with legal obligations
• to establish, exercise, or defend legal claims

We do not process customer content for advertising, marketing profiling, product ranking, model training, model fine-tuning, or model evaluation.

7. Legal bases

Where GDPR applies, we rely on one or more of the following legal bases:

• performance of a contract or steps before entering into a contract
• compliance with legal obligations
• our legitimate interests in operating, securing, and protecting our business and services
• consent, where required by law, for example for non-essential cookies or similar technologies

For customer content processed on behalf of a customer, the customer is responsible for determining the lawful basis for submitting that content to us.

8. Zero Data Retention commitment

For ZDR endpoints, Kosmik Compute follows Zero Data Retention for customer content.

For ZDR endpoints:

• customer content is processed only transiently for the duration of the active request
• customer content is not written to persistent storage
• customer content is not written to application logs, reverse-proxy logs, model server logs, GPU worker logs, debug logs, trace logs, analytics systems, monitoring systems, support systems, backups, queues, object storage, or persistent cache layers
• customer content is not sent to third-party model providers, cloud inference providers, analytics vendors, logging vendors, monitoring vendors, or support tools
• customer content is not used to train, fine-tune, improve, evaluate, rank, benchmark, or test models
• customer content is not manually reviewed for model improvement
• customer content is not sold, licensed, disclosed, or otherwise made available for advertising, marketing, profiling, or model training
• customer content is discarded from request-processing memory after the request is completed, fails, times out, or is cancelled

ZDR means no positive retention of customer content after the active request lifecycle. The only permitted processing of customer content on ZDR endpoints is transient processing necessary to authenticate, route, evaluate policy, execute inference or generation, return the response, and handle immediate request failure.

9. Technical implementation baseline for ZDR endpoints

The ZDR service design is intended to be implementable and auditable. ZDR endpoints must follow this baseline:

1. Transport: customer requests are accepted over encrypted transport.
2. Authentication: requests are authenticated using account credentials, API keys, or equivalent access controls.
3. Authorization and quota: requests are checked against account status, permissions, quota, rate limits, and abuse controls.
4. Processing location: customer content is processed on Kosmik Compute-controlled infrastructure located in the Czech Republic, unless a product notice or customer agreement expressly states otherwise.
5. Memory-only content handling: customer content may exist in RAM, GPU memory, process buffers, network buffers, and stream buffers only for the active request lifecycle.
6. No persistent content writes: customer content must not be written to disks, persistent volumes, databases, object storage, backup systems, analytics tools, monitoring tools, log aggregation tools, APM systems, support systems, or durable queues.
7. No third-party model routing: ZDR endpoint requests must not be routed to third-party model providers or third-party cloud inference providers.
8. Logging: logs must be content-excluding by design. Log schemas must not contain prompt text, completion text, generated output, uploaded file content, user-provided filenames, extracted text, embeddings of customer content, reversible hashes of customer content, or unsanitized exception traces.
9. Error handling: customer-facing and internal errors must use sanitized error codes and operational metadata. Exception traces must not include customer content.
10. Monitoring: monitoring must use operational metrics and metadata only, such as latency, status code, token count, request size, response size, endpoint, region, and resource utilization.
11. Abuse controls: automated policy, fraud, or abuse controls may inspect customer content transiently during the active request only, but must not store the content, content embeddings, content fingerprints, or human-readable excerpts.
12. Backups: backup jobs must exclude customer content because customer content is not written to persistent systems in the first place.
13. Support: support tools must not receive customer content from the request path. If a customer voluntarily sends customer content to support, that support message is handled as support data, not as ZDR endpoint content.
14. Failure handling: failed, timed-out, cancelled, malformed, or rejected requests are subject to the same no-persistence rule as successful requests.
15. Deletion: because ZDR customer content is not persistently stored, there is no customer-content record to retrieve, export, or delete after request completion. If an incident creates accidental persistence, it is handled under the incident process below.

10. Operational metadata

We may retain limited operational metadata needed to run, secure, meter, and bill the service.

Operational metadata may include:

• request ID
• account ID or organization ID
• API key hash or token identifier
• endpoint or model identifier
• timestamp
• request size and response size
• token count or equivalent usage count
• latency
• HTTP status, service status, or model error code
• region or routing target
• rate-limit decision
• abuse, fraud, or security score derived without storing customer content
• cost and billing allocation data
• IP address and user agent where needed for security, abuse prevention, fraud prevention, debugging, or legal compliance

Operational metadata must exclude:

• raw prompts
• completions
• generated outputs
• uploaded files
• file contents
• audio, image, or video content
• extracted text from files or media
• user-provided filenames, unless required for a customer-visible file-management feature outside a ZDR endpoint
• embeddings of customer content
• reversible hashes of customer content
• content-derived fingerprints intended to identify repeated prompts or outputs
• screenshots or recordings of customer content
• unsanitized exception traces containing customer content
• support transcripts automatically populated from customer content

11. Retention

Customer content processed through ZDR endpoints is not retained after the active request lifecycle.

Retention by category:

Where longer retention is required for security, legal, tax, accounting, or dispute purposes, we retain only the relevant business records or operational metadata. We do not convert ZDR endpoint customer content into retained business records.

12. Logging and incident handling

By design, customer content must not be logged on ZDR endpoints.

For ZDR endpoints:

• prompt logs are disabled
• completion logs are disabled
• content debug captures are disabled
• request and response bodies are excluded from access logs
• request and response bodies are excluded from reverse-proxy logs
• request and response bodies are excluded from model-server and GPU-worker logs
• crash reports and exception traces are sanitized to exclude customer content
• log aggregation, monitoring, and alerting systems receive operational metadata only

If customer content is accidentally written to a persistent system, we treat it as a security incident. The incident process includes containment, access restriction, deletion or isolation where legally and technically possible, root-cause analysis, remediation, and legally required customer or authority notification.

13. Infrastructure and datacenter

Kosmik Compute operates ZDR endpoint infrastructure on Kosmik-controlled servers located in the Czech Republic.

Our current datacenter provider is Coolhousing s.r.o. Coolhousing provides datacenter and colocation infrastructure. According to Coolhousing's public materials, its datacenter is located in Prague, contains three server rooms, and its operations/internal procedures and server-security environment are described as being in accordance with ISO 9001 and ISO 27001.

This statement describes the datacenter facility and provider environment. It does not state that Kosmik Compute itself is ISO 9001 or ISO 27001 certified.

Coolhousing is not authorised by Kosmik Compute to access, inspect, copy, administer, or process customer content. Kosmik Compute does not grant Coolhousing logical access to customer content, model requests, model responses, application logs, API systems, inference workers, customer accounts, or customer databases.

14. Subprocessors and third-party routing

As of the effective date, Kosmik Compute uses no subprocessors for customer content processed through ZDR endpoints.

For ZDR endpoints:

• no third-party model provider processes customer content
• no third-party cloud inference provider processes customer content
• no third-party logging provider receives customer content
• no third-party analytics provider receives customer content
• no third-party monitoring provider receives customer content
• no third-party support tool receives customer content from the request path
• no third-party storage, backup, object-storage, or durable-queue provider receives customer content

Coolhousing s.r.o. is the physical datacenter/colocation provider for our servers. It is not used as a logical customer-content processor for ZDR endpoint operations.

If we add a customer-content subprocessor or third-party routing path for any endpoint, we will update the relevant policy, endpoint documentation, or customer agreement before applying that change to ZDR-designated traffic. An endpoint must not be represented as ZDR if customer content is routed to a third party that retains it, trains on it, logs it, or otherwise fails to meet the ZDR commitments in this Policy.

15. Sharing of personal data

We share personal data only where necessary and lawful.

For customer content on ZDR endpoints, sharing is limited as described above: no customer-content subprocessors and no third-party model routing as of the effective date.

For business records and controller operations, we may share personal data where necessary with:

• payment processors and billing providers
• email and communications providers
• professional advisers, auditors, accountants, and legal counsel
• security, fraud-prevention, and compliance providers that process operational metadata or business records only
• authorities, courts, regulators, or other parties where required by law

Such providers must handle personal data in accordance with applicable law and, where they act as processors, our instructions.

16. International transfers

Customer content processed through ZDR endpoints is processed on Kosmik Compute-controlled infrastructure in the Czech Republic unless a product notice or customer agreement expressly states otherwise.

As of the effective date, we do not transfer ZDR endpoint customer content outside the European Economic Area.

For business records or controller operations, some providers may process data outside the European Economic Area. Where required, we use appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms.

17. Security

We use technical and organisational measures designed to protect personal data, customer data, and service infrastructure.

Our intended control set includes:

• encrypted transport for customer-facing service traffic
• network segmentation and firewall controls
• least-privilege access to production systems
• role-based access control for administrative access
• separation of customer content from retained business records and operational metadata
• content-excluding logs for ZDR endpoints
• secrets management for API keys, credentials, tokens, and signing material
• restricted administrative access to inference hosts and production systems
• access logging for administrative actions
• patching and dependency management for production systems
• change control for production deployments
• vulnerability management and remediation processes
• backup controls that exclude ZDR customer content
• incident response procedures
• periodic access review and removal of unnecessary access
• deletion or isolation procedures for accidental content persistence

No method of transmission or processing is completely secure. We design the service to reduce risk by minimizing retained data and by excluding customer content from persistent systems on ZDR endpoints.

18. Cookies and website data

We use only strictly necessary cookies by default to keep our website secure and functional.

We may use:

• session cookies for authentication and login flow
• security cookies to detect abuse and protect accounts
• preference cookies, if you choose to save website settings

We do not place non-essential cookies, analytics cookies, or marketing cookies without the required notice and, where required, your consent.

If we introduce analytics or marketing tools later, we will update this Policy and, where required, provide a consent mechanism.

Under EU and Czech privacy rules, technical cookies that are strictly necessary for a requested service may be used without a separate consent banner, but users still need clear information about how cookies work. Non-essential cookies require a lawful basis, usually consent.

19. Your rights

Subject to applicable law, you may have the right to:

• access your personal data
• correct inaccurate personal data
• delete personal data
• restrict processing
• object to processing based on legitimate interests
• withdraw consent at any time, where processing is based on consent
• receive a copy of your data in portable form, where applicable
• lodge a complaint with the Czech Data Protection Authority

For customer content processed through ZDR endpoints, we will usually be unable to retrieve, export, or delete customer content after request completion because the content is not retained. For customer content processed on behalf of a customer as processor or subprocessor, requests should normally be directed to the relevant customer or controller.

20. Customer responsibilities

Customers are responsible for:

• obtaining any necessary rights, notices, consents, and lawful bases before submitting personal data or customer content
• ensuring their use of the service complies with applicable law
• avoiding unnecessary submission of sensitive personal data unless the use case requires it and is lawful
• configuring their workflows to match their privacy, security, and compliance requirements
• reviewing and validating outputs before relying on them
• not sending customer content to support unless necessary for the support request

21. Children

Our services are not directed to children, and we do not knowingly collect personal data from children without appropriate authorization and lawful basis.

22. Changes to this Policy

We may update this Policy from time to time as our services evolve.

We will not apply a material change that weakens the ZDR commitments for ZDR-designated endpoints without updating the relevant policy, endpoint documentation, customer agreement, or product notice.

The latest version will be made available on our website with a revised effective date.

23. Contact

For privacy requests, data policy questions, or complaints, contact:

Kosmik Compute s.r.o. Karla Dvořáčka 608/1 68323 Ivanovice na Hané Czech Republic

Email: info@koscompute.com

Data Protection Officer: attorney Rostislav Buczyk DPO contact: via info@koscompute.com or by postal mail to our registered seat, marked for the attention of the Data Protection Officer.