Privacy Policy

CosmoQuick HRM ("we", "us", "our") is operated by CosmoQuick, a paid product for employer customers of cosmoquick.com. This policy explains what data we collect, why, and how we protect it.

1. What we collect. Account identity (name, email, avatar) via your CosmoQuick account. People data you upload into the HRM (employee records, candidate records, documents). Telemetry (page views, feature usage) to improve the product. We do NOT sell data, ever.

2. Why we collect it. To deliver the HRM service, prevent abuse, comply with law, and improve features. AI Copilot prompts are processed by our model providers (Google, OpenAI) under their data-processing agreements — your prompts are NOT used to train models.

3. Where it lives. On Lovable Cloud (built on Supabase), encrypted at rest with AES-256, in your selected region (EU / US / India). TLS 1.3 in transit. Backups retained for 30 days.

4. Who can access it. Only your authorized users (per your RBAC settings) and CosmoQuick staff under strict need-to-know, logged for audit. Sub-processors: Lovable Cloud (hosting), Resend (email), Google (Gemini), OpenAI (GPT). Full list at /legal/dpa.

5. Your rights. Access, export, correct, or delete your data anytime from Settings → Privacy, or by emailing privacy@cosmoquick.com. We honor GDPR and CCPA rights within 30 days.

6. Retention. Active data: as long as your CosmoQuick employer plan is active. Deletion: 90 days after account closure, after which we keep only legally required records (tax, payroll).

7. Children. CosmoQuick HRM is not for users under 16.

8. International transfers. SCCs in place. Choose EU residency in Settings → Data Residency.

9. Changes. Material changes will be emailed 30 days in advance.

Questions: privacy@cosmoquick.com.