GDPR

The EU General Data Protection Regulation (GDPR) gives you control over your personal data. This page explains each of your rights, how to use it in Cosmic Atman, and how to reach us. What we collect and why is explained in our privacy policy.

Who is responsible for your data

The controller of your personal data is COSMIC ATMAN SRL, B-dul Dacia 18, Iași, România, CUI 50880742. For anything about your data, write to care@cosmic-atman.ro.

Your rights and how to use them

• See your data (article 15). In Settings, download your data as a PDF, or everything as a JSON file. You can also ask us for a copy and for information about how we use it.
• Correct it (article 16). Change your name, email and billing details in Settings. Write to us to correct anything else.
• Delete it (article 17). Delete your account in Settings. Your account, check-ins, reflections, conversations and messages are deleted straight away, and from backups within 30 days. We keep invoices and payment records for as long as accounting law requires (10 years), and records of what Ask Atman cost without your identity.
• Restrict it (article 18). Ask us to stop using your data, except to store it, while a question about it is being resolved.
• Take it with you (article 20). The JSON export in Settings is machine-readable, so you can move your data to another service.
• Object (article 21). Object to what we do on the basis of our legitimate interests, such as security and spam prevention, by writing to us. You can unsubscribe from the newsletter from any of its emails.
• Withdraw your consent (article 7). For your health data, delete your account. For Ask Atman, simply stop using it. For the newsletter, unsubscribe. Withdrawing does not affect what happened before.
• Not be subject to automated decisions (article 22). Your readiness score, insights and tips are calculated automatically, but no decision with legal or similarly significant effects is made about you automatically.

How to make a request

• Write to care@cosmic-atman.ro from the email address of your account, so we know it's you, or use the contact form. Tell us which right you want to use.
• We reply within one month. If a request is complex or there are many, we may take up to two more months and will tell you why within the first month.
• It is free. Only if requests are clearly unfounded or excessive may we charge a reasonable fee or refuse, and we will explain why.
• If we can't be sure who is asking, we may ask you to confirm your identity first.

Where your data is processed

The app and its database are hosted in Romania. Some providers we use are outside the European Economic Area: Anthropic (United States), for Ask Atman, and Mailtrap (United States), which delivers our emails. These transfers are protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework, as applicable. Card payments are processed by NETOPIA Payments (Romania).

If something goes wrong

If a data breach is likely to put your rights and freedoms at high risk, we tell you without undue delay. Where the law requires it, we notify the Romanian data protection authority within 72 hours.

Complaints

Please contact us first, so we can try to put things right. You also have the right to complain to the Romanian data protection authority:

National Supervisory Authority for Personal Data Processing (ANSPDCP)
B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București
www.dataprotection.ro · anspdcp@dataprotection.ro

If you live in another EU country, you can also complain to the authority there.

Last updated: 5 October 2026