Legal

Privacy

This policy explains what personal data Cosmic Atman collects, why, who it is shared with, how long it is kept and what your rights are under the EU General Data Protection Regulation (GDPR).

Who we are

Cosmic Atman is operated by COSMIC ATMAN SRL, B-dul Dacia 18, Iasi, Ro, CUI: 50880742, who is the controller of your personal data. Contact: care@cosmic-atman.ro

What we collect

  • Account details: your name, email, password (stored hashed), your language and, if you choose, a phone number.
  • Check-ins: your daily ratings, the habits and influences you select, whether you ticked "I'm really struggling today", and any note you write. Notes are encrypted at rest.
  • Body numbers: if you add them, your hours of sleep and your heart rate after waking. They are used only to calculate your readiness.
  • Reflections and conversations: if you use Ask Atman, the AI-written reflection and your questions and Atman's answers are stored with that day, encrypted at rest.
  • Subscription: your plan, its status and dates, and notes about payments. Card details are entered on the payment page of NETOPIA Payments; we never see or store your card number.
  • Consents: when you agreed to the processing of your health data, to these terms and, if you did, to the care team.
  • Security data: the IP address you signed up from, login sessions and server logs, used to keep out spam and abuse and to keep the service secure.

Your health data

What you enter in your check-ins can reveal information about your physical or mental health: your mood, calm, energy and body ratings, sleep and heart rate, habits such as alcohol or smoking, whether you are struggling, your notes, and your reflections and conversations with Atman. Under the GDPR (article 9) this is a special category of personal data.

  • We process it only with your explicit consent, which you give at sign-up by ticking a separate box. We record when you gave it.
  • We use it only to provide the service to you: your readiness, insights, plan, journey, My days, exports and, if you ask, Atman's reflections.
  • We never sell it, never use it for advertising, and never share it with employers, insurers or data brokers.
  • Body numbers and notes are optional. Leave them out if you prefer.
  • You can withdraw your consent at any time by deleting your account in Settings, or by writing to us. Withdrawing does not affect processing that happened before.

Why we use your data, and on what legal basis

  • To run your account and the service: performance of our contract with you (GDPR article 6(1)(b)).
  • Health data in your check-ins: your explicit consent (articles 6(1)(a) and 9(2)(a)).
  • Ask Atman: your explicit consent, given each time you press Ask Atman or send Atman a question.
  • The newsletter (daily inspiration, news and offers): your consent, given by ticking the box and confirmed by email. As proof, we keep when you agreed, the text you agreed to and your IP address at that moment. You can unsubscribe from any email.
  • Security, spam prevention and blocking misuse: our legitimate interest in keeping the service safe (article 6(1)(f)).
  • Invoices and payment records: our legal obligations under accounting and tax law (article 6(1)(c)).

Ask Atman and our AI provider, Anthropic

Ask Atman is powered by Claude, an AI model made by Anthropic. Nothing is sent to Anthropic unless you press Ask Atman or send Atman a question.

  • What is sent: that day's ratings, the habits and influences you selected, whether you ticked "I'm really struggling today", your readiness on recent days, your note, and, for questions, the reflection and your conversation that day. Your name, email and phone number are not sent.
  • Anthropic processes this on our behalf, as our processor, under its commercial terms and data processing addendum.
  • Anthropic may keep the data for a limited time to detect and prevent misuse.
  • Anthropic processes data in the United States. The transfer is protected by the EU Standard Contractual Clauses in Anthropic's data processing addendum.
  • Please don't write other people's names or private details in notes or questions you send to Atman.

Who can see it

Only you can see your check-ins.

We use these service providers (processors), each bound by a contract to protect your data:

  • Anthropic, for Ask Atman (see above).
  • ROMARG SRL, Romania, which hosts the app and database.
  • Mailtrap.io, USA, which delivers our emails.
  • Netopia Financial Services S.A. (Romania), which processes card payments for Plus through NETOPIA Payments.

We disclose data to authorities only when the law requires it.

How long we keep it

  • Your account, check-ins, reflections and conversations: until you delete your account. They are then deleted straight away from the live database, and from backups within 30 days.
  • Accounts whose email is never confirmed: deleted after 7 days.
  • Records of what Ask Atman cost: kept for our accounts, without your identity once your account is deleted.
  • Payment records and invoices: for as long as accounting and tax law requires (10 years in Romania).
  • Server logs: 30 days.
  • Newsletter subscription and the proof of consent: until you unsubscribe, and the proof for 3 more years, in case we need to show you agreed.

How we protect it

Notes, reflections and conversations are encrypted at rest, passwords are stored hashed, every connection uses HTTPS, access by our team is limited to what their role needs, and new accounts must confirm their email.

Your choices and rights

Under the GDPR you have the right to:

  • access your data and get a copy (Settings: PDF, or a complete JSON file);
  • correct it (Settings, or write to us);
  • have it deleted (Settings: delete account);
  • take it with you in a machine-readable format (the JSON export);
  • restrict or object to processing based on our legitimate interests;
  • withdraw your consent at any time, without affecting what happened before;
  • not be subject to a decision based solely on automated processing that significantly affects you.

How to use each right is explained on our GDPR page.

Write to care@cosmic-atman.ro; we reply within one month. You can also complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or to the authority in the EU country where you live.

Age

Cosmic Atman is meant for people aged 18 and over. If we learn that an account belongs to someone younger, we delete it.

Cookies

We use only the cookies needed for the site to work: your login session, security against forged forms, and your language. We don't use advertising or tracking cookies, so we don't ask for cookie consent.

Changes to this policy

If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect, and ask for your consent again where the law requires it.

Last updated: 8 October 2026