Privacy Policy
Last updated: June 2026
Privacy Policy
Last updated: June 2026
Privacy Policy
Last updated: June 2026
CosmeVox Privacy Policy
Last updated: 10 September 2026 · Version 1.0
This policy explains what personal data we collect when you visit cosme-vox.ai or use the CosmeVox application at app.cosme-vox.ai (together, the "Service"), why we collect it, and what rights you have.
We have written it to be read, not to be survived. If anything here is unclear, write to us and we will explain it.
1. Who is responsible for your data
The data controller is:
WONDER TECHNOLOGY SRL, Via G. Manci, 5 ‘ Trento 38122, C.F / P.IVA N. IT 02472100227 ,R.I. di Trento n. 02472100227
Email for all privacy matters: wondertechnology@pec.it
We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. Privacy questions go to the address above.
2. What CosmeVox does, in data terms
CosmeVox is an AI assistant that answers questions about beauty and personal-care products. Its answers are grounded in publicly available customer reviews and product information published on retailer websites, currently Sephora. We collect and analyse that public content in advance; when you ask a question, the assistant searches and summarises our analysis of it.
Two distinct groups of people are affected, and this policy covers both:
You, as a visitor or a registered user: Sections 3 to 10.
People who wrote the reviews we analyse: Section 11.
3. Data we process about you
3.1 When you browse cosme-vox.ai
Our website is hosted by Framer and served through Cloudflare. Their systems record technical data automatically: your IP address, browser type and version, device and operating system, referring page, the pages you view and the time of your visit. This happens for every website and is necessary to deliver the page and to protect it from attack.
The marketing site also uses Framer's own aggregate page-view statistics, which do not set cookies and do not identify you individually, and it loads web fonts. Anything that is not strictly necessary runs only if you consent through our cookie banner. See the Cookie Policy for the full list.
3.2 When you create an account
Sign-in is handled by Auth0, an Okta service, which we use as our authentication platform. Our Auth0 tenant is hosted in the European Union. You choose to sign in with your Google account, and Google passes to us, through Auth0: your name, your email address, your Google account identifier, and your profile picture if you have one. We never receive your Google password and we have no access to your Google account beyond those details.
We then create and store: your account record, the date you registered, your plan tier, your remaining usage credits, and your session state.
3.3 When you use the assistant
The assistant is available only after you sign in. Once signed in, we process:
the questions you type, and the answers the assistant produces;
technical metadata about each exchange: timestamps, which AI model was used, how many tokens were consumed, how many credits were deducted, latency, and any errors;
usage counters used to enforce rate limits, credit caps and abuse controls.
Prompts and responses pass through Langfuse, an observability tool we use to trace how the assistant behaves, debug faults, monitor cost and investigate abuse. This means the text of your questions is stored for a limited period. See Section 7.
Please do not type personal data, health information, or anything confidential into the chat. CosmeVox asks about products, not about you, and there is no reason to tell it who you are.
3.4 When you contact us or ask about a paid plan
If you use a contact or upgrade form, we process what you put in it: typically your name, email address, company and message, plus the date it was sent. These forms are handled by Mailchimp, which stores the submission on our behalf.
3.5 Security and abuse prevention
We process technical signals to detect and stop rate-limit evasion, automated scraping, the creation of multiple accounts to farm free credits, and attempts to manipulate the assistant through prompt injection.
4. Why we process it, and on what legal basis
What we do | Why | Legal basis (Art. 6 GDPR) |
|---|---|---|
Create and run your account; answer your questions | To provide the Service you signed up for | Performance of a contract, Art. 6(1)(b) |
Deliver and secure the website | So the site loads and stays available | Legitimate interest, Art. 6(1)(f) |
Enforce credit limits, rate limits and spend caps | To keep a free service viable and fair | Legitimate interest, Art. 6(1)(f) |
Trace prompts and responses (Langfuse) | To debug faults, monitor quality and cost, and investigate abuse | Legitimate interest, Art. 6(1)(f) |
Detect and prevent abuse and fraud | To protect the Service and its users | Legitimate interest, Art. 6(1)(f) |
Measure how the Service is used, in aggregate | To decide whether to keep building it | Consent where trackers are involved, Art. 6(1)(a); otherwise legitimate interest, Art. 6(1)(f) |
Non-essential cookies and similar technologies | See Cookie Policy | Consent, Art. 6(1)(a) |
Reply to your enquiries | To answer you and, where relevant, discuss a plan | Pre-contractual steps / legitimate interest, Art. 6(1)(b), 6(1)(f) |
Comply with legal duties and defend legal claims | Because we must | Legal obligation / legitimate interest, Art. 6(1)(c), 6(1)(f) |
Where we rely on legitimate interest, we have weighed our interest against your rights and concluded it does not override them. You can ask us for the reasoning, and you can object. See Section 9.
We do not sell your personal data. We do not use it for behavioural advertising.
5. Artificial intelligence, and what happens to your prompts
CosmeVox is an artificial intelligence system. You are interacting with an AI, not a person, and its answers are generated automatically.
To produce an answer, your question, together with relevant extracts from our analysed review data, is sent to a third-party large-language-model provider that performs the inference. Our model providers are OpenAI and Anthropic. They act as our processors and are contractually prohibited from using your inputs or the resulting outputs to train their models. We do not use your prompts to train any model of our own either.
Some of this inference takes place outside the European Economic Area. See Section 8.
The assistant does not make any decision that produces legal effects for you or similarly significantly affects you within the meaning of Article 22 GDPR. It answers questions about products.
6. Who receives your data
We share personal data only with the following categories of recipient, and only as far as each needs it:
Companies within our corporate group that operate the technical infrastructure, data pipeline and analysis platform behind the Service, acting as our processors under a written data-processing agreement;
Cloud hosting and infrastructure providers, whose systems in the European Union store and process the data;
AI model providers (OpenAI, Anthropic), for the inference described in Section 5;
Website hosting, DNS and content-delivery providers (Framer, Cloudflare);
Our authentication platform (Auth0, an Okta company) and the sign-in provider you use with it (Google);
Observability and analytics providers (Langfuse for tracing the assistant, Framer for aggregate website statistics);
Email and forms providers (Mailchimp) used to receive and respond to enquiries;
Professional advisers (lawyers, accountants, auditors) under a duty of confidentiality;
Public authorities, where the law requires it.
Every processor is bound by a contract meeting Article 28 GDPR. If you would like the specific list of the companies in these categories, ask us at support@cosme-vox.ai and we will send it to you.
7. How long we keep it
Data | Retention |
|---|---|
Account data (profile, tier, credits) | For as long as your account exists, then deleted within 30 days of closure |
Chat prompts, responses and traces | 90 days from the exchange, then deleted |
Aggregated, non-identifying usage statistics | Indefinitely, as these no longer identify you |
Server and security logs | 12 months |
Contact and upgrade enquiries, including in Mailchimp | 24 months from the last message |
Cookie consent records | 12 months, then we ask again |
Anything needed for a legal claim | Until the claim and any appeal period ends |
8. Transfers outside the EEA
Our storage and analysis infrastructure is in the European Union.
AI model inference takes place partly in the United States, at OpenAI and Anthropic. Those transfers are covered by the European Commission's Standard Contractual Clauses and, where the provider is certified, by the EU–US Data Privacy Framework, together with supplementary measures where needed. Our authentication platform runs on EU infrastructure, but its provider is part of a US group, so support and administration may involve transfers on the same footing. The Google sign-in service and Mailchimp may also involve transfers, on the same basis.
You can request a copy of the safeguards from support@cosme-vox.ai.
9. Your rights
Under Articles 15 to 22 GDPR you can ask us to:
give you a copy of your personal data, and tell you how we process it;
correct anything inaccurate or incomplete;
delete your data, including by closing your account, which you can do at any time;
restrict processing while a dispute about it is resolved;
port the data you gave us to another provider, in a machine-readable format;
object to processing based on legitimate interest, on grounds relating to your situation;
withdraw consent at any time, where consent is the basis. This does not affect what we did before you withdrew it.
Write to support@cosme-vox.ai. We reply within one month, and will tell you if we need longer. Exercising these rights is free.
If you think we have got it wrong, you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl, or to the authority where you live or work.
10. Children
CosmeVox is not intended for children. You must be at least 16 to create an account. If we learn that we hold data about a child below that age, we delete it. If you are a parent or guardian and believe we do, write to support@cosme-vox.ai.
11. Reviews and the people who wrote them
This section is for people whose reviews appear in the data CosmeVox analyses, rather than for users of the Service.
What we process. We collect product reviews and related content published openly on retailer websites. As published, a review carries the nickname its author chose, a rating, a date and free text.
Two things limit what this amounts to in practice. Before review text enters our analysis we strip direct identifiers from it, such as email addresses and telephone numbers. And nicknames are never shown in CosmeVox: the assistant presents aggregate findings, not individual reviewers. We collect no account credentials and nothing behind a login, and we have no access to any retailer's user database, so we cannot connect a nickname to a named person.
What we do with it. We analyse this content in aggregate, extracting topics, sentiment and trends across many reviews, so that the assistant can answer questions like "what do people say about this moisturiser". Our purpose is aggregate market analysis, not profiling individuals. We do not attempt to identify review authors, we do not enrich review data with data from other sources to build profiles, and we do not target anyone on the basis of it.
Legal basis. Legitimate interest under Article 6(1)(f), in analysing publicly published opinions about consumer products. We have carried out a balancing assessment, which takes account of the measures above, and you can request a summary of it.
Where it came from. We obtain this content from public retailer websites; we did not obtain it from you directly (Article 14 GDPR). Because we hold no contact details for review authors and no reliable means to identify them, notifying each author individually would involve disproportionate effort within the meaning of Article 14(5)(b), so we publish this notice instead.
Sensitive content. Reviews sometimes mention health, skin or hair conditions, or other sensitive matters that their authors chose to publish. We do not seek such information out, we do not use it to target or single out any individual, and it reaches users only as part of aggregate analysis.
Your rights. If you wrote a review that you believe we hold and you want it removed from our analysis, write to support@cosme-vox.ai with enough detail for us to locate it. The same rights in Section 9 apply, including the right to object.
12. Changes to this policy
If we change how we handle personal data we will update this page and change the date at the top. For significant changes we will tell registered users by email or in the application before the change takes effect.
13. Contact
WONDER TECHNOLOGY SRL, Via G. Manci, 5 ‘ Trento 38122, C.F / P.IVA N. IT 02472100227 ,R.I. di Trento n. 02472100227, Email for all privacy matters: wondertechnology@pec.it
CosmeVox Privacy Policy
Last updated: 10 September 2026 · Version 1.0
This policy explains what personal data we collect when you visit cosme-vox.ai or use the CosmeVox application at app.cosme-vox.ai (together, the "Service"), why we collect it, and what rights you have.
We have written it to be read, not to be survived. If anything here is unclear, write to us and we will explain it.
1. Who is responsible for your data
The data controller is:
WONDER TECHNOLOGY SRL, Via G. Manci, 5 ‘ Trento 38122, C.F / P.IVA N. IT 02472100227 ,R.I. di Trento n. 02472100227
Email for all privacy matters: wondertechnology@pec.it
We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. Privacy questions go to the address above.
2. What CosmeVox does, in data terms
CosmeVox is an AI assistant that answers questions about beauty and personal-care products. Its answers are grounded in publicly available customer reviews and product information published on retailer websites, currently Sephora. We collect and analyse that public content in advance; when you ask a question, the assistant searches and summarises our analysis of it.
Two distinct groups of people are affected, and this policy covers both:
You, as a visitor or a registered user: Sections 3 to 10.
People who wrote the reviews we analyse: Section 11.
3. Data we process about you
3.1 When you browse cosme-vox.ai
Our website is hosted by Framer and served through Cloudflare. Their systems record technical data automatically: your IP address, browser type and version, device and operating system, referring page, the pages you view and the time of your visit. This happens for every website and is necessary to deliver the page and to protect it from attack.
The marketing site also uses Framer's own aggregate page-view statistics, which do not set cookies and do not identify you individually, and it loads web fonts. Anything that is not strictly necessary runs only if you consent through our cookie banner. See the Cookie Policy for the full list.
3.2 When you create an account
Sign-in is handled by Auth0, an Okta service, which we use as our authentication platform. Our Auth0 tenant is hosted in the European Union. You choose to sign in with your Google account, and Google passes to us, through Auth0: your name, your email address, your Google account identifier, and your profile picture if you have one. We never receive your Google password and we have no access to your Google account beyond those details.
We then create and store: your account record, the date you registered, your plan tier, your remaining usage credits, and your session state.
3.3 When you use the assistant
The assistant is available only after you sign in. Once signed in, we process:
the questions you type, and the answers the assistant produces;
technical metadata about each exchange: timestamps, which AI model was used, how many tokens were consumed, how many credits were deducted, latency, and any errors;
usage counters used to enforce rate limits, credit caps and abuse controls.
Prompts and responses pass through Langfuse, an observability tool we use to trace how the assistant behaves, debug faults, monitor cost and investigate abuse. This means the text of your questions is stored for a limited period. See Section 7.
Please do not type personal data, health information, or anything confidential into the chat. CosmeVox asks about products, not about you, and there is no reason to tell it who you are.
3.4 When you contact us or ask about a paid plan
If you use a contact or upgrade form, we process what you put in it: typically your name, email address, company and message, plus the date it was sent. These forms are handled by Mailchimp, which stores the submission on our behalf.
3.5 Security and abuse prevention
We process technical signals to detect and stop rate-limit evasion, automated scraping, the creation of multiple accounts to farm free credits, and attempts to manipulate the assistant through prompt injection.
4. Why we process it, and on what legal basis
What we do | Why | Legal basis (Art. 6 GDPR) |
|---|---|---|
Create and run your account; answer your questions | To provide the Service you signed up for | Performance of a contract, Art. 6(1)(b) |
Deliver and secure the website | So the site loads and stays available | Legitimate interest, Art. 6(1)(f) |
Enforce credit limits, rate limits and spend caps | To keep a free service viable and fair | Legitimate interest, Art. 6(1)(f) |
Trace prompts and responses (Langfuse) | To debug faults, monitor quality and cost, and investigate abuse | Legitimate interest, Art. 6(1)(f) |
Detect and prevent abuse and fraud | To protect the Service and its users | Legitimate interest, Art. 6(1)(f) |
Measure how the Service is used, in aggregate | To decide whether to keep building it | Consent where trackers are involved, Art. 6(1)(a); otherwise legitimate interest, Art. 6(1)(f) |
Non-essential cookies and similar technologies | See Cookie Policy | Consent, Art. 6(1)(a) |
Reply to your enquiries | To answer you and, where relevant, discuss a plan | Pre-contractual steps / legitimate interest, Art. 6(1)(b), 6(1)(f) |
Comply with legal duties and defend legal claims | Because we must | Legal obligation / legitimate interest, Art. 6(1)(c), 6(1)(f) |
Where we rely on legitimate interest, we have weighed our interest against your rights and concluded it does not override them. You can ask us for the reasoning, and you can object. See Section 9.
We do not sell your personal data. We do not use it for behavioural advertising.
5. Artificial intelligence, and what happens to your prompts
CosmeVox is an artificial intelligence system. You are interacting with an AI, not a person, and its answers are generated automatically.
To produce an answer, your question, together with relevant extracts from our analysed review data, is sent to a third-party large-language-model provider that performs the inference. Our model providers are OpenAI and Anthropic. They act as our processors and are contractually prohibited from using your inputs or the resulting outputs to train their models. We do not use your prompts to train any model of our own either.
Some of this inference takes place outside the European Economic Area. See Section 8.
The assistant does not make any decision that produces legal effects for you or similarly significantly affects you within the meaning of Article 22 GDPR. It answers questions about products.
6. Who receives your data
We share personal data only with the following categories of recipient, and only as far as each needs it:
Companies within our corporate group that operate the technical infrastructure, data pipeline and analysis platform behind the Service, acting as our processors under a written data-processing agreement;
Cloud hosting and infrastructure providers, whose systems in the European Union store and process the data;
AI model providers (OpenAI, Anthropic), for the inference described in Section 5;
Website hosting, DNS and content-delivery providers (Framer, Cloudflare);
Our authentication platform (Auth0, an Okta company) and the sign-in provider you use with it (Google);
Observability and analytics providers (Langfuse for tracing the assistant, Framer for aggregate website statistics);
Email and forms providers (Mailchimp) used to receive and respond to enquiries;
Professional advisers (lawyers, accountants, auditors) under a duty of confidentiality;
Public authorities, where the law requires it.
Every processor is bound by a contract meeting Article 28 GDPR. If you would like the specific list of the companies in these categories, ask us at support@cosme-vox.ai and we will send it to you.
7. How long we keep it
Data | Retention |
|---|---|
Account data (profile, tier, credits) | For as long as your account exists, then deleted within 30 days of closure |
Chat prompts, responses and traces | 90 days from the exchange, then deleted |
Aggregated, non-identifying usage statistics | Indefinitely, as these no longer identify you |
Server and security logs | 12 months |
Contact and upgrade enquiries, including in Mailchimp | 24 months from the last message |
Cookie consent records | 12 months, then we ask again |
Anything needed for a legal claim | Until the claim and any appeal period ends |
8. Transfers outside the EEA
Our storage and analysis infrastructure is in the European Union.
AI model inference takes place partly in the United States, at OpenAI and Anthropic. Those transfers are covered by the European Commission's Standard Contractual Clauses and, where the provider is certified, by the EU–US Data Privacy Framework, together with supplementary measures where needed. Our authentication platform runs on EU infrastructure, but its provider is part of a US group, so support and administration may involve transfers on the same footing. The Google sign-in service and Mailchimp may also involve transfers, on the same basis.
You can request a copy of the safeguards from support@cosme-vox.ai.
9. Your rights
Under Articles 15 to 22 GDPR you can ask us to:
give you a copy of your personal data, and tell you how we process it;
correct anything inaccurate or incomplete;
delete your data, including by closing your account, which you can do at any time;
restrict processing while a dispute about it is resolved;
port the data you gave us to another provider, in a machine-readable format;
object to processing based on legitimate interest, on grounds relating to your situation;
withdraw consent at any time, where consent is the basis. This does not affect what we did before you withdrew it.
Write to support@cosme-vox.ai. We reply within one month, and will tell you if we need longer. Exercising these rights is free.
If you think we have got it wrong, you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl, or to the authority where you live or work.
10. Children
CosmeVox is not intended for children. You must be at least 16 to create an account. If we learn that we hold data about a child below that age, we delete it. If you are a parent or guardian and believe we do, write to support@cosme-vox.ai.
11. Reviews and the people who wrote them
This section is for people whose reviews appear in the data CosmeVox analyses, rather than for users of the Service.
What we process. We collect product reviews and related content published openly on retailer websites. As published, a review carries the nickname its author chose, a rating, a date and free text.
Two things limit what this amounts to in practice. Before review text enters our analysis we strip direct identifiers from it, such as email addresses and telephone numbers. And nicknames are never shown in CosmeVox: the assistant presents aggregate findings, not individual reviewers. We collect no account credentials and nothing behind a login, and we have no access to any retailer's user database, so we cannot connect a nickname to a named person.
What we do with it. We analyse this content in aggregate, extracting topics, sentiment and trends across many reviews, so that the assistant can answer questions like "what do people say about this moisturiser". Our purpose is aggregate market analysis, not profiling individuals. We do not attempt to identify review authors, we do not enrich review data with data from other sources to build profiles, and we do not target anyone on the basis of it.
Legal basis. Legitimate interest under Article 6(1)(f), in analysing publicly published opinions about consumer products. We have carried out a balancing assessment, which takes account of the measures above, and you can request a summary of it.
Where it came from. We obtain this content from public retailer websites; we did not obtain it from you directly (Article 14 GDPR). Because we hold no contact details for review authors and no reliable means to identify them, notifying each author individually would involve disproportionate effort within the meaning of Article 14(5)(b), so we publish this notice instead.
Sensitive content. Reviews sometimes mention health, skin or hair conditions, or other sensitive matters that their authors chose to publish. We do not seek such information out, we do not use it to target or single out any individual, and it reaches users only as part of aggregate analysis.
Your rights. If you wrote a review that you believe we hold and you want it removed from our analysis, write to support@cosme-vox.ai with enough detail for us to locate it. The same rights in Section 9 apply, including the right to object.
12. Changes to this policy
If we change how we handle personal data we will update this page and change the date at the top. For significant changes we will tell registered users by email or in the application before the change takes effect.
13. Contact
WONDER TECHNOLOGY SRL, Via G. Manci, 5 ‘ Trento 38122, C.F / P.IVA N. IT 02472100227 ,R.I. di Trento n. 02472100227, Email for all privacy matters: wondertechnology@pec.it
CosmeVox Privacy Policy
Last updated: 10 September 2026 · Version 1.0
This policy explains what personal data we collect when you visit cosme-vox.ai or use the CosmeVox application at app.cosme-vox.ai (together, the "Service"), why we collect it, and what rights you have.
We have written it to be read, not to be survived. If anything here is unclear, write to us and we will explain it.
1. Who is responsible for your data
The data controller is:
WONDER TECHNOLOGY SRL, Via G. Manci, 5 ‘ Trento 38122, C.F / P.IVA N. IT 02472100227 ,R.I. di Trento n. 02472100227
Email for all privacy matters: wondertechnology@pec.it
We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. Privacy questions go to the address above.
2. What CosmeVox does, in data terms
CosmeVox is an AI assistant that answers questions about beauty and personal-care products. Its answers are grounded in publicly available customer reviews and product information published on retailer websites, currently Sephora. We collect and analyse that public content in advance; when you ask a question, the assistant searches and summarises our analysis of it.
Two distinct groups of people are affected, and this policy covers both:
You, as a visitor or a registered user: Sections 3 to 10.
People who wrote the reviews we analyse: Section 11.
3. Data we process about you
3.1 When you browse cosme-vox.ai
Our website is hosted by Framer and served through Cloudflare. Their systems record technical data automatically: your IP address, browser type and version, device and operating system, referring page, the pages you view and the time of your visit. This happens for every website and is necessary to deliver the page and to protect it from attack.
The marketing site also uses Framer's own aggregate page-view statistics, which do not set cookies and do not identify you individually, and it loads web fonts. Anything that is not strictly necessary runs only if you consent through our cookie banner. See the Cookie Policy for the full list.
3.2 When you create an account
Sign-in is handled by Auth0, an Okta service, which we use as our authentication platform. Our Auth0 tenant is hosted in the European Union. You choose to sign in with your Google account, and Google passes to us, through Auth0: your name, your email address, your Google account identifier, and your profile picture if you have one. We never receive your Google password and we have no access to your Google account beyond those details.
We then create and store: your account record, the date you registered, your plan tier, your remaining usage credits, and your session state.
3.3 When you use the assistant
The assistant is available only after you sign in. Once signed in, we process:
the questions you type, and the answers the assistant produces;
technical metadata about each exchange: timestamps, which AI model was used, how many tokens were consumed, how many credits were deducted, latency, and any errors;
usage counters used to enforce rate limits, credit caps and abuse controls.
Prompts and responses pass through Langfuse, an observability tool we use to trace how the assistant behaves, debug faults, monitor cost and investigate abuse. This means the text of your questions is stored for a limited period. See Section 7.
Please do not type personal data, health information, or anything confidential into the chat. CosmeVox asks about products, not about you, and there is no reason to tell it who you are.
3.4 When you contact us or ask about a paid plan
If you use a contact or upgrade form, we process what you put in it: typically your name, email address, company and message, plus the date it was sent. These forms are handled by Mailchimp, which stores the submission on our behalf.
3.5 Security and abuse prevention
We process technical signals to detect and stop rate-limit evasion, automated scraping, the creation of multiple accounts to farm free credits, and attempts to manipulate the assistant through prompt injection.
4. Why we process it, and on what legal basis
What we do | Why | Legal basis (Art. 6 GDPR) |
|---|---|---|
Create and run your account; answer your questions | To provide the Service you signed up for | Performance of a contract, Art. 6(1)(b) |
Deliver and secure the website | So the site loads and stays available | Legitimate interest, Art. 6(1)(f) |
Enforce credit limits, rate limits and spend caps | To keep a free service viable and fair | Legitimate interest, Art. 6(1)(f) |
Trace prompts and responses (Langfuse) | To debug faults, monitor quality and cost, and investigate abuse | Legitimate interest, Art. 6(1)(f) |
Detect and prevent abuse and fraud | To protect the Service and its users | Legitimate interest, Art. 6(1)(f) |
Measure how the Service is used, in aggregate | To decide whether to keep building it | Consent where trackers are involved, Art. 6(1)(a); otherwise legitimate interest, Art. 6(1)(f) |
Non-essential cookies and similar technologies | See Cookie Policy | Consent, Art. 6(1)(a) |
Reply to your enquiries | To answer you and, where relevant, discuss a plan | Pre-contractual steps / legitimate interest, Art. 6(1)(b), 6(1)(f) |
Comply with legal duties and defend legal claims | Because we must | Legal obligation / legitimate interest, Art. 6(1)(c), 6(1)(f) |
Where we rely on legitimate interest, we have weighed our interest against your rights and concluded it does not override them. You can ask us for the reasoning, and you can object. See Section 9.
We do not sell your personal data. We do not use it for behavioural advertising.
5. Artificial intelligence, and what happens to your prompts
CosmeVox is an artificial intelligence system. You are interacting with an AI, not a person, and its answers are generated automatically.
To produce an answer, your question, together with relevant extracts from our analysed review data, is sent to a third-party large-language-model provider that performs the inference. Our model providers are OpenAI and Anthropic. They act as our processors and are contractually prohibited from using your inputs or the resulting outputs to train their models. We do not use your prompts to train any model of our own either.
Some of this inference takes place outside the European Economic Area. See Section 8.
The assistant does not make any decision that produces legal effects for you or similarly significantly affects you within the meaning of Article 22 GDPR. It answers questions about products.
6. Who receives your data
We share personal data only with the following categories of recipient, and only as far as each needs it:
Companies within our corporate group that operate the technical infrastructure, data pipeline and analysis platform behind the Service, acting as our processors under a written data-processing agreement;
Cloud hosting and infrastructure providers, whose systems in the European Union store and process the data;
AI model providers (OpenAI, Anthropic), for the inference described in Section 5;
Website hosting, DNS and content-delivery providers (Framer, Cloudflare);
Our authentication platform (Auth0, an Okta company) and the sign-in provider you use with it (Google);
Observability and analytics providers (Langfuse for tracing the assistant, Framer for aggregate website statistics);
Email and forms providers (Mailchimp) used to receive and respond to enquiries;
Professional advisers (lawyers, accountants, auditors) under a duty of confidentiality;
Public authorities, where the law requires it.
Every processor is bound by a contract meeting Article 28 GDPR. If you would like the specific list of the companies in these categories, ask us at support@cosme-vox.ai and we will send it to you.
7. How long we keep it
Data | Retention |
|---|---|
Account data (profile, tier, credits) | For as long as your account exists, then deleted within 30 days of closure |
Chat prompts, responses and traces | 90 days from the exchange, then deleted |
Aggregated, non-identifying usage statistics | Indefinitely, as these no longer identify you |
Server and security logs | 12 months |
Contact and upgrade enquiries, including in Mailchimp | 24 months from the last message |
Cookie consent records | 12 months, then we ask again |
Anything needed for a legal claim | Until the claim and any appeal period ends |
8. Transfers outside the EEA
Our storage and analysis infrastructure is in the European Union.
AI model inference takes place partly in the United States, at OpenAI and Anthropic. Those transfers are covered by the European Commission's Standard Contractual Clauses and, where the provider is certified, by the EU–US Data Privacy Framework, together with supplementary measures where needed. Our authentication platform runs on EU infrastructure, but its provider is part of a US group, so support and administration may involve transfers on the same footing. The Google sign-in service and Mailchimp may also involve transfers, on the same basis.
You can request a copy of the safeguards from support@cosme-vox.ai.
9. Your rights
Under Articles 15 to 22 GDPR you can ask us to:
give you a copy of your personal data, and tell you how we process it;
correct anything inaccurate or incomplete;
delete your data, including by closing your account, which you can do at any time;
restrict processing while a dispute about it is resolved;
port the data you gave us to another provider, in a machine-readable format;
object to processing based on legitimate interest, on grounds relating to your situation;
withdraw consent at any time, where consent is the basis. This does not affect what we did before you withdrew it.
Write to support@cosme-vox.ai. We reply within one month, and will tell you if we need longer. Exercising these rights is free.
If you think we have got it wrong, you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl, or to the authority where you live or work.
10. Children
CosmeVox is not intended for children. You must be at least 16 to create an account. If we learn that we hold data about a child below that age, we delete it. If you are a parent or guardian and believe we do, write to support@cosme-vox.ai.
11. Reviews and the people who wrote them
This section is for people whose reviews appear in the data CosmeVox analyses, rather than for users of the Service.
What we process. We collect product reviews and related content published openly on retailer websites. As published, a review carries the nickname its author chose, a rating, a date and free text.
Two things limit what this amounts to in practice. Before review text enters our analysis we strip direct identifiers from it, such as email addresses and telephone numbers. And nicknames are never shown in CosmeVox: the assistant presents aggregate findings, not individual reviewers. We collect no account credentials and nothing behind a login, and we have no access to any retailer's user database, so we cannot connect a nickname to a named person.
What we do with it. We analyse this content in aggregate, extracting topics, sentiment and trends across many reviews, so that the assistant can answer questions like "what do people say about this moisturiser". Our purpose is aggregate market analysis, not profiling individuals. We do not attempt to identify review authors, we do not enrich review data with data from other sources to build profiles, and we do not target anyone on the basis of it.
Legal basis. Legitimate interest under Article 6(1)(f), in analysing publicly published opinions about consumer products. We have carried out a balancing assessment, which takes account of the measures above, and you can request a summary of it.
Where it came from. We obtain this content from public retailer websites; we did not obtain it from you directly (Article 14 GDPR). Because we hold no contact details for review authors and no reliable means to identify them, notifying each author individually would involve disproportionate effort within the meaning of Article 14(5)(b), so we publish this notice instead.
Sensitive content. Reviews sometimes mention health, skin or hair conditions, or other sensitive matters that their authors chose to publish. We do not seek such information out, we do not use it to target or single out any individual, and it reaches users only as part of aggregate analysis.
Your rights. If you wrote a review that you believe we hold and you want it removed from our analysis, write to support@cosme-vox.ai with enough detail for us to locate it. The same rights in Section 9 apply, including the right to object.
12. Changes to this policy
If we change how we handle personal data we will update this page and change the date at the top. For significant changes we will tell registered users by email or in the application before the change takes effect.
13. Contact
WONDER TECHNOLOGY SRL, Via G. Manci, 5 ‘ Trento 38122, C.F / P.IVA N. IT 02472100227 ,R.I. di Trento n. 02472100227, Email for all privacy matters: wondertechnology@pec.it
ASK COSMEVOX
Your next brief starts with a .question
No credit card. Answers in seconds, sourced.
ASK COSMEVOX
Your next brief starts with a .question
No credit card. Answers in seconds, sourced.
ASK COSMEVOX
Your next brief starts with a .question
No credit card. Answers in seconds, sourced.
.SHARP .DATA-FIRST .BEAUTY-NATIVE
RESOURCES
SOCIAL
© 2026 CosmeVox | All Rights Reserved
.SHARP .DATA-FIRST .BEAUTY-NATIVE
RESOURCES
SOCIAL
© 2026 CosmeVox | All Rights Reserved
.SHARP .DATA-FIRST .BEAUTY-NATIVE
RESOURCES
SOCIAL
© 2026 CosmeVox | All Rights Reserved