How Kosmico processes information when you connect selected cloud projects to ChatGPT or Codex.
Scope and controller
Kosmico SAS is responsible for operating this connection. This notice supplements the Kosmico Privacy Policy for ChatGPT and Codex integrations. Contact privacy@kosmico.ai, or write to our registered office at 15 impasse des Violettes, 01280 Prévessin-Moëns, France, for privacy requests.
Information processed and purpose
To establish and enforce your connection, we process your Kosmico user identifier, selected project identifiers and per-project permissions, external client identifier, granted permissions, authorization status and creation/expiry times. We store cryptographic hashes of the connection tokens rather than their plaintext values. Temporary authorization records also contain the callback, state and proof-key challenge needed to complete sign-in securely.
When you use a tool, Kosmico processes its arguments and the requested project paths, metadata and contents to return a result or apply an authorized edit. These operations use the existing project storage and collaboration system. The separate authorization database does not store your project file contents or your Kosmico password.
We process this information to provide the connection you request and to protect accounts and the service against misuse. The respective legal bases are performance of the requested service and our legitimate interests in security. Authorizing a connector is optional; without it, that external service cannot use this connection to access your project.
Recipients and external services
Kosmico uses its hosting provider Hostinger and cloud data service Convex to operate the connection and project storage. Information returned by a tool is transmitted to the connected OpenAI service. OpenAI's processing, retention and any use of conversation content depend on your service, plan, organization settings and applicable OpenAI terms and privacy notice. We do not promise that every account or plan has the same data-handling settings.
Hosting and cloud providers and their subprocessors may process personal data outside the European Economic Area. Their data-processing terms include the European Commission's Standard Contractual Clauses where required for those transfers: Hostinger Data Processing Addendum and Convex Data Processing Addendum. You can contact privacy@kosmico.ai for information about the safeguards applicable to your data.
Check that those conditions permit sharing your project, particularly when it contains confidential or regulated information. Disconnecting Kosmico does not erase copies already received by OpenAI; manage those through the external service and its available privacy controls.
Retention and deletion
Connection records and their token hashes expire no later than 30 days after authorization. Expired records are removed at service startup and during hourly cleanup; while the service is running, this is within one hour of expiry. Temporary authorization requests expire after 10 minutes and are removed by the same cleanup. Revocation blocks access immediately but records may remain until their original expiry for security purposes.
The connector does not add a second archive of project contents. Your project data follows Kosmico's existing account and project retention rules. A privacy request can also be made to privacy@kosmico.ai. We make a daily recovery copy of the connector authorization database, with access restricted to service administrators. Each successful daily backup removes managed copies older than seven days. These copies contain connection metadata and token hashes, not project file contents. A revoked or expired connection may therefore remain in a recovery copy until that copy is removed; such copies are not used to serve normal connector requests.
Your rights
Depending on the applicable law and circumstances, you may request access, correction, erasure or portability of your personal data, restriction of processing, or object to processing based on legitimate interests. Contact privacy@kosmico.ai. You may also lodge a complaint with the CNIL or your competent supervisory authority. Revoking the connector is available independently of these requests.