Last Modified: September 9, 2026
This Privacy Policy describes how Cognitia AI, Inc. ("we", "us," "our") collects, uses and discloses information about individuals who use our website (https://www.cognitia-ai.com) to access the free version of our product or Cognitia Pro and other paid versions, other applications, services, tools and features, or who otherwise interact with us (collectively, the "Services").
This Privacy Policy describes how Cognitia AI, Inc. ("we", "us," "our") collects, uses and discloses information about individuals who use our website (https://www.cognitia-ai.com) to access the free version of our product or Cognitia Pro and other paid versions, other applications, services, tools and features (including our mobile App, optional desktop companion / local device integration, cloud desktop and browser-agent features, Data Platform, Data Marketplace, developer API, and Model Context Protocol ("MCP") features), or who otherwise interact with us (collectively, the "Services"). For the purposes of this Privacy Policy, we are the data controller, and "you" and "your" means you as the user of the Services, whether you are a customer, website visitor, job applicant, representative of a company with whom we do business, or another individual whose information we have collected pursuant to this Privacy Policy. The Services are intended only for individuals who are 18 or older. Please read this Privacy Policy carefully. By using any of the Services, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree to this Privacy Policy, please do not use or access the Services.
We may modify this Privacy Policy from time to time, in which case we will update the "Last Modified" date at the top of this Privacy Policy. If we make material changes to the way in which we use or disclose information we collect, we will use reasonable efforts to notify you (such as by emailing you at the last email address you provided us, by posting notice of such changes on the Services, or by other means consistent with applicable law) and will take additional steps as required by applicable law. If you do not agree to any updates to this Privacy Policy, please do not continue using or accessing the Services.
Collection and Use of Your Information
When you use or access the Services, we collect certain categories of information about you from a variety of sources.
Information You Provide to Us
Some features of the Services may require you to directly provide us with certain information about yourself. You may elect not to provide this information, but doing so may prevent you from using or accessing these features. Information that you directly submit through our Services includes: • Basic contact details, such as name, address, phone number, and email ("Contact Information"). We use this information where necessary to perform our contract with you to provide the Services, and to communicate with you (including, with your consent where required, to tell you about certain promotions or products or services that may be of interest to you). • Account information, such as name, username, email and password ("Account Information"). We use this information where necessary to perform our contract with you to provide the Services and to maintain and secure your account with us. You are responsible for keeping your account credentials safe. We recommend you do not share your access details with anyone else. If you believe your account has been compromised, please contact us immediately at contact@cognitia-ai.com. • Payment information, such as credit or debit card information and billing address, which we collect using a third party payment processor ("Payment Information"). We use this information where necessary to perform our contract with you to process your payment and provide the Services. Marketplace payouts may also require payout account details handled by our payout processor (such as Stripe Connect). • Applicant details, such as information included in your resume or CV, references, and job history ("Applicant Information"). We use applicant details in our legitimate interests to process your application for employment and to evaluate your candidacy. • Your input and output, such as questions, prompts and other content that you input, upload or submit to the Services, and the output that you create, and any collections or pages that you generate using the Services ("Service Interaction Information"). This content may constitute or contain personal information, depending on the substance and how it is associated with your account. We use this information where necessary to perform our contract with you to generate and output new content as part of the Services. If you make content publicly available or share content with third parties, please note that it may be stored, displayed, reproduced, published, or otherwise used or disclosed without your permission, and may or may not be attributed to you. • Memory and knowledge graph data derived from your use of the Services, such as entities, relationships, temporal facts, behavioral signals, provenance metadata, and related embeddings ("Memory Information"). We use Memory Information where necessary to perform our contract with you to provide persistent memory, personalization, search, Data Platform controls, and related features. • Health and wellness data, such as activity metrics, workout data, sleep data, heart-rate related metrics, and other health-related information from Apple Health or similar health platforms that you choose to sync with the Services through our mobile App ("Health Information"). We use Health Information where necessary to perform our contract with you to provide personalized insights as part of the Services. Notwithstanding anything else in this Privacy Policy, we do not use Health Information to create, train, improve, or fine-tune AI models, and we do not sell or share Health Information with third parties for advertising purposes. We do not return raw Health Information (such as health-record dumps) in Data Marketplace payloads. If you enroll in the Data Marketplace and grant the applicable consents, derived Memory Information in a query may reflect Health Information you chose to sync, but only to the extent it contributed to your graph and an authorized marketplace origin (such as ingested or app sync) covers it. • Photos and media data, such as images and associated metadata (including date, time, and location if available) from your device's photo library that you choose to sync with the Services through our mobile App ("Photos Information"). We use Photos Information where necessary to perform our contract with you to provide personalized memory and context features as part of the Services. • Location information from device features you enable, such as significant locations or place visits synced through our mobile App, in addition to location metadata that may be embedded in Photos Information ("Location Information"). We use Location Information where necessary to perform our contract with you to provide place-aware memory and context features. • Content shared via the share extension on your mobile device, such as text, URLs, images, or other content that you choose to send to the Services through the operating system's share functionality ("Shared Content"). We use Shared Content where necessary to perform our contract with you to ingest and process the shared materials as part of the Services. • Network relay information, when you choose to set up Cloud Sync on your iPhone. The App's network extension collects your device name, device model, iOS version, and App version to identify which of your devices to route through; this iPhone's public IP address and its private mesh address, to reach that device and to confirm the connection is working; and the total number of bytes relayed and the times the connection changed state, so you can see the feature working in Settings ("Network Relay Information"). The feature routes only the specific addresses listed on that screen before you turn it on; your other traffic is not carried, and the extension terminates TCP rather than TLS, so we see addresses and never the contents of your traffic. Notwithstanding anything else in this Privacy Policy, we do not sell, use, or disclose to third parties any Network Relay Information, for any purpose, and we do not use it to create, train, improve, or fine-tune AI models. You can turn the feature off, and remove the device, at any time in the App. • Identity and biometric-related enrollment data you choose to provide, such as face or voice samples used to create cross-modal identity links or voice profiles, which may be processed with specialized voice or vision providers ("Identity Information"). We use Identity Information where necessary to perform our contract with you to provide identity linking and related memory features you enable. Where applicable law treats certain Identity Information as biometric or special-category data, we process it based on your consent or another applicable legal basis. We retain Identity Information, including any templates or embeddings we create from it, only while the relevant enrollment remains enabled on your Account. If you disable enrollment or delete your Account, we delete Identity Information from production systems within 30 days, except where we must retain information to resolve a dispute, comply with law, or protect safety and security. We do not sell Identity Information and we do not use it to train AI models. • Device and desktop companion data you choose to sync through our optional local device integration / device companion, such as local files, screenshots or on-screen captures, browser history digests, notifications, or other device data you authorize ("Device Companion Information"). We use Device Companion Information where necessary to perform our contract with you to provide local-device features you enable. We do not return raw Device Companion Information (such as screenshots, local files, or notification dumps) in Data Marketplace payloads. If you enroll in the Data Marketplace and approve the companion origin on a Personal enrichment request, derived Memory Information in a query may reflect Device Companion Information to that extent. • Cloud desktop and browser-agent session data when you use hosted desktop or browser-agent features, such as page contents, screenshots, form-fill actions, cookies or site credentials you choose to store in that environment, and related logs needed to run, debug, and bill the session ("Cloud Desktop Information"). We use Cloud Desktop Information where necessary to perform our contract with you to provide those features. • Career-tracking materials you choose to submit in product features for your own job search (for example, resumes or application notes) ("Career Information"), which is distinct from Applicant Information we collect if you apply to work at Cognitia. • Any other information you choose to include in communications with us when necessary to perform our contract with you, for example, when sending a message through the Services ("Other Information You Provide").
Information Collected Automatically
We and certain third parties also automatically collect certain information about your interaction with the Services ("Usage Data") through the use of cookies, pixels, tags and other tracking technologies ("Tracking Technologies"). Usage Data includes: • Device information, such as device type, operating system, unique device identifier, and internet protocol (IP) address. • Location information, such as approximate location derived from IP address. • Other information regarding your interaction with the Services, such as browser type, log data, date and time stamps, clickstream data, interactions with marketing emails, onboarding and product analytics events, data from integrations with external applications authorized by you, and ad impressions. We use Usage Data in our legitimate interests to tailor features and content to you, run analytics and measure and better understand user interaction with the Services, and we may permit third parties to use Usage Data for such purposes. For more information on how we use Tracking Technologies and your choices, see the section below, Cookies and Other Tracking Technologies.
Information Collected From Other Sources
We may obtain information about you from outside sources, including information that we collect directly from third parties and information from third parties that you choose to share with us. Such information includes: • Analytics data we receive from analytics providers such as Google Analytics ("Analytics Information"), which we use in our legitimate interests to understand your interaction with, and improve, our Services. • Information we receive from career websites, such as LinkedIn, Monster, or Indeed, which we use in our legitimate interests to process your application for employment ("Employment Information"). • Information we receive from consumer marketing databases or other data enrichment companies, which we use in our legitimate interests to better customize advertising and marketing to you ("Advertising Information"). • Information we receive from business partners and other companies that we partner with to provide you with free or discounted access to the Services or other offers or promotions, which we use in our legitimate interests to provide you with free or discounted access to the Services ("Partner Information"). • Information we receive when you choose to link any third-party platforms to your account, such as when you sign into your account through Google or Apple ("Third Party Platform Information"). We use this information only where necessary to perform our contract with you, to maintain your account and login information and to provide you with the Services, including to generate and output new content. Third Party Platform Information may includes your name, profile picture and email address. • Information from publicly accessible sources, such as information that's publicly available online (like articles, websites, and journals) or from other public sources, which we use where necessary to perform our contract with you ("Public Information"). • Email, calendar, contacts, and reminders information when you sync third-party accounts (such as Gmail, Google Calendar, Outlook, iCloud Mail/Calendar) or device contacts/reminders with the Services, including message content, attendees, and related metadata (together, "Email Service Information"). Notwithstanding anything else in this Privacy Policy, we only use and disclose Email Service Information to provide the Services or as otherwise required by applicable law, and we do not use or disclose Email Service Information to create, train, improve or fine-tune AI models. If you sync your Google account with the Services, we only use and disclose information from your Google account in accordance with the Google API Services User Data Policy, including the Limited Use requirements. We do not return raw Email Service Information (such as message bodies or an inbox dump) in Data Marketplace payloads. If you enroll in the Data Marketplace and grant the applicable consents, derived Memory Information in a query may reflect Email Service Information from sources you connected, but only to the extent those sources are among the origins a business requested and you approved. We do not provide Email Service Information to MCP or API clients other than clients you explicitly authorize for your own Account. • Financial account information when you link financial institutions through Plaid or similar providers, such as account identifiers, balances, transactions, merchants, categories, liabilities, and related metadata including transaction location where provided by the institution ("Financial Information"). We use Financial Information where necessary to perform our contract with you to provide budgeting, memory, search, and assistant features. Notwithstanding anything else in this Privacy Policy, we do not use Financial Information to create, train, improve, or fine-tune AI models, and we do not sell Financial Information for advertising purposes. We do not return Financial Information in Data Marketplace payloads (including account identifiers, transaction lists, or bank feeds). If you enroll in the Data Marketplace and approve the finance origin on a Personal enrichment request, derived Memory Information in a query may reflect Financial Information to that extent (graph attributes and, if that request included quoted snippets, short retrieve hits). We do not provide Financial Information to MCP or API clients other than clients you explicitly authorize for your own Account. • Cloud storage and file content when you connect Google Drive, OneDrive, Dropbox, or similar services, or upload device files ("Cloud File Information"). • Social, messaging, and media information when you connect services such as X (formerly Twitter), LinkedIn, Telegram (including optional user-session history import you authorize via phone login), Spotify, or Apple Music, or when you import chat backups or other archives you upload, including WhatsApp, Instagram, Facebook Messenger, TikTok, WeChat, LINE, and YouTube ("Social and Messaging Information"). • Meeting transcripts, video, listening history, and similar media you choose to ingest ("Media Ingest Information"). In addition to the specific uses described above, we may use any of the above information as described in "How We Use Your Information" below. Any information we receive from outside sources will be treated in accordance with this Privacy Policy. We are not responsible for the accuracy of the information provided to us by third parties and are not responsible for any third party's policies or practices. For more information, see the section below, Third Party Websites and Links. To the extent the laws in your jurisdiction do not recognize the legal basis of legitimate interest or another legal basis specified above for a particular purpose, you consent to the processing of your personal data for that purpose through using the Services.
We use the information we collect to: • Provide, operate, personalize, and improve the Services, including chat, memory, search, desktop companion, cloud desktop and browser-agent features, Data Platform, marketplace, API/MCP, billing, and customer support. • Process connected integration data and retrieve relevant context (including Financial Information, Email Service Information, Memory Information, and other authorized sources) to fulfill your requests, including by sending necessary context to third-party AI providers as described below. • Run product analytics, onboarding funnels, safety monitoring, troubleshooting, testing, and internal research and development. • Process payments, subscriptions, credits, marketplace balances, and payouts. • Send service and, where permitted, marketing communications. • Comply with law, enforce our Terms of Service, and protect the Services, our rights, and the rights of users and others. We do not use your personal information to create, train, improve, or fine-tune artificial intelligence or machine learning models. Personalization and memory features use your data to operate the Services for your account; they are not model-training pipelines. Finally, we may, in our legitimate interests, deidentify or anonymize your information such that it cannot reasonably be used to infer information about you or otherwise be linked to you ("Deidentified Information") (or we may collect information that has already been deidentified/anonymized), and we may use such Deidentified Information for any purpose. To the extent we possess or process any deidentified information, we will maintain and use such information in deidentified/anonymized form and not attempt to reidentify the information, except solely for the purpose of determining whether our deidentification/anonymization process satisfies legal requirements.
Cognitia utilizes third-party artificial intelligence and machine learning services to power the core features of our Services, including generating responses, processing files, running batch extraction or synthesis jobs, providing voice features, and providing personalized assistance. We continuously evaluate AI providers and their models to deliver the highest quality experience to our users.
AI Service Providers
We currently utilize large language models and AI services hosted by organizations such as OpenAI, Anthropic, Google (Gemini), DeepSeek, and xAI. We may also use specialized providers for voice cloning or synthesis (such as Resemble) and remote desktop / browser-agent infrastructure (such as E2B) when you use those features. We may add, remove, or change providers from time to time to improve the quality, reliability, or cost-effectiveness of our Services.
Data Sent to AI Service Providers
When you use AI-powered features of our Services, the following categories of data may be transmitted to our AI service providers to generate responses and fulfill your requests: • Messages and prompts you submit through the chat interface. • Files, images, and documents you upload for processing or analysis. • Profile information and directives you have configured, used to personalize AI responses. • Contextual information from your connected integrations and memory (such as email, calendar, financial, social, device companion, cloud desktop, or knowledge-graph content), only when relevant to your request and only from sources you have explicitly authorized. • For batch or background jobs (for example, knowledge extraction, behavioral synthesis, or import processing), request and response payloads may be stored temporarily to complete and audit those jobs. We send only the data necessary to fulfill your specific request or job. We do not send your full account credentials or payment card information to AI service providers.
How Your Data Is Protected
All data transmitted to AI service providers is encrypted in transit using TLS 1.2 or greater. We maintain contractual agreements with our AI service providers that prohibit the use of your data to train their models. Our AI service providers are required to process your data solely for the purpose of generating responses to your requests (or completing the authorized job) and are contractually obligated to delete your data after processing, in accordance with their data retention policies. We likewise do not use data returned from or sent to these providers to train Cognitia models.
Your Consent
Before any data is transmitted to third-party AI services, we ask for your explicit consent through an in-app disclosure presented when you first use the Services. You may withdraw your consent at any time through your Account settings or by contacting us at contact@cognitia-ai.com. Please note that because AI processing is a core function of our Services, withdrawing consent may prevent you from using certain features of the Services.
System and OS Integrations
When you enable optional operating-system features (such as App Intents, share extensions, health, photos, location permissions, or assistant / Apple Intelligence-style extensions where available), the Services may receive queries or content through those system surfaces and return answers based on Memory Information and other data associated with your account, subject to the permissions you grant on your device.
Optional desktop companion, cloud desktop, and browser-agent features let the Services act on websites or a computer you authorize, including navigating pages, filling forms, reading on-screen content, and completing multi-step flows you request. These features run when you start them, when you have scheduled or standing tasks enabled, or when a chat or workflow you initiate requires them. They are not an always-on capture of your entire device unless you enable a specific ambient or scheduled capture setting in the companion. You can stop a session with the in-product controls. Depending on the feature and permissions you grant, we may process page contents, screenshots or screen regions, URLs, cookies or site credentials you choose to store in the hosted desktop, local files or notifications from the companion, and logs needed to operate, debug, and bill the session. Processing may occur on your device, in our hosted cloud desktop environment (including through infrastructure providers such as E2B), and with AI providers as described in "Third-Party AI Services." We do not use Device Companion Information or Cloud Desktop Information to train AI models. Password-manager fields, private-browsing contexts, and secrets you do not submit remain your responsibility to exclude; we do not claim we can detect every secret on a page. Support staff do not review session contents except as needed for security, abuse, billing disputes, or as required by law. Raw session artifacts are retained only as long as needed to complete the request, provide recent session history you can inspect, and meet the retention criteria in "Data Security and Retention." You can disconnect the companion or disable cloud desktop features in Account or Local Device settings.
Most browsers accept cookies automatically, but you may be able to control the way in which your devices permit the use of Tracking Technologies. If you so choose, you may block or delete our cookies from your browser or limit cross-site tracking; however, blocking or deleting cookies may cause some of the Services, including certain features and general functionality, to work incorrectly. If you have questions regarding the specific information about you that we process or retain, as well as your choices regarding our collection and use practices, please contact us using the information listed below.
To opt out of tracking by Google Analytics, visit https://tools.google.com/dlpage/gaoptout.
Your browser settings may allow you to transmit a 'do not track' signal. Like many websites, our website is not designed to respond to such signals. We do honor Global Privacy Control ("GPC") signals as described in the "Do Not Sell or Share My Personal Information" section. To learn more about 'do not track' signals, you can visit http://www.allaboutdnt.com/.
We may disclose your information to third parties subject to this Privacy Policy, including the following categories of third parties: • Company Group: Our affiliates or others within our corporate group, in accordance with our contract with you, and for internal administration or support purposes, in our legitimate interest to run a successful business and in order to provide our Services. • Service Providers: Vendors or other service providers who help us provide the Services, including for system administration, cloud hosting and storage, vector databases, generative AI and content creation (see the "Third-Party AI Services" section above), security, customer transaction facilitation and relationship management, marketing communications, web analytics, payment networks, payment processing and payouts (such as Stripe), referral payouts (such as PayPal), financial account linking (such as Plaid), remote desktop and browser-agent infrastructure (such as E2B), and voice providers. • Business Partners: Third parties through whom you receive access to our Services, including via use of a promotion code or other method provided by such business partners, in our legitimate interest to provide you with free or discounted access to our Services. • Other Third Parties, including other users: Third parties to whom you request or direct us to disclose information, such as through your use of social media widgets or login integrations, when you send an email or interact with your third party email or calendar account through the Services, or otherwise choose to share or make output or other information visible to others, including other users. We do this as necessary for the performance of a contract, or in our legitimate interest to provide you with access to the Services and integrations with third parties, or with your consent. • Advertising Partners: Third parties who display advertising information on our Services or otherwise assist with the delivery of ads. • Data Platform, Marketplace, API, and MCP Recipients: Where you have enrolled or otherwise authorized access through the Data Platform, Data Marketplace, developer API, or MCP OAuth/consent flows, authorized businesses, developers, and clients may receive permitted categories of Memory Information and related fields according to the scopes, listings, and consents you configure. Marketplace disclosures do not include name, email, phone, or street address, and do not include Identity Information, Financial Information, Device Companion Information, or raw Email Service Information or Health Information (for example, message bodies, transaction lists, health-record dumps, or full files). Marketplace queries do not live-fetch your mailbox, calendar, or bank, and do not return artifact identifiers or signed or open URLs. Aggregate insights uses listing enrollment and returns cohort distributions only (no per-person rows or quoted snippets). Personal enrichment requires a separate per-business consent: the business may suggest source groups (email and calendar, chats and social, files, money, device and Cognitia); if you approve, you choose which quotable origins are authorized for that business and layer, or you may enable auto-approve so incoming requests are granted for the origins the business asked for. When the request includes quoted snippets (fidelity=evidence), businesses receive short derived retrieve hits from those authorized origins — not your inbox, bank feed, health records, or file contents. Derived Memory Information returned in a marketplace query may reflect connected sources to the extent they contributed to your enrolled graph, are among the authorized origins, and you have granted the applicable consents. You control which listings, businesses, and origins are authorized and may revoke access through your Account or Data Platform settings, subject to prospective effect as described below. • Professional Advisors: As necessary, we will share your personal data with professional advisors such as auditors, law firms, or accounting firms. • Business Transactions: We will share personal information with a prospective buyer, seller, new owner, or other relevant third party as necessary while negotiating or in relation to a change of corporate control such as a restructuring, merger, asset sale or purchase, bankruptcy or other business transaction or re-organization. We do this in our legitimate interest to run a successful and compliant business, and as required by applicable law. We may also disclose your information as needed to comply with applicable law or any obligations thereunder or to cooperate with law enforcement, judicial orders, and regulatory inquiries, to enforce any applicable terms of service, and to ensure the safety and security of our business, employees, and users. We do this in our legitimate interest to protect our Service and business and to comply with applicable law.
Social Features
Certain features of the Services may allow you to initiate interactions between the Services and third-party services or platforms, such as X (formerly Twitter), LinkedIn, Telegram, and other social or messaging networks ("Social Features"). Social Features include features that allow you to access our pages on third-party platforms, and from there 'like' or 'share' our content, as well as connected integrations you authorize. Use of Social Features may allow a third party to collect and/or use your information. If you use Social Features, information you post or make accessible may be publicly displayed by the third-party service. Both we and the third party may have access to information about you and your use of both the Services and the third-party service. For more information, see the section below, Third Party Websites and Links.
Third Party Websites and Links
We may provide links to third-party websites or platforms. If you follow links to sites or platforms that we do not control and are not affiliated with us, you should review the applicable privacy notice, policies and other terms. We are not responsible for the privacy or security of, or information found on, these sites or platforms. Information you provide on public or semi-public venues, such as third-party social networking platforms, may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators.
The Services are for individuals who are 18 years of age or older. We do not seek or knowingly collect personal information from anyone under 18. If we become aware that we have collected information about a person under 18, we will make commercially reasonable efforts to delete such information and the associated Account. If you believe we have collected personal information from someone under 18, contact us using the information below.
We implement commercially reasonable technical, administrative, and organizational security measures designed to protect your information from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, no security measures are impenetrable, and we cannot guarantee "perfect security." Any information you send to us electronically, while using the Services or otherwise interacting with us, may not be secure while in transit. We recommend that you do not use unsecure channels to send us sensitive or confidential information. We retain your information for as long as is reasonably necessary for the purposes specified in this Privacy Policy. When determining the length of time to retain your information, we consider the following criteria: • Whether we need the information to continue to provide you the Services (e.g., maintaining your Account Information while your account is active). • Whether you have requested deletion of your information. When you delete specific memory items in the Services, we mark them deleted and remove them from active product use; residual copies may persist for a limited period in backups, logs, or processing queues before they are purged. When you delete your account, we aim to delete your personal information from our production systems within 30 days, except where we must retain information to resolve a dispute, enforce our agreements, comply with legal, tax, or accounting obligations, or protect safety and security. • Whether we need to retain the information to resolve a dispute, enforce our contractual agreements, or comply with applicable legal, tax, or accounting obligations. • Whether the information is needed to prevent harm, promote safety, security and integrity, or protect ourselves, including our rights, property or products (e.g., retaining information about accounts that violated our policies). • The amount, nature, and sensitivity of the information, and the potential risk of harm from unauthorized use or disclosure. When your information is no longer required, we will destroy, delete, erase, or convert it into an anonymized form as permitted or required under applicable laws.
Your personal information may be transferred to, stored, and processed in the United States or other countries where our servers, service providers, or affiliates are located. These countries may have data protection laws that are different from the laws of your country of residence. When we transfer personal information outside the European Economic Area ("EEA"), the United Kingdom ("UK"), or Switzerland, we rely on valid transfer mechanisms to comply with applicable data protection law, including: • Standard Contractual Clauses ("SCCs") as approved by the European Commission pursuant to Article 46(2)(c) of the GDPR, and the UK International Data Transfer Addendum to the SCCs, where applicable. • Adequacy decisions issued by the European Commission or the UK Secretary of State, as applicable, recognizing that a country provides an adequate level of data protection. Regardless of where your information is processed, we apply the protections described in this Privacy Policy. For more information or to obtain a copy of the appropriate safeguards we have in place, please contact us at contact@cognitia-ai.com.
If you are located in the EEA, UK, or Switzerland, we process your personal information based on the following legal bases under applicable data protection law: • Contract: Where processing is necessary to perform our contract with you to provide the Services, such as processing your Account Information to maintain your account, processing your Payment Information to handle subscriptions, and processing your Input to generate Output. • Legitimate Interests: Where processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights. This includes improving and developing our Services (without using your personal information to train AI models), conducting research, ensuring the safety and security of our Services, preventing fraud, and sending service-related communications. • Consent: Where you have given us your consent to process your personal information for a specific purpose, such as sending you marketing emails, syncing Health Information, Photos Information, Location Information, or Identity Information, authorizing marketplace or MCP disclosures, or transmitting data to third-party AI services. You may withdraw your consent at any time by contacting us at contact@cognitia-ai.com or through your Account settings. • Legal Obligation: Where processing is necessary to comply with a legal obligation to which we are subject, such as retaining financial records or responding to lawful government requests. • Vital Interests: In rare circumstances, where processing is necessary to protect your vital interests or those of another person. To the extent the laws in your jurisdiction do not recognize any of the legal bases specified above for a particular purpose, you consent to the processing of your personal data for that purpose through your use of the Services.
Depending on where you live, you may have some or all of the rights listed below in relation to personal information that we have collected about you. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. • Right to Access / Know. You may have a right to request access to personal information that we hold about you, or to request information about our collection, use and disclosure of your personal information, such as the categories of personal information we have collected or disclosed for a business purpose. • Right to Delete. You may have a right to request that we delete personal information we maintain about you. • Right to Correct. You may have a right to request that we correct inaccurate personal information we maintain about you. • Right of Portability. You may have the right to receive a copy of the personal information we hold about you and to request that we transfer it to a third party. Export tools may be available in the Data Platform for certain Memory Information. • Restriction of Processing. You may have the right to ask us to stop, suspend or restrict our processing of personal information. • Objection. You may have the right to object to our processing of personal information. • Withdrawal of Consent. Where we rely on consent to process your personal information, you may have the right to withdraw this consent at any time by contacting us at contact@cognitia-ai.com. Please note that the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal, and that where you withdraw your consent, we may not be able to deliver the expected service to you. You may choose to stop receiving personalized advertising or marketing promotions from us when using the Services by contacting us at our email address provided below. You may exercise any of these rights by contacting us using the information provided below. We will not discriminate against you for exercising any of these rights. We may need to collect information from you to verify your identity, such as your email address and government issued ID, before providing a substantive response to the request. You may designate, in writing or through a power of attorney document, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us. If we deny your request, you may appeal our decision by contacting us using the information provided below. You may request to delete your account through the settings page or by contacting us at contact@cognitia-ai.com. If you delete your account, we aim to delete your personal information from our production systems within 30 days, subject to the retention exceptions above.
Cognitia AI does not "sell" or "share" your personal information as those terms are defined under the California Consumer Privacy Act ("CCPA"), the California Privacy Rights Act ("CPRA"), or other applicable state privacy laws, unless you have configured Data Platform / Data Marketplace enrollment or otherwise authorized such disclosure. Our Services include a Data Platform and Data Marketplace through which you can make certain derived Memory Information available to authorized third-party services, businesses, and partners—for research and similar aggregate analysis, merchant enrichment of a relationship they already have with you, or monetization in exchange for compensation or other benefits. Marketplace payloads do not include name, email, phone, or street address. Marketplace queries return derived Memory Information (such as knowledge-graph attributes, behavioral signals, and temporal facts) according to your enrollment and consents; they do not return Identity Information, Financial Information, Device Companion Information, or raw Email Service Information or Health Information. Aggregate insights is cohort-level only and enrolled by default unless you opt out. Personal enrichment is per-business: you approve or reject the request and choose which ingest origins the business may use, or you may enable auto-approve so incoming requests are granted for the origins the business asked for. If the request includes quoted snippets, those snippets are derived retrieve hits from the origins you approved, not inbox dumps or full files. Derived Memory Information may reflect those sources if they contributed to your graph and are among the authorized origins. Any such sharing occurs according to the enrollment, listing, consent, and disclosure choices you make in the Services (including business consent requests you approve or auto-approve). We will disclose material details such as categories of information, purposes, and recipients or recipient types in the relevant product flows. When you revoke consent or disable enrollment, we will cease new sharing with the applicable parties going forward; information already disclosed may remain with the recipient subject to their obligations and applicable law. You may also authorize developer API or MCP clients to access Memory Information and related data under scopes you approve. Those disclosures are directed by you and are described in the "Disclosure of Your Information" section. Email Service Information, Financial Information, Health Information, and Identity Information are available to those clients only if you grant a scope that includes them. Outside of these authorized Data Platform, Marketplace, API, and MCP flows, we may disclose personal information to our service providers and business partners solely as described in the "Disclosure of Your Information" section of this Privacy Policy. These disclosures are made to provide and support the Services and are not "sales" or "sharing" under applicable law. We honor Global Privacy Control ("GPC") signals. If your browser or device sends a GPC signal, we will treat that as an opt-out of any sale or sharing of your personal information, to the extent applicable under law, except where you have provided affirmative authorization for a specific Data Platform or Marketplace disclosure that we are permitted to honor under applicable law. If you are a California resident, you have the right to request information about our data practices and exercise additional rights under the CCPA/CPRA, as described in the "Your Rights and Choices" section above. We will not discriminate against you for exercising any of these rights.
Should you have any questions about our privacy practices or this Privacy Policy, including personal data processing, please email us at contact@cognitia-ai.com. If you have complaints about how we process your personal information, please contact us at contact@cognitia-ai.com and we will respond to your request as soon as possible. You may also write to us at: Cognitia AI, Inc. 415 Mission Street San Francisco, CA 94105 United States If you think we have infringed data protection laws, you can file a claim with the data protection supervisory authority in the country in which you live or work or where you think we have infringed data protection laws. If you reside in the European Economic Area, you can reach out to your local supervisory authority. If you reside in the United Kingdom, you can reach out to the Information Commissioner's Office (ICO). If you reside in Switzerland, you can reach out to the Federal Data Protection and Information Commissioner (FDPIC).