Privacy Policy

1. The Core Principle

Unlike model providers or standard SaaS applications, Cosmocrat operates as infrastructure. In our standard deployment model, the Cosmocrat Engine runs entirely within your environment. We do not require access to your databases, we do not train models on your data, and we do not retain payload data unless explicitly configured for audit purposes.

For data protection purposes, customers act as data controllers; Cosmocrat acts as a data processor limited to governance metadata.

2. What We Process

To provide governance, the system processes:

• Decision Metadata: The "shape" of a decision (tool called, latency, success/fail status).
• Policy Hashes: Cryptographic identifiers of the rules enforced.
• Authority Records: Who authorized an action (User ID, API Key hash).
• Execution Receipts: The immutable proof of the transaction.

Raw Payloads: By default, input prompts and output completions remain in your volatile memory or local logs. They are not transmitted to Orion Apex Capital unless you opt-in to hosted observability features.

3. What We Do Not Do

• We do not train AI models on your customer data or inputs.
• We do not resell decision data or metadata.
• We do not inject ads or tracking pixels into the runtime kernel.

4. Data Location & Control

Standard Deployment: Data resides in your Virtual Private Cloud (VPC) or on-premise infrastructure. You hold the encryption keys. We cannot decrypt your run records.

Hosted Components: Hosted components never receive customer prompts, outputs, or execution payloads unless explicitly enabled by the customer. Only non-payload metadata (counts, health status, billing metrics) is transmitted for license verification and aggregated reporting.

5. Retention

Receipts: Governance artifacts (receipts) are designed to be immutable and retained according to your compliance policy.

Deletion: If you terminate your license, you retain all data generated by the system. We have no "kill switch" for your local data.