Privacy Policy

1. Controller

The controller within the meaning of the GDPR is:

Osos AI GmbH

Cosimastrasse 121, 81925 Munich, Germany

Email: info@ososomega.com

Represented by: Dr. Hải Vân Lê Jorks

---

2. Purpose of Data Processing

We process personal data for:

• Providing the Demo App
• Authentication of registered users
• Ensuring technical operation
• Further development of our product
• Prevention of misuse and security protection

---

3. Type of Data Processed

For use without registration:

• IP address
• Timestamp
• Technical access data (log files)

For registration:

• Email address
• Authentication data (tokens)
• Usage data within the Demo App

---

4. Storage Duration

Demo account without registration:

• Valid for a maximum of 1 hour
• User data will be deleted within 24 hours

Data of registered users will be deleted after:

• Account deletion by the user

There is no backup of the demo data.

---

5. Hosting

The Demo App is hosted via:

Supabase (Backend-as-a-Service)

on AWS (Region eu-central-1, Frankfurt)

Data processing takes place within the European Union.

---

6. Use of External AI Services

The Demo App uses the OpenAI API.

As part of this, entered content may be transmitted to OpenAI.

It cannot be excluded that OpenAI processes data for model improvement.

Further information:

https://openai.com/policies/privacy-policy

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in AI-supported functionality)

---

7. Proprietary Product Improvement

We may use user input in anonymized or pseudonymized form to improve our product.

No training of a proprietary Large Language Model takes place.

---

8. Legal Bases

Data processing is carried out on the basis of:

• Art. 6 (1) lit. b GDPR (fulfillment of contract)
• Art. 6 (1) lit. f GDPR (legitimate interest)
• Art. 6 (1) lit. c GDPR (legal obligation)

---

9. Disclosure to Third Parties

Disclosure is made exclusively to:

• Hosting providers (Supabase / AWS)
• API providers (OpenAI)

No further disclosure beyond this takes place.

---

10. Rights of Data Subjects

Data subjects have the right to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)

The right to lodge a complaint with a supervisory authority remains unaffected.

---

11. Data Security

We employ technical and organizational measures in accordance with Art. 32 GDPR.

Nevertheless, data transmission over the internet may have security gaps.