Privacy Policy

1. General information

CosmoKit (cosmokit.ee / cosmokit.app) is a platform operated by Dragonflow OÜ that lets people working in spiritual fields (hereinafter practitioners) create and manage numerology reports and widget-based tools.

This privacy policy explains how Dragonflow OÜ processes personal data on the platform across two different roles:

• Practitioner data: data of users who register on the platform, for which Dragonflow OÜ is the data controller.
• Client data: data of a practitioner's own clients, for which the practitioner themselves is the data controller; Dragonflow OÜ acts as a data processor in relation to this data (GDPR Art. 28).

2. Processing of practitioner data

Data collected: name, email address, business name, settings (colors, texts, report templates), and payment information related to a Stripe account.

Purpose and legal basis of processing:

• Performance of a contract (GDPR Art. 6(1)(b)): managing the account and providing the service.
• Legal obligation (GDPR Art. 6(1)(c)): accounting and tax records.

Retention: until the account is deleted, and for as long as required to fulfill accounting obligations (up to 7 years).

3. Processing of client data (as data processor)

A practitioner's clients' data — full name, birth date, email address and generated numbers (report buyers), or email address, name and birth date (Daily Energy widget subscribers) — is stored in the Convex database on the practitioner's behalf and instructions. Dragonflow OÜ does not use this data for its own business purposes and does not pass it on to third parties outside its sub-processors. A practitioner's voluntary connection of a MailerLite account is an optional extra feature for syncing subscribers into their own MailerLite account — it is not a requirement for using the platform.

In addition, a practitioner can add free-form notes and tags to a client's profile in the Clients view. This is content the practitioner writes themselves, not data collected from the client, and it is stored the same way in the Convex database on the practitioner's behalf.

As the data controller for this data, the practitioner is themselves responsible for having the right to process their clients' data and for informing clients appropriately about it.

Retention and deletion:client data is retained for as long as the practitioner keeps their account active. A practitioner can permanently delete their account and all related client data at any time via the Settings page (“Danger zone”) — this deletes all of the practitioner's own and their clients' data from the Convex database at once.

4. Sub-processors

Dragonflow OÜ uses the following authorized sub-processors:

5. Data subject rights

A practitioner has the right to:

• access their personal data (GDPR Art. 15)
• request correction of data (GDPR Art. 16)
• request deletion of data (GDPR Art. 17)
• restrict processing (GDPR Art. 18)
• data portability (GDPR Art. 20)
• object to processing based on legitimate interest (GDPR Art. 21)
• withdraw previously given consent at any time, without affecting the lawfulness of processing carried out before the withdrawal
• lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, the supervisory authority for Dragonflow OÜ as an Estonian company) (www.aki.ee)

To submit a request, write to siljapaulus@dragonflow.biz

6. Cookies

The platform uses cookies only for session management (Clerk) and to remember your preferred language (cosmokit.ee vs. cosmokit.app). No advertising cookies are used.

7. Changes to this policy

Dragonflow OÜ may update this privacy policy from time to time, for example when a new sub-processor is added or a legal requirement changes. For significant changes that affect how your data is processed, practitioners are shown a notice in the dashboard. The “last updated” date at the top of this page always reflects the current version.