This document describes how personal data is processed in connection with the use of the website cogitusai.com and the Agent Ofertowy AI application (the “Application”) — a tool for creating and sending sales quotes. It fulfils the information obligation under Articles 13 and 14 of the GDPR (EU Regulation 2016/679).
1. Data controller
The data controller is COGITUS AND MARKETS Krzysztof Zajkowski, ul. Józefa Sierakowskiego 4 lok. 64, 03-712 Warsaw, Poland, VAT ID (NIP) 5422489902, REGON 141939802. Contact for data matters: kris@cogitusai.com.
2. Who this applies to
The Application is a business (B2B) tool for sales representatives of companies using the service. A user signs in with their work Google or Microsoft account, creates a quote for their customer, and can send it by email from their own mailbox. This policy also applies to visitors of the website and people who contact us.
3. Purposes, data and legal bases
| Purpose | Scope of data | Legal basis (GDPR) |
|---|---|---|
| Signing in to the Application | Google/Microsoft account profile: email address, first and last name | Art. 6(1)(b) (provision of the service) and (f) (legitimate interest — secure access) |
| Sending a quote on the user's behalf | send permission (Google gmail.send / Microsoft Mail.Send), recipient address, quote content (PDF) |
Art. 6(1)(b) and (f) — only on an explicit user action (clicking “Send”) |
| Handling enquiries / contact | email address, message content | Art. 6(1)(f) (responding to an enquiry) |
| Website statistics and security | technical data (IP address, logs), see “Cookies” | Art. 6(1)(f) (maintaining and securing the website) |
4. Data recipients (processors)
We use trusted providers that process data solely on our instructions and only to the extent necessary to run the service:
- Google (Google Cloud, Google Workspace APIs) — hosting of the application and data (EU region), sign-in, and sending email from the user's Google account.
- Microsoft — sign-in and sending email from the user's Microsoft account (Microsoft Graph).
- Postmark (ActiveCampaign, LLC) — delivery of quote emails (for customers using this sending method).
5. Transfers outside the European Economic Area
Some providers (Google, Microsoft, Postmark) are based in the USA, which may involve transferring data outside the EEA. Such transfers rely on the safeguards provided for in the GDPR — the provider's participation in the EU‑U.S. Data Privacy Framework or Standard Contractual Clauses approved by the European Commission. Application and customer data are stored in the EU region.
6. What we do NOT do with mailbox data (Google/Microsoft)
- We do not read, scan, or store the contents of your mailbox — the
gmail.send/Mail.Sendpermission is used only to send email, not to read it. - We do not use data for advertising or profiling.
- We do not sell data and do not share it beyond the providers listed above.
- No human on our side reads the content of the messages being sent.
7. How we protect your data
- Encryption in transit: HTTPS/TLS 1.2+ for all traffic.
- Encryption at rest: data stored in Google Cloud (Firestore, Secret Manager), encrypted by default with AES-256.
- Processing region: European Union (Firestore
europe-central2, assistant memoryeurope-west4). - Tenant isolation: each company's data is stored in
a separate namespace (
tenants/{id}/…); user sessions are bound to their company. Data of different companies is never merged or shared. - Access control: authenticated users on a per-company allowlist; least-privilege IAM for cloud services; secrets and tokens stored in Google Secret Manager, never in source code.
- Data minimisation: we request send-only permission
(
gmail.send). We never read, browse or download the content of your mailbox. Assistant conversation content is not written to application logs. - Deletion: account data and related records are deleted on request; a connected mailbox can be disconnected at any time and access revoked in your Google Account settings.
8. Artificial intelligence and your data
The application uses Google Gemini models provided through Google Cloud Vertex AI — our only AI provider. We do not send data to any other AI provider, aggregator or gateway.
Google user data is never used to develop, train or improve generalised or foundational AI/ML models — neither by us nor by our providers. Under Google Cloud terms, customer data processed in Vertex AI is not used to train Google's foundation models.
The gmail.send scope allows the application only to
send the quotation you have prepared. The content of that message is
composed from data you enter in our forms and from your company's product
catalogue. We do not read your mailbox, therefore no Gmail messages or
attachments are ever passed to AI models.
Cogitus AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
9. Compliance with Google's policy (Limited Use)
Agent Ofertowy AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
10. Retention period
- Send token (Google/Microsoft) — until the user disconnects the application or stops using the service; after disconnection we can no longer send on your behalf.
- Sign-in data and sales-rep data — for as long as the user's company uses the service.
- Correspondence — for as long as necessary to handle the matter.
11. Cookies
Necessary: the Application uses a session cookie to keep the user signed in — the service does not work without it.
Marketing (Google Ads): on our website we use Google Ads cookies solely to measure ad performance (to see whether a visit from an ad ended in a contact). We rely on Google Consent Mode: these cookies are disabled by default and are only activated after you give consent in the cookie banner. You can withdraw consent at any time by clearing this website's data in your browser. We do not use your email data for advertising (see section 6).
Statistics (Google Analytics): we measure website traffic anonymously (how many people visit, which pages they view) using Google Analytics. These cookies are also only activated after you give consent in the cookie banner.
You can also change cookie settings directly in your browser.
12. Your rights
You have the right to: access your data, rectify it, erase it, restrict processing, data portability, and object to processing based on legitimate interest. You can disconnect the application from your account at any time: Google / Microsoft. For data matters, write to kris@cogitusai.com.
You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00‑193 Warsaw.
13. Automated decisions
We do not make decisions about users based solely on automated processing that produce legal effects. The Application uses AI models to help draft quote content, but the final decision on the content and on sending is made by a human (the sales representative).
14. Changes to this policy
We announce material changes by updating the date at the top of this page.