Privacy policy

As of: November 2026

This privacy policy is available in German and in English. Both versions have the same content; where the wording differs, the German version applies.

1. Controller and scope

1.1 The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Levi Yosef, trading as Cosa
Singerstraße 33, 10243 Berlin, Germany
Email: levi@usecosa.ai

Hereinafter “Cosa”, “we” or “us”.

1.2 This privacy policy applies to the website www.usecosa.ai and all its subpages, to contacting us by email and through the contact form, to the waitlist for the Cosa AI beta, to the booking of calls and to the processing of data in the course of initiating and conducting business relationships with companies.

1.3 This privacy policy does not apply to the Cosa application, for which separate privacy information is provided, nor to personal data that we process on behalf of our customers (section 10.3).

1.4 We have not appointed a data protection officer. For all questions about data protection, you can reach us at the email address above.

2. Legal bases

2.1 We process personal data on the following legal bases:

2.1.1 Article 6(1)(a) GDPR, where you have consented to the processing;

2.1.2 Article 6(1)(b) GDPR, where the processing is necessary for the performance of a contract with you or for steps taken at your request prior to entering into a contract;

2.1.3 Article 6(1)(c) GDPR, where the processing is necessary for compliance with a legal obligation to which we are subject, in particular retention obligations under commercial and tax law;

2.1.4 Article 6(1)(f) GDPR, where the processing is necessary for the purposes of our legitimate interests or those of a third party and your interests, fundamental rights and freedoms do not override them. We name the legitimate interests in each of the following sections.

2.2 Storing information on your device and accessing information already stored on your device are additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). We do not set any cookies on this website. Cal.com sets a cookie only once you load its booking calendar (section 7.2). For audience measurement, see section 5.

3. Provision of the website and hosting

3.1 Each time you visit our website, our hosting provider processes technically necessary data transmitted by your browser. This includes the IP address, the date and time of access, the page or file requested, the previously visited page (referrer), the amount of data transferred, the status code of the request and information about your browser and operating system.

3.2 This processing serves to deliver the website, to ensure its stability and security, and to detect and defend against attacks, spam and abusive automated access. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in a secure and functional website. Insofar as your device is technically accessed in the process, this is strictly necessary to provide the website you have requested (Section 25(2) no. 2 TDDDG).

3.3 Our website is operated by Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, the Netherlands (“Framer”). Framer processes the data on our behalf on the basis of a data processing agreement under Article 28 GDPR. Framer uses Amazon Web Services as a sub-processor for hosting; data may also be processed on servers in the USA (section 12).

3.4 The data are stored only for as long as is necessary for the purposes stated. Data needed to investigate a security incident are kept until the investigation is complete.

3.5 The images and videos of the website are also delivered from Framer’s servers.

4. Fonts

When you visit the website, the fonts of this website are loaded from servers of Google (fonts.gstatic.com; Google Ireland Limited and Google LLC); in the process, your IP address is transmitted to Google.

5. Audience measurement with Framer Analytics

5.1 We use the audience measurement built into Framer to understand how many visitors our website has, which pages are viewed and from which countries the visits come. The provider is Framer (section 3.3), which processes the data as a processor.

5.2 When you open a page, your browser loads a small script from Framer and sends Framer a message about the page view. It contains the page viewed, the page you came from (where your browser reports it), your browser’s language and time zone, a country code and a random identifier that applies only to that single page view. For technical reasons Framer receives your IP address and browser identifier (user agent) in the process. No cookies are set and no information is stored on your device.

5.3 According to Framer, the IP address and browser identifier are hashed with a daily rotating key that is reset and deleted every day; they serve only to count the visitors of one day. Framer uses the IP address on its servers to estimate the country, and Framer Analytics does not store it. If you return on another day, that counts as a new visitor. We receive only aggregated statistics, such as page views, visitors per day, referring pages, countries, device types, browsers and operating systems.

5.4 The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in evaluating the use of our website in aggregated form and in improving our offering. You can object to this processing under section 15. We do not ask for consent under Section 25(1) TDDDG because nothing is stored on your device and only the few details named are read, which serve solely for anonymous counting.

6. Contact by email, contact form and waitlist

6.1 If you contact us by email, we process your email address, your name, the content of your message and the information you provide, for example about your company and your role.

6.2 We process these data to answer your enquiry. The legal basis is Article 6(1)(b) GDPR where your enquiry is aimed at concluding or performing a contract, and otherwise Article 6(1)(f) GDPR. Our legitimate interest lies in answering enquiries and maintaining business contacts.

6.3 Our email service is provided by Google as a processor as part of Google Workspace. Data may also be processed in the USA (section 12).

6.4 We delete the data once your enquiry has been dealt with conclusively and no business relationship arises, at the latest 24 months after the last contact, unless statutory retention obligations apply. We keep business letters for the statutory retention periods.

6.5 On our website you can join the waitlist for the Cosa AI beta using a form. In doing so, we process your email address and, where you provide them voluntarily, your name, your company and your message, as well as the date and time of your entry, of our confirmation email and of your confirmation, and your reply email with its sender details. Only the email address is required; without it we cannot add you to the waitlist.

6.6 After you sign up, we send you an email in which you confirm your entry (double opt-in). You confirm by clicking the confirmation link in that email, which opens a prepared reply that you then send, or by replying “Yes” to that email. We add you to the waitlist only after your confirmation. If you do not confirm within 30 days, we delete your details.

6.7 We use your details exclusively to invite you to the Cosa AI beta, to set up your access and to contact you by email about your beta access. We do not send you a newsletter. The legal basis is your consent under Article 6(1)(a) GDPR, which you give by submitting the form and confirming. We store the details of your entry and confirmation in order to be able to prove that you signed up and consented yourself; the legal basis for this is Article 6(1)(c) in conjunction with Article 7(1) GDPR and Article 6(1)(f) GDPR, our legitimate interest being the proof of your consent.

6.8 The form is provided by our hosting provider Framer (section 3.3) as a processor. Framer transmits your entry to our mailbox at Google Workspace (section 6.3). To protect against automated entries, the form contains invisible fields that only programs fill in, and your browser solves a computational puzzle in the background, the result of which Framer checks. In doing so, Framer processes technical characteristics of your browser and your connection. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in protecting the form against abuse. Insofar as your device is accessed in the process, this is strictly necessary for the form you are using (Section 25(2) no. 2 TDDDG). Only after your confirmation do we transfer your entry to our customer relationship and sales software Oxygen of OXYGEN GTM Inc., USA; section 7.10 applies accordingly to processing on our behalf, server locations and transfer.

6.9 You can withdraw your consent at any time with effect for the future and leave the waitlist by sending an email to levi@usecosa.ai or by replying to one of our emails. Withdrawal does not affect the lawfulness of processing carried out before it. After withdrawal we delete your details and keep only the record of your entry and your withdrawal for as long as we need it to defend against claims, at most three years.

6.10 Without withdrawal, we delete your details once you have received access and no business relationship arises, or when the beta phase ends, at the latest 24 months after your entry. If your access leads to a business relationship, section 10.2 applies.

6.11 On our website you can send us a message using a contact form. In doing so, we process your name, your email address and the content of your message, as well as the date and time of your enquiry. All three details are required; without them we cannot answer your enquiry. We do not need any other details. Please put only what we need for your enquiry into the message.

6.12 We process these data exclusively to answer your enquiry. The legal basis is Article 6(1)(b) GDPR where your enquiry is aimed at concluding or performing a contract, and otherwise Article 6(1)(f) GDPR. Our legitimate interest lies in answering enquiries and maintaining business contacts. We do not send you a newsletter, and we do not use your details from the form to send you unsolicited advertising.

6.13 The form is provided by our hosting provider Framer (section 3.3) as a processor. Framer transmits your message to our mailbox at Google Workspace (section 6.3). Section 6.8 applies accordingly to the protection of the form against automated entries, including the legal basis and the note on Section 25(2) no. 2 TDDDG stated there. Your message is not transferred automatically to our customer relationship and sales software. If your enquiry leads to a conversation about working together, section 10 applies.

6.14 We delete your details once your enquiry has been dealt with conclusively and no business relationship arises, at the latest 24 months after the last contact, unless statutory retention obligations apply. We keep business letters for the statutory retention periods. If a business relationship arises, section 10.2 applies. Your rights under sections 14 and 15 apply to these data as well.

7. Booking calls via Cal.com

7.1 To book calls, we use the booking calendar of Cal.com, Inc. (“Cal.com”). The booking calendar is embedded on some pages of our website. It loads only when you click the “Book a call” button; before that, no data are transmitted to Cal.com and no information is stored on your device. We also link to our booking page on Cal.com; it opens only when you click the link.

7.2 When you click “Book a call” or the link, your browser loads program code and content from Cal.com’s servers. In doing so, your IP address, information about your browser and operating system, the page from which you open the booking calendar, and the date and time of access are transmitted to Cal.com. Cal.com currently stores a cookie of its service provider Cloudflare (“__cf_bm”) that detects automated access and expires after 30 minutes, and may transmit technical error reports to its service provider Sentry. Storing this cookie is strictly necessary to provide you securely with the booking calendar you have expressly requested (Section 25(2) no. 2 TDDDG).

7.3 When you book a call, we process the details you enter, namely your name, your email address, your company and your information on the purpose of the call, as well as the chosen time, the type of call and your time zone. The required details are those marked as required fields in the form; without them we cannot arrange a call with you.

7.4 We process these data to arrange, confirm, prepare and hold the call, and to provide you with the booking calendar you requested. The legal basis is Article 6(1)(b) GDPR where the call serves to initiate a contract, and otherwise Article 6(1)(f) GDPR. Our legitimate interest lies in easy scheduling with prospects and customers and in preparing the call.

7.5 After booking, Cal.com sends you, on our behalf, a confirmation email with a calendar invitation and, where applicable, reminders and information on rescheduling or cancelling the call. If you do not want to receive emails from us about the call, a reply to one of our emails is enough.

7.6 The provider of the booking calendar is Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. Cal.com processes the data on our behalf on the basis of a data processing agreement under Article 28 GDPR. Cal.com uses sub-processors, the vast majority in the USA, among other things for hosting, database, email delivery, protection against automated access and error monitoring; Cal.com publishes the current list at trust.cal.com/subprocessors. Where Cal.com processes data for its own purposes, for example the security of its service, Cal.com is itself the controller; in that respect Cal.com’s privacy policy at cal.com/privacy applies.

7.7 Cal.com processes the data in the USA. Cal.com, Inc. is certified under the EU-U.S. Data Privacy Framework (section 12.2); the transfer is based on the adequacy decision of the European Commission.

7.8 Booked calls are added to our calendar at Google Workspace; the invitation contains a link to the video conference we use for the call. Section 6.3 applies accordingly.

7.9 We delete the booking data 24 months after the call, unless a business relationship arises or statutory retention obligations apply.

7.10 To prepare the call, we transfer your name, your email address, your company, your information on the purpose of the call and the type and time of the call to our customer relationship and sales software Oxygen, provided by OXYGEN GTM Inc., 2810 N Church St STE 88810, Wilmington, DE 19802, USA. OXYGEN processes the data on our behalf on the basis of a data processing agreement under Article 28 GDPR; according to OXYGEN, the application and databases run on servers in France, with backups in Germany. OXYGEN itself and some of its sub-processors are based in the USA. OXYGEN GTM Inc. is not certified under the EU-U.S. Data Privacy Framework; the transfer to the USA is based on the standard contractual clauses of the European Commission (section 12.3), which we are concluding with OXYGEN. The legal basis is Article 6(1)(b) GDPR where the call serves to initiate a contract, and otherwise Article 6(1)(f) GDPR; our legitimate interest lies in preparing the call and maintaining our business contacts. We delete these data in Oxygen in accordance with section 10.1.5. The connection between Cal.com and Oxygen is established by OXYGEN through its service provider Composio, which manages the access authorisation to our Cal.com account and may have access to booking data in doing so. Composio is a sub-processor of OXYGEN; OXYGEN publishes the current list at oxygen-agent.com/subprocessors.

8. Links to LinkedIn and other websites

8.1 Our website contains links to LinkedIn and to other external websites. These are simple links, not embedded plugins. No data are therefore transmitted to LinkedIn or to the operators of the linked websites when you visit our website.

8.2 Only when you click a link do you leave our website. The operator of the linked website is solely responsible for the processing of your data there; its privacy information applies.

9. Recommendations on our website

9.1 On our website we show excerpts from recommendations that people have written publicly on LinkedIn about the work of Levi Yosef, each with name, role and company as shown on the person’s LinkedIn profile, profile picture, the year of the recommendation and a link to the recommendation on LinkedIn. Where the website appears in a language other than that of the recommendation, we show a translation marked as such.

9.2 The details come from the publicly accessible recommendations on Levi Yosef’s LinkedIn profile.

9.3 We publish these details only with the consent of the person concerned. The legal basis is Article 6(1)(a) GDPR. Consent can be withdrawn at any time with effect for the future by email or LinkedIn message to us; we then remove the recommendation from the website within seven days.

10. Business development and customer relationships

10.1 Business contacts and prospects

10.1.1 We approach companies and their decision-makers for whom our services may be of interest, mainly via LinkedIn. For this purpose we process professional contact and profile data, in particular name, role, company, industry, professional contact details, publicly accessible profile information and posts, and the history of our communication.

10.1.2 The data come from publicly accessible sources, in particular professional networks such as LinkedIn and company websites, from our communication with you and from providers of company and contact data.

10.1.3 The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in initiating business relationships with companies and in maintaining our business contacts. We send promotional messages by email only where the German Act against Unfair Competition (UWG) permits this.

10.1.4 We store these data in our customer relationship and sales software. Its providers process the data on our behalf as processors; some of them are based in the USA or process data there (section 12).

10.1.5 We delete the data when they are no longer needed for business development, at the latest 24 months after the last contact, unless a business relationship has arisen. If you object to the processing, we will no longer contact you and store only the details necessary to respect your objection permanently.

10.2 Customers

To perform our contracts, we process the contact and contract data of our customers’ contact persons. The legal basis is Article 6(1)(b) GDPR where the contact person is a contracting party, and otherwise Article 6(1)(f) GDPR; our legitimate interest lies in performing the contract with the company for which the contact person works. We keep invoices and contract documents under Article 6(1)(c) GDPR for the statutory retention periods of up to ten years.

10.3 Processing on behalf of our customers

Personal data that we process on behalf of our customers when providing our services, for example data from their CRM systems, call recordings and sales documents, we process as a processor under Article 28 GDPR on the instructions of the respective customer. In this case the customer is the controller and its privacy information applies. We forward enquiries concerning such data to the customer.

11. Recipients

11.1 We pass on personal data only where this is necessary for the purposes stated in this privacy policy, where a legal basis permits it or where you have consented.

11.2 Recipients are in particular our processors: the hosting provider of the website (Framer), the provider of our email and calendar service (Google Workspace), the provider of our booking calendar (Cal.com) and the providers of our customer relationship and sales software, in particular OXYGEN GTM Inc., USA (Oxygen). In addition, data may be transmitted to tax advisers, authorities or courts where we are obliged to do so or where this is necessary to establish, exercise or defend legal claims.

12. Transfers to third countries

12.1 Some of our service providers are based in the USA or process data there. The USA is a third country within the meaning of the GDPR.

12.2 For transfers to companies in the USA that are certified under the EU-U.S. Data Privacy Framework, there is an adequacy decision of the European Commission (Implementing Decision (EU) 2023/1795 of 10 July 2023, Article 45 GDPR).

12.3 Where a recipient is not certified, we base the transfer on the standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914, Article 46(2)(c) GDPR). You can obtain a copy of the standard contractual clauses on request by email to us.

13. Storage period

Unless a specific storage period is stated in this privacy policy, we store personal data only for as long as is necessary for the respective purpose. We keep data that are subject to statutory retention obligations, in particular under commercial and tax law, for the duration of these obligations and restrict their processing during this time to fulfilling the obligation.

14. Your rights

14.1 Subject to the statutory requirements, you have the right of access to the personal data we process (Article 15 GDPR), to rectification of inaccurate data (Article 16 GDPR), to erasure (Article 17 GDPR), to restriction of processing (Article 18 GDPR) and to data portability (Article 20 GDPR).

14.2 You can withdraw any consent you have given at any time with effect for the future (Article 7(3) GDPR). The lawfulness of the processing carried out before the withdrawal remains unaffected.

14.3 You have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

14.4 An email to levi@usecosa.ai is sufficient to exercise your rights.

15. Right to object under Article 21 GDPR

15.1 You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Article 6(1)(f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

15.2 If we process your data for direct marketing, you can object to this processing at any time without giving reasons. We will then no longer process your data for this purpose.

15.3 The objection can be made in any form and should be sent to levi@usecosa.ai.

16. Provision of data and automated decision-making

16.1 You are under no statutory or contractual obligation to provide us with personal data. However, without the data technically required to provide the website (section 3), the website cannot be displayed; without contact details we cannot answer your enquiry or arrange a call with you; without an email address we cannot add you to the waitlist.

16.2 No automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place.

17. Changes to this privacy policy

We adapt this privacy policy when our processing or the legal requirements change. The version published on this website applies.