Privacy Policy — Cogitent Community Edition and Plus Edition

DRAFT — pending counsel review. Not legal advice. Not yet binding until ratified in M1 final.

---

Introduction

Cogitent SAS (in formation) ("Cogitent", "we", "us") operates the Cogitent software platform — a privacy-respecting AI memory and context augmentation layer for coding assistants. This Privacy Policy describes what data we collect, why we collect it, how we use it, and your rights under the General Data Protection Regulation (EU) 2016/679 ("RGPD" / "GDPR") and French implementing legislation (Loi n° 78-17 du 6 janvier 1978, "Loi Informatique et Libertés").

This policy covers both editions of Cogitent:

• Community Edition (CE): licensed under AGPL-3.0-or-later, available to all users.
• Plus Edition: closed-source, licensed under the EULA at docs/legal/eula.md.

Where data processing differs by edition, that is clearly marked below.

Scope. This policy applies to data processed by the Cogitent software installed on your device and to data transmitted to Cogitent-operated services (entitlement service, telemetry collector, federated-learning aggregator). It does not cover data processed solely within your local database (cogitent_substrate) that is never transmitted to Cogitent — that data remains entirely yours.

What we do NOT do. We do not sell personal data. We do not share data with third parties for marketing or advertising. We do not read, transmit, or analyse the content of your memory episodes, queries, or coding sessions.

---

1. Identity and Contact Details of the Controller

Controller: Cogitent SAS (in formation) [Address — to be registered on incorporation] Email: [email protected]

Data Protection Officer (DPO): [TBD — Cogitent will appoint a DPO before M1 launch or confirm that no DPO is required under Art. 37 GDPR given the processing activities. Counsel confirmation pending.]

Supervisory Authority: Commission Nationale de l'Informatique et des Libertés (CNIL) 3 Place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07 [URL: https://www.cnil.fr — placeholder, verify before publication]

---

2. Data We Collect and Why

2.1 Telemetry Events

Applies to: Both CE and Plus Edition. Event set (complete and exhaustive for M1 / v0):

What telemetry events do NOT contain: query text, memory episode content, code fragments, file names, user names, email addresses, IP addresses, device fingerprint beyond the install UUID, or any other personally identifiable information.

Retention: Telemetry events are retained for 24 months rolling from the date of receipt, then permanently deleted.

Recipients: Cogitent Labs (internal engineering and operations teams). Events are stored on Cogitent-operated infrastructure hosted in the EU (see Section 4 on transfers). Cogitent does not share raw telemetry with third parties.

Legal basis:

• CE: Art. 6(1)(b) RGPD — processing is necessary for the performance of the contract (the AGPL-3.0 license requires the CE user to contribute telemetry as a condition of free access to the software). Users cannot opt out of CE telemetry without violating the CE terms; however, users are free to switch to a commercial arrangement that eliminates mandatory telemetry.
• Plus Edition: Art. 6(1)(a) RGPD — processing is based on your explicit, revocable consent given via the telemetry opt-in/opt-out toggle in the TUI. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing before withdrawal.

---

2.2 License-Key Validation Data (Plus Edition only)

Applies to: Plus Edition only.

When you activate a License Key, the Software performs a validation call to the Entitlement Service. This call transmits:

• License Key fingerprint (truncated hash of the JWT — not the full key)
• Install UUID
• Software version
• Validation timestamp

What is NOT transmitted: the full JWT secret, local file paths, query content, or any other system information.

Purpose: To verify that the License Key is valid, not revoked, and associated with a legitimate installation. To detect and respond to unauthorized key sharing.

Retention: License-key issuance and validation records are retained for 5 years from the date of issue for legal compliance (tax records, audit trail — Art. L. 123-22 Code de commerce).

Legal basis: Art. 6(1)(b) RGPD — processing is necessary for the performance of the Plus Edition license contract.

---

2.3 Federated-Learning Gradients and Coarse Geolocation

Applies to: Both CE (mandatory) and Plus Edition (consent-based, togglable).

Cogitent's federated-learning (FL) pipeline trains shared model components across all participating installs without centralizing episode content. Here is precisely what flows:

What flows outward (from your device to Cogitent's FL aggregator):

• Gradient vectors: mathematical parameter updates computed locally from your interaction patterns. These are model gradients, not raw data. They cannot be trivially reversed into episode content.
• Coarse geolocation metadata: country and region only (e.g., "FR / Île-de-France"). This metadata is used for cultural and linguistic adaptation of the model. It is derived from a voluntary declaration or from timezone/locale settings — never from IP address, GPS, or city-level resolution.
• Round ID and install UUID (so the aggregator can de-duplicate contributions from the same install within a round).

What does NOT flow:

• Query text or memory episode content (never).
• Precise location (never — city, neighbourhood, IP, GPS are excluded by design).
• User identity, name, email, employer, or any profile data.

Aggregation and deletion: Individual gradient contributions are deleted from Cogitent's servers within 48 hours of the aggregation round closing. Aggregated round results (the combined model update, not any individual's gradients) are retained indefinitely for model reproducibility and scientific integrity — this is standard practice in federated learning and is necessary to reproduce any published results.

Differential privacy: Each round applies a calibrated DP noise mechanism (ε and δ parameters published in the model release notes). This provides a formal mathematical privacy guarantee that individual contributions cannot be extracted from the aggregate.

Secure aggregation: The aggregator employs cryptographic secure aggregation (SecAgg) so that even the aggregator server does not observe individual gradient vectors in plaintext before summation.

Important disclosure for data subject rights (Art. 17 RGPD — right to erasure): Because individual gradient contributions are mathematically merged into the aggregate before deletion, it is technically impossible to remove a specific individual's contribution from a completed aggregate. This limitation is disclosed here in advance. If you exercise your right to erasure, Cogitent will: (a) immediately delete all pre-aggregation gradient blobs still on Cogitent servers; (b) suppress any future use of your install UUID in FL rounds; (c) provide written acknowledgement of what could and could not be erased. This limitation does not apply to any other category of data.

Legal basis:

• CE: Art. 6(1)(b) RGPD — contractual necessity (FL contribution is part of the CE use terms).
• Plus Edition: Art. 6(1)(a) RGPD — explicit revocable consent via the TUI toggle.

---

2.4 Support Contact Data (Plus Edition and Commercial Exemption holders)

Applies to: Plus Edition users who open a support request, and parties to a Commercial Exemption agreement.

When you contact Cogitent support, we collect: your name, email address, company (if provided), and the content of your support correspondence. We do not actively solicit sensitive personal data in support channels; please do not include passwords, License Key secrets, or special-category data in support messages.

Purpose: To respond to your support request, resolve technical issues, manage commercial relationships.

Retention: Support records are retained for 3 years from the date of last contact.

Legal basis: Art. 6(1)(b) RGPD (performance of the Plus Edition contract or Commercial Exemption agreement) and Art. 6(1)(f) RGPD (legitimate interest in resolving technical issues and managing business relationships, balanced against your interests — no override given the limited sensitivity of support data).

---

3. Recipients

We do not sell personal data. We do not share personal data with third parties for advertising or marketing.

---

4. International Transfers

Cogitent's design intent is to host all data processing infrastructure within the European Union. We commit to documenting any non-EU processor in an updated version of this policy before engaging them, and to implementing Standard Contractual Clauses (SCCs, Commission Implementing Decision 2021/914/EU) for any transfer to a third country not covered by an adequacy decision.

At M1 launch, the processor list is: [TBD — to be finalized before M1 ratification]. This section will be updated accordingly.

---

5. Your Rights Under GDPR (Art. 15–22)

You have the following rights in relation to your personal data processed by Cogitent. To exercise any of them, email [email protected] with subject line "GDPR Request — [your right]". We will respond within one month (extendable by two months for complex requests, with written notice).

5.1 Right of Access (Art. 15)

You may request a copy of all personal data Cogitent holds about you, along with information about how it is processed.

5.2 Right to Rectification (Art. 16)

You may request correction of inaccurate personal data. For telemetry data keyed by install UUID, rectification is limited to the extent technically feasible.

5.3 Right to Erasure ("Right to be Forgotten") (Art. 17)

You may request deletion of your personal data. Important limitation for FL gradients: as disclosed in Section 2.3, individual gradient contributions incorporated into a completed aggregate cannot be erased. Cogitent will delete all pre-aggregation blobs and confirm in writing what was and was not erased.

For all other categories: telemetry events keyed by your install UUID will be deleted. License-key records are subject to a 5-year legal retention obligation (Art. L. 123-22 Code de commerce) and cannot be deleted before that period expires.

5.4 Right to Restriction (Art. 18)

You may request that Cogitent restrict processing of your data in circumstances specified by Art. 18 RGPD (e.g., while a rectification request is pending).

5.5 Right to Data Portability (Art. 20)

You may request a machine-readable (JSON) export of telemetry events associated with your install UUID. This right applies to data processed on the basis of consent or contract. Submit your request to [email protected].

5.6 Right to Object (Art. 21)

Where processing is based on legitimate interests (Art. 6(1)(f)), you may object at any time. Where processing is based on consent (Art. 6(1)(a)), you may withdraw consent via the TUI toggle at any time.

5.7 Rights Related to Automated Decision-Making (Art. 22)

Cogitent does not use personal data to make any automated decisions that produce legal effects or similarly significant effects for individual users. This right is therefore not applicable to Cogitent's current processing activities.

---

6. Retention Summary

---

7. Cookies and Similar Technologies

The Cogitent software (Python library, MCP server, TUI) does not use browser cookies or equivalent persistent tracking technologies. No web beacons, fingerprinting scripts, or local-storage identifiers beyond the install UUID are used in M1.

If Cogitent operates a web-based dashboard or documentation site in a future release, that surface will have its own cookie notice updated in this policy before launch. For M1, no such web surface exists.

---

8. Children

The Cogitent software is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 is using the Software and their data has been processed by Cogitent, please contact [email protected]. Cogitent does not use location, network, or session signals to detect minor users proactively.

---

9. Security

Cogitent applies appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, or disclosure, including:

• TLS 1.3 in transit for all Cogitent-operated API endpoints.
• Encryption at rest for the telemetry store and license-key validation log.
• Role-based access control within Cogitent Labs.
• Differential privacy and secure aggregation for FL gradients (see Section 2.3).

Despite these measures, no system is completely secure. If you discover a security vulnerability that could affect the privacy of user data, please report it via the process described in docs/security/.

For the operator-side right-to-erasure workflow (Section 5.3), see docs/security/right-to-erasure.md.

---

10. Complaints

If you believe that Cogitent has not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the CNIL (the French supervisory authority):

CNIL 3 Place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07 Website: https://www.cnil.fr [placeholder — verify before publication] Online complaint form: https://www.cnil.fr/fr/plaintes [placeholder]

You may also lodge a complaint with the supervisory authority in your country of habitual residence, place of work, or the place where the alleged infringement occurred (Art. 77 RGPD).

---

11. Changes to This Policy

Cogitent may update this Privacy Policy to reflect changes in processing activities, applicable law, or business practices. Material changes will be announced via the Cogitent release notes and, where technically feasible, via an in-app notification. We will always maintain a version history in this file.

Version history:

---

End of Privacy Policy v1.0 — Cogitent CE and Plus Edition