Capybaba AI Search Privacy Notice
The Privacy Notice is Effective as of March 24, 2026
This Privacy Notice (“Notice”) sets out how Kosmos Mind Technology S.A. and its affiliates (“we”, “us” or “our”) protect the personal data we process relating to you. This Notice applies if you use any of the Capybaba AI Search application or website services (the “Service”) , for which we are the controller.
Who is the controller
The data controller is Kosmos Mind Technology S.A., with its address at Calle 60 E 16, San Francisco
Ciudad de Panamá, Panama. Please contact us by sending an email to info@capybaba.io.
Personal Data We Collect About You
Through the Service, we currently process your personal data. Personal data means any information that directly or indirectly identifies a natural person or makes such natural person identifiable, in particular, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity. In the US “personal data” refers to information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a consumer or household.
We collect and process the following categories of personal data from and about you, including but not limited to:
| Category of personal data | Description & Examples | Category of source |
| Online and Technical Identifiers | IP address, device identifiers, browser type, operating system (OS), app version, User Agent (UA), device model, and network type. | Indirectly from you (e.g., from your usage of our Service) |
| Internet & Network Activity | User-input queries/keywords, request status codes, timestamps, and information regarding your interaction with the Service (e.g., clicks). | Indirectly from you (e.g., from your usage of our Service) |
| Communication Information | Name, email address, phone number, and the content of your messages or audio recordings provided during support requests. | Directly from you when you contact us |
Uses of Personal Data
Your personal data may be processed by us in the following ways and for the following purposes：
| Scenario | Purpose of Processing | Categories of Personal Data | Justification of Processing |
| Content Recommendation (Channel All / Channel Next) | To display homepage content and paginated feeds tailored. | Online and Technical Identifiers; Internet & Network Activity | Performance of a contract; |
| Search Functionality (Suggestions & Results) | To provide auto-complete "hot words" and retrieve search results based on your keywords or IMDB IDs. | User Keywords; Online & Technical Identifiers. | Performance of a contract; |
| Third-Party Website Redirection | To complete the jump to external websites, ensure access security, and improve your experience. | Target URL/Domain; Click Timestamps; Online and Technical Identifiers. | Performance of a contract; |
| User Communication | To resolve technical issues, respond to support requests, and send mandatory policy updates. | Communication Information; Online and Technical Identifiers. | Performance of a contract;Legitimate interest. |
| Security and Fraud Prevention | To detect malicious activity, prevent fraud, and ensure the stability of our global server infrastructure. | IP Address; Request Status Codes; Online and Technical Identifiers. | Legitimate interest. |
In addition, we may use your personal data to comply with a legal obligation to which we are subject, to satisfy tax or reporting obligations. If we ask you for your consent, you maintain the right to withdraw your consent at any point in time, without affecting the lawfulness of the processing that relied on such consent before your withdrawal.
Who Do We Share Personal Data With
We may share your personal data with the following categories of recipients:
· our third-party service providers who perform certain business-related functions for us, such as website hosting, data analysis, infrastructure provision, IT services, customer support service, e-mail delivery services, and other similar services to enable them to provide services to us. Those third parties will only act in accordance with our instructions and on our behalf.
· affiliates of our company, to carry out regular business activities (such as providing you with Service, complying with law enforcement activities, lawfully processing your Personal Data under this Privacy Notice), and/or with another company or third party in the event of a reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets or stock (including, without limitation, in connection with any bankruptcy or similar proceedings). In such an event, you will be notified via email and/or a notice on our website and/or application of any change in ownership, new uses of your personal data, and choices you may have regarding your personal data. We will limit the sharing of your personal data to a reasonable amount necessary to achieve the respective purpose.
These disclosures discussed above are necessary: (a) to comply with applicable laws and regulations; (b) to comply with legal process; (c) to respond to requests from public and government authorities, including public and government authorities outside your country of residence; (d) to enforce our terms and conditions; (e) to manage and protect our operations, business, and systems; (f) to protect our rights, privacy, safety or property, and/or that of other users, including you; and (g) to allow us to pursue available remedies or limit the damages that we may sustain.
Except for the third parties described above, we may also disclose your personal data to other third parties with additional notice and/or consent, if such consent is required.
Please note that if you access third-party services — such as social media services, third-party single sign-on tools, third-party applications, and third-party websites — through our Service and services, these third-party services may be able to collect information about you, including information about your activity on our Service and services, and they may notify your connections on the third-party services about your use of the product and services, in accordance with their own privacy policies. For additional information about targeted advertising, see the additional disclosures at the bottom of this Notice.
Additional Information About our Data Collection and Sharing Practices
Sensitive Personal Information: We only use your Sensitive Personal Information for the purpose for which it was collected.
Sharing of Aggregated Data: We may create and use aggregated or de-identified data at our discretion, such as by sharing it with marketing agencies, media agencies and analytics providers.
Combination of Information: We may combine personal data together and with other information we obtain from our business records. Additionally, information collected about you from a particular browser or device may be linked to information collected from another computer or device that we believe relates to you.
International Transfers
We share your personal data with other entities that are part of our corporate group, some of which are located outside your country, to carry out the activities specified in this Notice. We may also subcontract the processing or sharing of your personal data to third parties located outside your country. When you use our Service, we may transfer, store and process your information within and outside of your country of residence, consistent with this Notice. The processing of your personal data may, therefore, also be subject to laws other than those applicable in your country of residence.
We take appropriate steps to ensure that any international transfers of personal data are carried out in accordance with applicable privacy laws and, in particular, that contractual, technical, and organizational measures will be in place under our agreements with recipients of the data, including, without limitation, the Standard Contractual Clauses approved by the European Commission. You can obtain a copy of such agreements upon request via the contact information indicated below at the end of the Notice.
Cookies
We provide a variety of Service and services on our Website using cookies. We place cookies on your device on which you access our services in order to provide you with personalized access to essential services, enhance website functionality, and to show you offers and services tailored to your apparent interests.
What is a Cookie?
A cookie is a small piece of data that a web site can send to your browser, which may then be stored on your hard drive as a “tag” that identifies your computer. The cookie has a unique ID assigned to your device, but typically does not contain data that directly identifies you like your name or email address. It helps to navigate from page to page on a website, provide secure connections, and remembers preferences from a previous visit, when you return. Cookies can allow us to properly format the web page on subsequent visits for your specific computer and browser, letting us personalize your experience and tailor our inter actions with you. Cookies also help us to gather anonymous statistics about usage and effectiveness of our Services.
Cookies may be either “persistent” cookies or “session” cookies. A persistent cookie consists of a text file sent by a web server to a web browser, which will be stored by the browser and will remain valid until its set expiry date (unless deleted by the user before the expiry date). A session cookie, on the other hand, will expire at the end of the user session, when the web browser is closed. We use both persistent and session cookies.
We use third-party services for analytics and interest-based advertising purposes. These service providers and ad partners may use cookies alone or in conjunction with unique identifiers, beacons, and other tracking technologies to collect information about you when you use the our services, open our emails, or interact with our ads. We do not combine the information collected through the use of these services with information that directly identifies you.
Any use of cookies that is not absolutely technically necessary for this purpose constitutes data processing that is only permitted with your express and active consent. This applies in particular to the use of performance, advertising, targeting or sharing cookies.
How to Manage Your Cookies
You can control and manage cookie settings at any time through Cookie settings.
However, disabling all cookies could diminish the functionality of the site and negatively impact your site experience.
Please note that by disabling or deleting cookies, you may not be able to access the full functionality of the Website.
Security
We use commercially reasonable physical, administrative, and technical safeguards to preserve the integrity and security of your personal data, and provide various security strategies to effectively ensure the data security of user devices, including the following:
Ÿ We will use SSL and other technical measures to ensure encryption with regard to our Service. We will regularly examine our practice of information collection, storage, and processing (including physical security measures) to prevent unauthorized system access.
Ÿ We will authorize our employees and personnel of third parties to access your personal data on a need-to-know basis in order to help us process your personal data and provide services to you. These employees and external personnel (of third parties authorized by us) are subject to contractual confidentiality obligations.
Ÿ We will prudently select business partners and service providers, and implement the requirements for personal data protection to the business contracts between both parties.
Data Retention
We retain personal data only for as long as needed for the purposed to provide the Service and fulfill the transactions you have requested, or for other legitimate purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements.
Your Privacy Rights
Certain jurisdictions have specific legal requirements and grant privacy rights with respect to personal data, and we will comply with restrictions and any requests you submit as required by applicable law. For example, you may have the right to review, correct, and delete personal data we have about you, or to consent or withdraw consent to certain uses or sharing of personal data. You may be able to use our Service to access and update the personal data that you have provided to us. You may also exercise these rights by submitting a request as described in the “How to Submit a Request” section below.
If you are a resident of the United States, please read the “Information for Individuals Located in the United States” section of this Notice.
If you are resident of California, please also read the “Additional Notice for California Residents” section of this Notice. You may have additional rights in relation to your personal information.
If you are resident of Virginia or Colorado, please also read the “Additional Notice for Colorado, Connecticut, and Virginia Residents” section of this Notice. You may have additional rights in relation to your personal information.
If you are resident of Nevada, please also read the “Additional Notice for Nevada Residents” section of this Notice. You may have additional rights in relation to your personal information.
If you are a resident of the EEA (European Economic Area), please read the “Information for Individuals Located in the European Economic Area” section of this Notice.
Information for Individuals Residing in the United States
If you are a resident of the United States, your state of residence may provide you additional rights in relation to the processing of your personal data. Further to the information set out in the “Your Privacy Rights” section of this Notice, the following additional information may apply to you. Unless otherwise required by applicable law, the following terms shall have the following meanings:
· “Process” or “processing” means any operation or set of operations performed, whether by manual or automated means, on personal information or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion or modification of personal data.
· “Targeted advertising” or “Cross-context behavioral advertising” means displaying advertisements to a consumer where the advertisement is selected based on personal data obtained from that consumer’s activities over time and across non-affiliated websites or online applications to predict such consumer’s preferences or interests.
· “Sale” or “sell” means renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal data by the business to a third party for monetary or other valuable consideration.
· “Share,” “shared,” or “sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, personal data to a third party for cross-context behavioral advertising.
· “Profiling” means any form of automated processing of personal data to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
Persons with disabilities may obtain this notice in alternative format upon request by contacting us at info@capybaba.io. You may exercise the rights given to you by your state of residence by submitting a request as described in the “How to Submit a Request” section below.
Right to Know and to Access. Subject to certain exceptions, and legal obligations, you may have the right to request that we disclose certain information to you about our collection, use, and disclosure of your personal information, such as the following:
· The categories of personal data we collected about you;
· The categories of sources of that information;
· The business or commercial purposes for which we collect, sell or share personal data about you;
· The categories of personal data about you that we have disclosed about you and the categories of persons or vendors to whom it was disclosed for a business purpose; and
· The specific pieces of personal data we have collected about you.
This information is disclosed above in the “Personal Data We Collect About You” section. To protect your personal data, we may request additional information to verify your identify before we act on your request. To the extent legally required, we will provide the information you request, in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance. We may provide this information to you via email to the email address you have provided with your request.
Right to Correction. You may have the right to request that we correct any inaccurate personal data we maintain about you. In response to your request, we may request additional information showing that the information you want to correct is inaccurate.
Right to Deletion. You may have the right to request that we delete your personal data. This right is subject to certain exceptions, and legal obligations imposed by state or federal laws including, without limitation, privacy and employment laws. We will delete or deidentify personal data not subject to one of these exceptions from our records and, to the extent required, we will direct our service providers to take similar action.
Right to Opt-Out. Depending on where you reside, you may have the right to opt-out of the processing of your personal data for the purpose of (i) the sale or sharing of your personal data by us to third parties, (ii) targeted advertising, or (iii) profiling.
Non-Discrimination or Retaliation. We will not discriminate or retaliate against you for exercising any of your data privacy rights.
Do Not Track
If you are a resident of the United States, we do not currently recognize browser signals regarding tracking mechanisms, which include “Do Not Track” (DNT) signals sent by web browsers, mobile devices, or other mechanisms.
Global Privacy Signal
We receive and process Global Privacy Signals (“GPC Signal”) for requests to opt-out of sale or sharing. We process the commonly used and industry standard GPC Signals but because this is new technology and new providers may offer solutions, we will do our best to recognize, process, and honor a GPC Signal that meets the legal standards and is widely adopted in the industry.
Additional Notice for California Residents
“Share” and “sharing” as used in this section, does not include transfers of personal data described in this Privacy Notice as part of a corporate business transaction, such as a merger, acquisition, or joint venture, or in the event of insolvency, bankruptcy, or receivership. Should such an event occur, we will use reasonable efforts to direct the transferee to use personal data you have provided to us in a manner that is consistent with this Privacy Notice.
Categories of Personal Data Disclosed to Service Providers
We disclose personal information to certain third parties to enable them to fulfill the purposes described above. The personal data provided to our service providers is limited to that personal data which is necessary for them to fulfill these purposes. Our service providers have contractually agreed not to use your personal data other than as necessary to fulfill the applicable purposes and in accordance with the CCPA. In the preceding 12 months, we have disclosed the categories of personal information described above with the following categories of service providers:
· Marketing and Advertising Providers
· Operating Systems and Platforms
· Customer Support Providers
We disclose personal data to our service providers in accordance with the purposes described above.
Categories of Personal Data Sold or Shared to Third Parties
We do not sell and have not sold your personal data or transferred personal data to third parties to use for their own benefit in the preceding 12 months. We also do not share your personal data for targeted or cross-context behavioral advertising, except as described below. Relatedly, we do not sell or share personal data of California residents under 16 years of age.
For more information about the collection and use of personal data by third parties who process information collected by cookies and similar technologies that we permit them to use on our Services, please refer to the “Cookies” section above. Our use of cookies and similar technologies may be considered a “sale” or “sharing” under certain states’ privacy laws.
Right to Limit Use and Disclosure of Sensitive Personal Information
California residents have the right to direct us to limit our use of your sensitive personal information that we use to infer characteristics about you to that use which is necessary to fulfill the purposes reasonably expected by an average consumer who requests those goods or services. When we collect sensitive personal information, it is only used as it is necessary to fulfill the purposes for which it was collected and not to infer characteristics about you.
California "Shine the Light" Law
Residents of the State of California have the right to request information about other companies to whom the company has disclosed certain categories of personal information during the preceding year for those companies’ direct marketing purposes. If you are a California resident and would like to make such a request, please email us at info@capybaba.io
Notice of Financial Incentive
From time to time, we may collect personal data, such as email addresses, in connection with a promotion, offer or discount. Our offers and incentives generally reflect the value of the relationships that we have with the individuals who participate in these programs. Participation in these programs is voluntary and you may withdraw at any time by emailing us at info@capybaba.io.
Additional Notice for Colorado, Connecticut, and Virginia Residents
Right to Appeal
If you are a Colorado, Connecticut, or Virginia resident that made a request to exercise any of the above data access rights, and we are unable to comply with your request, you may request to appeal our decision within a reasonable period time by contacting us at info@capybaba.io. with the subject line “Data Access Request Appeal”. Within 60 days of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If after you complete the appeal process with us, you are still not satisfied with our response, you may contact your Attorney General to file a complaint. Below are the contact information for the appropriate entity where you can inquire about filing an appeal:
· For Colorado residents, to the Colorado AG at https://coag.gov/file-complaint/
· For Connecticut residents, to the Connecticut AG at https://www.dir.ct.gov/ag/complaint/
· For Virginia residents, to the AG at https://www.oag.state.va.us/consumercomplaintform
Additional Notice for Nevada Residents
Residents of the State of Nevada have the right to opt out of the sale of certain pieces of their information to other companies who will sell or license their information to others. At this time, we do not engage in the sale of information.
Information for Individuals Located in the European Economic Area
The GDPR offers data subject rights for individual located in the EEA.
Thus, you have the following legal rights against us with regard to your personal data, provided that the respective requirements are met. You can find further information on your rights and the relevant requirements on the EU Commission's website at https://commission.europa.eu/law/law-topic/data-protection/reform/rights-citizens_en.
Right of Access
As a data subject, you have the right to request confirmation as to whether we process personal data that concerns you. If this is the case, you have the right to information about this personal data, as well as other information, e.g., the processing purposes, the recipients and the planned duration of storage or the criteria for determining the duration.
Right to Rectification and Completion
As a data subject, you have the right to demand the correction of incorrect personal data. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data.
Right to Erasure
As concerned data subject, you may have the right to the erasure your personal data. For example, if your personal data is no longer necessary for its original purpose, you have revoked your consent, or the personal data has been improperly processed.
Right to Restriction of Processing
As a data subject, you have the right to restrict the processing in the cases prescribed by law.
Right to Data Portability
As a data subject, you have the right, in the cases prescribed by law, to receive the personal data concerning you in a structured, common and machine-readable format.
Right of Objection
As a data subject, you have the right to object at any time to the processing of certain personal data concerning you for any reason relating to your particular situation.
Right to Revoke your Consent under Data Protection Law
You may revoke your consent to the processing of your personal data at any time with effect for the future. However, the lawfulness of the processing carried out before the revocation is not affected.
Right to Complain to a Data Protection Authority
You have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which you reside, your place of work or the place where the alleged infringement was committed, if you believe that the processing of your personal data violates the GDPR.
Changes to This Privacy Notice
We may update this Privacy Notice to reflect changes to our data processing. Any update to this Privacy Notice will be effective upon its posting on our website at https://capybaba.io/policy/terms/en.html, and we encourage you to periodically review the Privacy Notice page on our website for the latest information on our privacy practices.
Contacting Us and How to Submit a Request
If you would like further information on the collection, use, disclosure, transfer, or processing of your Personal Data or the exercise of any of the rights listed above, please contact us through the specific channels indicated below.
The data controller is Kosmos Mind Technology S.A.., with its address at Calle 60 E 16, San Francisco Ciudad de Panamá, Panama. Please contact us by sending an email to info@capybaba.io.