Private by design, clear about the rest.

Controller and contact

Email: privacy@mediatoss.com

Media Toss UG (haftungsbeschränkt) is the controller for the Rosi website and services described here.

Website delivery and cookies

• When you visit, our hosting and security services process technical request data such as IP address, date and time, requested URL, browser information, and security signals. We use it to deliver and protect the site based on our legitimate interests (Article 6(1)(f) GDPR).
• The public marketing pages use no analytics, advertising trackers, local storage, session storage, or non-essential cookies.
• The free-trial form uses Cloudflare Turnstile to prevent automated abuse. Turnstile processes technical and security signals and may use strictly necessary browser storage for that check.
• After a feedback-portal sign-in, we set a secure, HttpOnly, SameSite=Lax session cookie named rosi_feedback_session. It is strictly necessary to keep you signed in. The current default session period is 30 days.
• Our security provider may use strictly necessary measures when it detects suspicious traffic. These are used only to protect and operate the service.

Access requests, free trials, and feedback

• The Hosted Beta access form collects your first name, email address, and any optional note. We use an email delivery service to confirm and review your request.
• The Rosi for Mac trial form collects your email address, acceptance of the current service terms, your optional marketing choice, and security-check results. We use them to verify your email, enforce one trial per address, prevent abuse, activate and end the service, and send necessary trial lifecycle emails.
• We retain privacy-preserving, short-lived security fingerprints rather than raw IP addresses in the trial record. Trial lifecycle records contain operational events, not message or email content.
• Product-news email is optional and unchecked by default. Requesting or using a trial does not by itself authorize a marketing campaign, and you can withdraw an opt-in at any time.
• The feedback portal processes your email address, sign-in records, feedback you submit, and limited technical information used for security and abuse prevention.
• We process these details to take steps at your request before a contract, provide the requested service, respond to you, and protect the service (Article 6(1)(b) and (f) GDPR).

Rosi account and assistant data

• Account and service data: sign-in details, subscription and access state, app version, device name, and similar operational metadata.
• Assistant content: messages, reminders, memories, jobs, attachments, voice notes, and other material you choose to give Rosi.
• Connected service data: account identifiers, granted permissions, and task-related requests and results for services you choose to connect or use.
• We process this data to provide your subscription, carry out your requests, maintain reliability, prevent abuse, support recovery, and respond to support requests (Article 6(1)(b) and (f) GDPR). We process records required by tax or other law under Article 6(1)(c) GDPR.

Connected Apps and Composio

• Composio is Rosi's Connected Apps provider. It presents the secure connection flow, provides implemented toolkit actions, and carries task-related requests and results between Rosi and the service you connect. Where the authentication method uses tokens, Composio holds and refreshes them.
• Rosi does not receive the password you enter at the connected service or the raw access token Composio holds. Rosi does receive the account status, identifiers, and task data needed to carry out your request.
• The connected service defines and enforces its permission and API model. Composio's connection configuration requests scopes where applicable, and its toolkit determines the implemented actions available to Rosi. Rosi selects and governs the capabilities used for your task; you approve or revoke access. Available actions, permissions, and authentication methods vary even though Composio provides access to a catalog of more than 1,000 services.
• Composio may process and log task-related requests and results under the configuration used for Rosi and its own policies. See Composio Security and Composio Privacy.

Where data is stored and shared

• Rosi for Mac: core assistant state is stored on your Mac. Data leaves it when an online provider or connected service is needed for your request.
• Rosi Hosted: core assistant state is stored in a dedicated managed environment. Shared delivery services transiently route traffic needed to reach it.
• We share only the data needed with providers that support hosting and security, AI and search, messaging, email, payments, backups, and services you choose to connect. For Connected Apps, this includes Composio and the service you connect.
• When data is processed outside the European Economic Area, we use an applicable adequacy decision or contractual safeguards as required by law. You can ask us for information about the safeguards that apply.

Retention and deletion

• Website security data is kept only as long as needed to operate and secure the service, investigate incidents, and meet legal obligations, then deleted or anonymized under the applicable provider settings.
• Hosted access requests, feedback, and support correspondence are kept while we handle and reasonably follow up on them, and longer only when needed for a contract, legal claim, or statutory recordkeeping.
• Pending trial links expire after 30 minutes. Trial request, activation, expiry, provider-revocation, and email-delivery records are kept as needed to operate the trial, enforce the one-trial limit, prevent abuse, reconcile service credentials, and establish or defend legal claims. Short-lived security fingerprints are removed earlier.
• Rosi data is kept while your service is active or until you delete it. Hosted Rosi continuity backups expire on a rolling 30-day schedule.
• After a Hosted Rosi deletion, active managed state is removed and service credentials are revoked. Any remaining continuity backup copies expire within 30 days. Billing, tax, fraud-prevention, and legal records may be kept for the applicable statutory periods.

Your GDPR rights

• You may request access, correction, deletion, restriction, or portability of your personal data.
• You may object to processing based on legitimate interests. If processing is based on consent, you may withdraw that consent at any time for the future.
• You may complain to a data protection authority. The authority for our registered office is the Landesbeauftragte für den Datenschutz Sachsen-Anhalt.
• To exercise a right, email privacy@mediatoss.com. We may need to verify your identity before acting on a request.

Your choices and required data

• You decide which content and connected services to give Rosi and can disconnect optional services. Disconnecting removes the connection from Rosi and Composio. You can also revoke Rosi or Composio directly in the connected service's security settings for immediate control at that service.
• Required access-form and account fields are needed to respond to your request or provide the service. Without them, we may be unable to invite you, sign you in, or provide Rosi.
• The marketing checkbox on the free-trial form is optional. Leaving it unchecked does not affect trial eligibility or service emails.
• We do not use website visitor data for solely automated decisions that produce legal or similarly significant effects.