Plain-language version: I collect only what you give me on a form, I use it to send you what you asked for, and I add you to a mailing list only if you tick a box for it. I never sell or rent your details. Everything below is the full account.
This site, cosmomariano.com, is run by Cosmo Mariano ("I", "me"). Some communications you can opt into are sent by XSparks (xsparks.ai), the firm where I serve as Chief Client Outcomes Officer. Cosmo Mariano and XSparks are separate senders, which is why the forms ask for your permission for each one separately. For any question about your data, or to exercise any of the rights below, email cosmo@xsparks.ai.
I only collect personal data that you enter into a form on this site. Depending on the form, that is:
I do not ask for, and you should not send, special-category data (health, financial account numbers, and the like). The interactive Risk Read and Software Tax tools calculate their results in your browser; those working numbers are only sent to me if you then submit the form to request the full read.
To deliver what you requested — the ebook, a Risk Read, or a Software Tax assessment. Legal basis: taking steps at your request / my legitimate interest in fulfilling it. This happens whether or not you opt into any marketing.
To send you the AI Value Dispatch, my newsletter, but only if you ticked that box. Legal basis: your consent.
To let XSparks contact you about the AI Operating Model, events, and related services, but only if you ticked that separate box. Legal basis: your consent.
To keep a record of your consent so I can show what you agreed to and when. Legal basis: my legitimate interest in meeting anti-spam and data-protection obligations (including Canada's CASL and the GDPR).
I use a small number of trusted service providers who process your data on my behalf, under contract, only to provide their service:
These providers may process data on servers in the United States. Where your data moves across borders, it is protected by the safeguards those providers offer (such as standard contractual clauses). If this site uses analytics, it is a privacy-light service that measures traffic in aggregate and does not build advertising profiles of you. I do not sell, rent, or trade your personal data to anyone, and I do not use it for advertising targeting.
Fulfilment records (who requested what) are kept while there is a live business reason and then removed. Newsletter details are kept until you unsubscribe or ask me to delete them. Consent records are kept for as long as I rely on that consent plus a reasonable period afterward, so I can evidence it if asked.
You can unsubscribe at any time using the link at the foot of any Dispatch or XSparks email, or by emailing cosmo@xsparks.ai. Withdrawing consent does not affect anything done before you withdrew it.
Depending on where you live, you also have the right to ask me to give you a copy of your data, correct it, delete it, restrict or object to how it is used, or provide it in a portable form. To exercise any of these, email cosmo@xsparks.ai and I will respond within the timeframe the law requires. If you are in the UK or EEA and believe I have mishandled your data, you may also complain to your local data-protection authority.
If I change how data is handled, I will update this page and move the effective date at the top. Material changes to marketing practices will be flagged before they take effect.
This notice is provided in good faith to explain current practices in plain language. It is not legal advice; if your obligations are specific or high-stakes, have it reviewed by qualified counsel for your jurisdiction.