Privacy Policy

Last updated: September 23, 2026

This Privacy Policy explains how Cosmic ("we", "us") collects, uses, and shares information when you use cosmiccloud.app and related services (the "Service"). Cosmic is a business-to-business platform: most information we handle is business contact information and business project content, submitted by our clients and their teams.

Our role

For information you upload about your own staff, clients, or customers, you act as the controller (or business) and we act as your processor (or service provider), handling that information only to provide the Service under your instructions. For your own account and billing information, we act as the controller. If you require a Data Processing Addendum, contact us and we will provide one.

Information we collect

• Account information: name, email address, company name, and role.
• Content: requests, comments, chat messages, files, documents, brand materials, and the prompts and attachments you send to Nova and other AI features.
• Billing information: processed by our payment provider; we do not store full card numbers. We store billing address, plan, charge history, and receipts.
• Usage data: device, browser, log, and activity information, including push notification subscriptions you enable.
• Email replies: when you reply to a notification email, we receive and store that reply as a comment.

How we use information

• To provide, operate, secure, and improve the Service and complete your requests.
• To send notifications, updates, receipts, renewal reminders, and account emails.
• To process payments and prevent fraud or abuse.
• To power AI features, such as drafting copy, generating designs and images, and research.

AI processing

When you use Nova or another AI feature, the prompt you write and the relevant project context — which may include task details, comments, brand materials, and files you attach — are transmitted to our AI model providers through their commercial APIs solely to generate a response or deliverable for your request.

• Our primary AI provider is xAI, LLC (the Grok models). We use xAI's standard commercial API and do not have a negotiated or custom data agreement with them; their standard API terms and privacy commitments apply to data we send.
• We do not sell your content, and we do not use your content to train our own models or to target advertising.
• We do not control the internal practices of AI providers beyond the terms of their commercial APIs. Please avoid submitting information you are contractually or legally barred from disclosing to a third-party processor, and avoid submitting sensitive personal data (such as government identifiers, health, or financial account data) into AI prompts.
• AI output may be inaccurate. It should be reviewed before publication or reliance.

Service providers and subprocessors

We share information with providers that help us run the Service, under contracts that limit their use of it:

• xAI, LLC — AI generation, research, and context processing.
• Google LLC — supporting AI model processing for certain features.
• Supabase and its cloud hosting providers — application database, authentication, and storage.
• Backblaze and Cloudflare — file storage, delivery, and content distribution.
• Stripe — payment processing, subscriptions, receipts, and tax calculation.
• Postmark — transactional and notification email delivery, including inbound email replies.

We may disclose information if required by law or to protect rights and safety, or as part of a merger or acquisition. We do not sell personal information and we do not share it for cross-context behavioral advertising.

Data retention

We keep information for as long as your account is active and as needed to provide the Service, comply with legal and tax obligations, and resolve disputes. When an account closes, you may export your files before deletion; we may delete remaining data after a reasonable retention period.

Security

We use encryption in transit, access controls, and account-level data separation. No method of transmission or storage is completely secure.

International transfers

We operate in the United States, and our providers may process information in the United States and other countries. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.

Your rights

Depending on where you live (including under the CCPA/CPRA, the Washington My Health My Data Act where applicable, and the GDPR/UK GDPR), you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. Contact us to make a request; we will verify your request and will not discriminate against you for exercising these rights. If you are an end user of one of our clients, we will refer your request to that client.

Cookies and local storage

We use essential cookies and browser storage to keep you signed in and remember preferences. We do not use advertising cookies.

Children

The Service is a business tool and is not directed to children. It is not intended for anyone under 18, and we do not knowingly collect information from children.

Changes

We may update this policy and will notify you of material changes by email or in the app.

Contact

Privacy questions or requests:

Cosmic
1305 Fowler St. Ste 2A
Richland, WA 99352
United States
info@onlinecosmic.com