Privacy at COSMO.

COSMO generally acts as a controller for account administration, billing, website, security and support data. When COSMO processes customer content or connected-workspace data solely to provide the service on a customer’s instructions, the customer generally determines the purposes of that processing and COSMO acts as a processor.

• Account data: name, email address, authentication identifiers and account preferences.
• Workspace data: workspace names, memberships, roles, brand settings, markets and configuration.
• Usage data: exports, feature usage, integration events, device/session metadata, errors and timestamps.
• Billing data: plan, subscription identifiers, payment status and billing events. Card data is handled by the payment provider when billing is enabled.
• Support and sales data: information submitted through support, contact and Enterprise forms.
• Connected-service data: tokens and identifiers needed to perform authorized actions with services such as Klaviyo.

• Provide, secure and operate the product.
• Authenticate users and enforce workspace permissions and plan limits.
• Connect customer-authorized third-party services and complete requested exports.
• Provide support, billing, onboarding and important service communications.
• Understand product reliability and aggregate usage so COSMO can improve.
• Comply with legal obligations and protect the service from misuse.

Depending on the context and applicable law, processing may be necessary to perform a contract or provide requested services, comply with legal obligations, pursue legitimate interests such as security and product improvement, or act on consent where consent is required.

COSMO does not sell personal data to advertisers. Data may be shared with infrastructure, payment, transactional email and other service providers that support the product, or with customer-connected destinations when a user instructs COSMO to perform an integration action. See the Trust Center for the current service-provider overview.

Account and workspace data is retained while needed to provide the service and for a reasonable period afterward where necessary for security, billing, dispute resolution or legal obligations. Export-history visibility may differ by plan. Support, audit and billing records may be retained longer where operationally or legally necessary.

Service providers may process data in countries different from the user’s location. Where applicable law requires a transfer mechanism, COSMO will use an appropriate legally recognized mechanism or rely on another lawful basis before the relevant production use.

Depending on applicable law, individuals may have rights to access, correct, delete, restrict or object to processing, request portability, or withdraw consent. Workspace administrators can also manage memberships, devices and certain stored settings directly in COSMO.

Submit a privacy request →

COSMO is designed for professional and business use and is not intended for children. This notice may be updated as the service, legal operator or provider stack changes; the current update date is shown at the top of the page.