Privacy policy
Last updated 4 November 2026
This policy explains how Roy Azran, trading as “Cosmo” and “CosmoCMO” (“we”, “us”), handles personal data when you use Cosmo at cosmocmo.com or talk to Cosmo on WhatsApp, Telegram, iMessage, email or the phone.
In short: we use your data to run your marketing, nothing goes out without your approval, we don't sell your data, we don't train AI models on it, and you can ask us to export or delete it at any time. It takes effect on 4 November 2026.
1. Who we are
Cosmo is provided by Roy Azran, a sole trader (self-employed) in Tel Aviv, Israel. For anything about privacy, write to roy@cosmocmo.com.
For your own account and the data you give us to run Cosmo, we are the controller. For personal data about your customers, leads and contacts that Cosmo handles for you (for example an outreach list), you are the controller and we act as your processor, following your instructions.
2. What we collect
- Account data: name, email address, sign-in details from Supabase (email magic link or Google sign-in), phone number and messaging IDs you verify, company, plan and settings.
- Workspace and brand kit: your website content, brand kit (logo, colours, voice), goals, onboarding answers, competitors, the plan Cosmo writes and your working preferences.
- Messages: what you send Cosmo and what Cosmo sends you, on every channel: the web app, WhatsApp, Telegram, iMessage, email and phone. Voice notes are transcribed to text (with OpenAI Whisper, if enabled). Phone calls produce audio and a transcript.
- Connected platforms: access tokens and keys for the accounts you connect (ad accounts, social profiles, websites, inboxes, GA4, Search Console, Stripe), stored encrypted.
- Platform data: data Cosmo reads from those accounts when a task or report needs it, such as campaign results, post stats, site analytics, revenue figures and, for connected inboxes, replies to your cold emails.
- Work product and approvals: drafts, posts, articles, creatives, videos, lead lists, research results, browser runs, and a log of every approval, edit and skip.
- Data about other people that you ask Cosmo to handle: leads and their business contact details, email replies, and public posts and profiles found during research.
- Usage and analytics: product events (such as “post approved”) tied to your workspace, and anonymous pageviews on our marketing site (page path and referring site only, no cookies, no IDs, not recorded if your browser sends Do Not Track or Global Privacy Control).
- AI usage records: for each AI request, the model, task, token counts and cost, so we can run the monthly AI budget.
- Billing data: handled by Polar. We receive your plan, subscription status and invoice details, not your full card number.
- Technical data: server logs with IP address, browser and errors, to keep the service secure and working.
3. Why we use it, and our legal bases
For people in the EU and UK, the GDPR requires a legal basis (Article 6) for each use:
What we do Legal basis Provide Cosmo: plan, create, and after your approval publish, send and run your marketing, and report back Contract (Art. 6(1)(b)) Talk to you on the channels you chose, including transcribing voice notes Contract (Art. 6(1)(b)) Bill you and keep tax records Contract and legal obligation (Art. 6(1)(b) and (c)) Keep the service secure, prevent abuse, fix bugs and run the AI budget Legitimate interests (Art. 6(1)(f)) Understand how Cosmo is used and improve it, with minimal analytics Legitimate interests (Art. 6(1)(f)) Research public data about your niche, competitors and leads for you Our and your legitimate interests (Art. 6(1)(f)); for lead data, you as controller decide the basis Send product and account emails Contract (Art. 6(1)(b)) Send marketing emails about Cosmo Consent (Art. 6(1)(a)); you can unsubscribe at any time We don't sell personal data, we don't use it for advertising profiles, and we don't make decisions with legal or similar effects about you by automated means alone.
4. AI and your data
Cosmo runs on Anthropic's Claude models through their commercial API. Under those terms, Anthropic does not train its models on API inputs or outputs. We don't train AI models on your data either.
If enabled, OpenAI transcribes voice notes, and OpenAI, Perplexity and Google Gemini receive questions about your category and brand so Cosmo can check how AI assistants mention you. They get only what each task needs.
AI output can be wrong. That's why nothing goes out without your approval, unless you turn on auto-approve for low-risk scheduled posts and directory listings.
5. Google user data
If you connect Google services (Gmail, Google Ads, GA4, Search Console or YouTube), Cosmo accesses only what each feature needs:
- Gmail: sends the cold emails you approve from your inbox and reads replies to those emails, so Cosmo can stop sequences and sort replies.
- Google Ads: reads performance and creates or changes campaigns you approve (new campaigns start paused).
- GA4 and Search Console: reads traffic, conversion and search data for your reports.
- YouTube: uploads the videos you approve, and reads your channel, video and analytics data for reports.
Cosmo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide and improve the features you use; we transfer it to others only as needed for those features (for example to Anthropic to draft or sort a reply), for security, or to comply with the law; we never use it for advertising; we never use it to train general AI models; and no person reads it unless you ask us to, it's needed for security or abuse investigations, or the law requires it.
Cosmo uses YouTube API Services. By using YouTube features you agree to the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy. We store your YouTube tokens (encrypted), channel details and the stats Cosmo reports on, and don't share them with anyone except our processors as needed to run Cosmo. Cosmo doesn't place cookies on your device for YouTube features. You can revoke Cosmo's access at any time on the Google security settings page or by disconnecting in Cosmo; we then delete the tokens, and you can ask us to delete the data we stored from YouTube.
6. Cookies and analytics
We use only the cookies needed to keep you signed in. We don't use advertising or tracking cookies.
Pageviews on our marketing site are counted with our own first-party beacon: no cookies, no IDs, no stored IP address, and nothing is recorded if your browser sends Do Not Track or Global Privacy Control.
Inside the app we record product events tied to your workspace. If PostHog is enabled, we forward those events from our server, with your workspace ID and the domain of your email address only. We strip names, email addresses, phone numbers and other identifiers first.
7. Who processes it
We use these service providers (sub-processors). Each gets only what it needs for its job and is bound by its terms to protect it. “If enabled” means we only use that provider when the related feature is switched on.
Provider Purpose Data Google Cloud (Cloud Run, Cloud Storage, Secret Manager, Cloud Logging) Hosting the app, storing rendered videos and media, keeping secrets, server logs Everything the service handles passes through it; logs include IP addresses and request details Supabase Database and sign-in Your account, workspace, brand kit, plans, approvals, messages, connected-account tokens (encrypted) and work product Anthropic (Claude API) The AI that powers Cosmo Your messages and the business context needed for each task, such as website content, drafts, replies to your cold emails and platform data you asked about OpenAI (if enabled) Transcribing voice notes (Whisper); checking how ChatGPT mentions your brand Voice-note audio; questions about your category and brand Perplexity (if enabled) Checking how Perplexity mentions your brand Questions about your category and brand Google Gemini API (if enabled) Checking how Gemini mentions your brand Questions about your category and brand Resend Email between you and Cosmo (briefs, approval cards, replies) Your email address and the content of those emails Meta WhatsApp Cloud API, or Zernio as WhatsApp provider WhatsApp messages with Cosmo Phone number, profile name, messages and voice notes on that channel Telegram Telegram messages with Cosmo Telegram user ID, name, messages and voice notes on that channel Sendblue (if enabled) iMessage with Cosmo (US numbers) Phone number, messages and voice notes on that channel ElevenLabs (if enabled) Phone calls with Cosmo; voiceovers for reels Call audio, phone number and transcripts; voiceover scripts Polar Checkout, subscriptions, invoices and tax (merchant of record) Name, email, billing address and payment details (we never see your full card number) PostHog (if enabled) Product analytics Event names with your workspace ID and the domain of your email address only; no names, email addresses or message content Browserbase The remote browser Cosmo uses for research and approved web tasks The pages Cosmo visits and the details you approved it to enter Apify (if enabled) Niche and competitor research on public social posts (TikTok, Instagram, LinkedIn, Reddit) Your keywords and competitors; returns public posts and public profile details ScrapeCreators (if enabled) Public ad library and social data, as a fallback Competitor names and pages DataForSEO (if enabled) Keyword volumes and search rankings Your domain, competitors and keywords Apollo (if enabled) Finding leads for outreach Your search criteria; returns business contact data Reoon (if enabled) Verifying email addresses before sending Lead email addresses fal (if enabled) AI-generated video clips (B-roll) Video prompts and scripts HeyGen and Creatify (if enabled) Videos with AI actors Scripts, product details, images and your website address Postiz (if enabled) Posting to X, Pinterest and Bluesky Post content, media and the accounts you connect there Google PageSpeed Insights Website speed and health checks Your public website address 8. Platforms you connect
The platforms you connect are not our processors. When Cosmo reads from or publishes to Meta (Facebook, Instagram, Threads, Meta Ads), Google (Google Ads, GA4, Search Console, YouTube, Gmail), LinkedIn, TikTok, Microsoft Outlook, Stripe, your website platform, IndexNow search engines or the networks behind Postiz, data flows to and from that platform under its own terms and privacy policy, and that platform is responsible for what it does with it.
Videos Cosmo renders are stored on Google Cloud Storage at public URLs, so platforms can fetch them when you approve a post. Anyone with the link can view the file.
9. International transfers
We are based in Israel, and our main providers process data in the United States and other countries. Israel is recognised by the European Commission as giving adequate protection. When personal data from the EU, UK or Switzerland goes to a country without that recognition, we rely on the EU Standard Contractual Clauses (with the UK addendum), the EU-US Data Privacy Framework where a provider is certified, or another lawful safeguard. You can ask us for a copy of the relevant safeguards.
10. How long we keep it
Data How long Account, workspace, messages, work product and AI usage records While your account exists, plus up to 30 days after you close it or ask us to delete it Connected-platform tokens Until you disconnect the platform or close your account Backups Up to 30 days, then overwritten Server logs 30 days Analytics events and pageviews 12 months Billing and tax records As long as tax law requires (Polar keeps payment records under its own policy) 11. Exporting and deleting your data
In the app you can see your plan, approvals, messages and content, disconnect any platform, and cancel your plan.
To get a full export of your data or to delete your account and data, write to roy@cosmocmo.com from your account email. We'll do it within 30 days. Deleting removes your data from live systems straight away and from backups within 30 days, except records we must keep by law. Deleting your data from Cosmo doesn't delete posts, ads or emails already published or sent on other platforms; remove those on each platform.
12. Your rights in the EU and UK
You can ask to access, correct, export or delete your personal data, to restrict or object to how we use it (including objecting to anything based on legitimate interests), and withdraw consent at any time. Write to roy@cosmocmo.com. We answer within one month. You can also complain to your local data protection authority, such as the authority in your EU country or the UK Information Commissioner's Office. If you are a lead or contact of one of our customers, we'll pass your request to them, since they control that data, and help them answer it.
13. Your rights in California
If you live in California, the CCPA (as amended by the CPRA) gives you the right to know what personal information we collect, use and disclose; to delete it; to correct it; and not to be discriminated against for using these rights.
- The categories we collect are listed in “What we collect”: identifiers, commercial information (your plan and billing), internet activity, audio (voice notes and calls), professional information and inferences about your marketing preferences. We collect them from you, from the platforms you connect and from the providers listed above, for the purposes in “Why we use it”.
- We don't sell personal information or share it for cross-context behavioral advertising, and we haven't done so in the last 12 months.
- We use sensitive personal information (such as account access tokens) only to provide the service.
To make a request, write to roy@cosmocmo.com. We'll verify your request through your account email. An authorized agent can make a request for you with your written permission.
14. Your rights in Israel and elsewhere
If you live in Israel, you have the right to see and correct your data under the Privacy Protection Law. Wherever you are, you can ask us about your data at roy@cosmocmo.com, and we'll help under the law that applies to you.
15. Security
Data is encrypted in transit (TLS) and at rest. Access tokens for connected platforms are also encrypted with AES-256 before they are stored. Approval links are signed and expire, and Cosmo only acts on messages from contacts you have verified. Cosmo's browser never enters passwords or payment details. Admin access is limited to the founder and is logged. No system is perfectly secure; if a breach affects your data, we'll tell you and the authorities without undue delay, as the law requires.
16. Children
Cosmo is a business tool for adults. It is not meant for anyone under 18, and we don't knowingly collect data from children. If you think a child has given us data, write to roy@cosmocmo.com and we'll delete it.
17. Changes
If we change this policy in a meaningful way, we'll email you before the change takes effect and update the date at the top. Our terms of service cover the rest of our agreement with you.
18. Contact
Roy Azran (Cosmo / CosmoCMO), Tel Aviv, Israel. Email: roy@cosmocmo.com.