Qosmic — Privacy Policy

Last updated: 2026-10-29

Qosmic ("Qosmic", "we", "us") operates the Qosmic app (the "App") distributed through the Shopify App Store. This Privacy Policy explains what data we collect, how we use it, and the rights you have as a merchant or as a visitor to a merchant's storefront. The full Qosmic privacy policy, including the services you can connect to Qosmic, is at qosmic.ai/legal/privacy.

1. Who we are and how to reach us

Qosmic is operated by Qosmic Inc. For privacy questions, security disclosures, or data access requests, contact gabriel@qosmic.ai.

2. What we collect from your store

When you install the App, we collect:

• Store metadata: shop domain, store name, plan name, primary locale, currency, access scopes, and plan/capability flags.
• Your storefront's public pages: screenshots and page snapshots of the pages anyone on the internet can see, used to run your audits.
• Audit and experiment records: audit findings and scores, the experiments you approve or roll back, the runtime payload we ship to your theme, and any notes you add.
• Order records: totals, currency, financial and fulfillment status, line items (product, quantity, price), refund amounts, order source, and shipping country code only — so your dashboard can show revenue, AOV, refunds-adjusted net revenue, and experiment results.
• A minimal customer reference: the numeric customer ID Shopify assigns to each order. We do not collect customer names, street addresses, or phone numbers from Shopify. If you explicitly enable subscription-management email, Qosmic reads the recipient email on a verified Qosmic subscription order only long enough to send one transactional customer-account link through Resend. Qosmic does not store that address in its database; it keeps an order-keyed access and delivery receipt without the email value. A service you connect, such as Klaviyo, can hold additional customer details; see section 3.
• Billing state: Shopify Billing API charge id, plan, status, and period end. We never receive or store card numbers.

3. Services you connect

You can connect other tools to Qosmic, one at a time, from the Integrations page. Each shows its own consent screen first. You can connect:

• Google Analytics (read-only): the email address of the Google account you connect, the Analytics properties it can see, and reports for the property you pick — totals and breakdowns such as visits, traffic sources, pages, devices, countries, purchases and revenue.
• Klaviyo: flows, campaigns and their results; lists, segments and sign-up forms; templates, catalog, coupons and brand settings; metrics and events; reviews and customer-agent conversations; and individual customer profiles when a question needs them. A profile can include a customer's email address, phone number, location and consent status.
• Meta Ads: your selected ad account's identity, currency and time zone; campaign and ad information; and advertising performance reports, including spend, impressions, clicks and conversions when available. We use these to answer questions and prepare recommendations. Read-only access cannot make ad changes. If you separately grant ad-management access, changes require your approval as described below.

We add a service here, with what we read from it, before you can connect it.

• Access keys: encrypted on our servers. Every request the AI agent makes goes through a Qosmic gateway that holds the key. The agent never sees it.
• Changes need your approval: Qosmic never changes anything in a connected service on its own. It shows you the exact change first, sends nothing until you approve, and sends an approved change once. Scheduled runs only read. The separate subscription-management email setting is off by default and requires an explicit merchant opt-in; when enabled it sends only the transactional account-link message described above. Qosmic does not otherwise message customers, change their consent or subscriptions, or delete their records.
• Your customers' details: Qosmic reads a person's record only when your question needs it, and does not build its own copy of your customer list. What the agent reads stays in the chat where you asked, can go to our AI providers to answer you (section 6), and sits in our agent logs for 14 days. When you disconnect a service, we delete its access key at once and stop reading; details it already sent stay only in the chats where they appeared, and deleting a chat or a brand deletes those chats within 30 days. You are the controller of this data; we process it on your instructions.
• Google user data: we use it only for features you see in Qosmic. We do not sell it, use it for ads, or use it to train generalized AI models. People at Qosmic read it only with your consent, to investigate a bug, security problem or abuse, when the law requires, or in aggregate. Qosmic's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Disconnecting: press Disconnect on the Integrations page, or remove Qosmic in the service itself. We delete the access key and ask the service to revoke our access. To delete any data from a connected service, email gabriel@qosmic.ai.

4. What we collect from storefront visitors

• Experiment events: page views, experiment assignment (control or variant), clicks, add-to-carts, and purchases, keyed by a random first-party visitor ID we mint ourselves. It is not the Shopify customer ID, and we cannot connect it to one.
• Session analytics (web pixel): when this feature is enabled on your store, we count visitor sessions and funnel steps (page viewed, product viewed, cart, checkout) so your dashboard can show conversion rate. It is consent-gated — Shopify only loads our pixel when the visitor has granted analytics consent (or consent is not required in their region), and we drop events without it. Each event carries a random per-tab session ID, the page path with query strings stripped, the referrer's domain only, and marketing UTM tags. Customer identifiers in pixel events are dropped, not collected — sessions need no identity.
• We do not collect names, IP-address profiles, device fingerprints, or precise geolocation from storefront visitors. The optional transactional subscription email uses the order recipient address as described in section 2; it is not collected through storefront analytics.

5. How we use the data

• Generating audits and recommending experiments.
• Answering your questions in chat, using your store's data and the services you connect.
• Running the experiments you approve and measuring their results.
• Showing you revenue and conversion metrics about your own store.
• Debugging production incidents and keeping the App online. Error reports are scrubbed of headers, cookies, and request bodies before being sent to Sentry.
• Billing and customer support.
• Nothing else. We do not sell your data. We do not use your data to train third-party foundation models.

6. Subprocessors

• Supabase (AWS): Postgres database + file storage for shop, audit, order, and experiment data. SOC 2 Type II. All customer-derived tables are locked behind deny-all row-level security and reachable only by our backend service role.
• Fly.io: hosts the embedded app.
• LangSmith (LangChain Inc.): agent traces. Traces can include data the agent read from a service you connect, including customer details.
• Sentry: error monitoring with request data stripped.
• Resend: sends the optional merchant-approved transactional subscription management email. Resend receives the recipient email address and message contents for delivery; Qosmic sends a stable order key to prevent duplicate delivery on webhook retries.
• OpenAI, Google (Gemini) and Anthropic: AI models for audits and chat. They receive your storefront's public pages, store metrics, what you write in chat, and — when a question needs it — order details from Shopify and data from services you connect, including customer details. Order analytics sent to AI providers exclude customer names, emails, phone numbers and addresses; the optional subscription recipient email goes only to Resend, not to an AI provider. Under the providers' business terms, your data is not used to train their models.

7. Data deletion (Shopify redaction webhooks)

Qosmic implements Shopify's three mandatory compliance webhooks, and they do real deletions:

• shop/redact — 48 hours after you uninstall, Shopify tells us to erase your store. We delete everything tied to your shop in one transaction: order records, line items, customer references, refunds, audits, experiments, analytics events, OAuth tokens, connections to services you connected and their access keys, and the stored audit files (screenshots, page snapshots, reports). We record a deletion receipt with per-table counts so we can prove the request was honored.
• customers/redact — when a customer asks you to delete their data, Shopify notifies us and we erase that customer's record and unlink their orders and subscription-email receipts within 30 days. Provider delivery IDs are removed from those receipts. Order totals and the anonymized fact that an approved access or delivery occurred are retained as financial and compliance records — without the customer identity — as permitted by GDPR Article 17(3)(b).
• customers/data_request — when a customer asks for their data, we compile everything we hold (customer ID, order aggregates, and any order-keyed subscription-email access or delivery receipts; the email address itself is not stored by Qosmic) and respond within 30 days via gabriel@qosmic.ai.
• We keep a minimal log of the compliance requests themselves, because we are required to demonstrate that we honored them.

8. Data retention

• While installed: we keep your data so you can see history.
• After uninstall: the shop/redact deletion above runs automatically. Database backups roll off within 30 days.
• Connected services: see section 3. When Google Analytics is disconnected, we delete the access key and any copy of its reports we keep.

9. Your rights

If you're in the EEA, UK, Switzerland, or California, you have the right to access, correct, or delete the data we hold about you. Email gabriel@qosmic.ai. We respond within 30 days.

10. International transfers

We host data in US-East (iad). If you need EU-only hosting, email gabriel@qosmic.ai to discuss options.

11. Security

• All traffic uses TLS 1.2+; data is encrypted at rest (AES-256, including backups).
• Shopify OAuth tokens live in a Postgres table protected by row-level security and reachable only by our backend service role.
• Access keys for services you connect are encrypted by us before they are stored, and the AI agent never sees them.
• We follow least-privilege access for our infrastructure, and dependency audits run before production deploys.

12. Changes

We will announce material changes to this policy at least 30 days in advance by email to the merchant's account owner.