Privacy Policy

This policy applies to the Qosmic website, the Qosmic Shopify app, and the services behind them (together, the “Services”).

If you are a merchant — a store owner or a member of their team — this describes what we hold about you and your store. We are the controller of that information.

If you are a shopper on a store that uses Qosmic, the merchant decides what is collected and why. We act on their instructions as their processor, and they are your first point of contact. See “Shoppers on our merchants’ stores”.

If we contacted you about Qosmic without you having signed up, see “Prospects and marketing”.

Questions, requests and complaints: hello@qosmic.ai.

• Account and workspace details — name, email address, store domain, your login identity, and the team members you invite.
• Billing details — subscription status and plan. Card details go directly to our payment processor and are never stored by us.
• Support and correspondence — what you send us and what we send back.
• What you ask the product to do — briefs, notes, goals and instructions about what you want changed.

Installing Qosmic grants a set of permissions through Shopify’s OAuth flow. Under them we read:

• orders and full order history, and aggregate reports;
• customer records, inventory levels and locations;
• products, variants, collections and their publication status;
• theme files, templates, sections and settings;
• customer events exposed by Shopify.

We also hold write permissions — themes, products, publications, discounts, inventory, Online Store pages, files, web pixels and the app proxy. Those exist so Qosmic can make the changes you approve, and they are set out in full in our Terms of Service. We act on your store at your direction.

We also collect what your storefront already shows the public: page content, screenshots, structured data, and the audit findings we generate from them.

Shopify classifies certain data as Protected Customer Data and reviews any app that asks for it. Our access was reviewed and approved on 14 July 2026.

Shopify treats customer name, email address, phone number and street address as optional protected fields an app must separately justify. Qosmic does not request any of them. We work from order totals, timestamps, product identifiers, pseudonymous customer identifiers and aggregate purchase behaviour.

That is about data from Shopify. A service you connect, such as Klaviyo, can hold those details. See “Your customers’ details in connected services”.

You can connect other tools you use to run your store, so Qosmic can answer with their data too. Connecting is your choice, made one service at a time on the Integrations page. Each service shows its own consent screen before it shares anything.

These are the services you can connect, and what we read from each:

• Google Analytics.Your traffic and sales reports. The details are in “Google user data” below.
• Klaviyo.Your email and SMS marketing: flows, campaigns and their results; lists, segments and sign-up forms; templates, catalog, coupons and brand settings; metrics and events; reviews and conversations with Klaviyo’s customer agent; and individual customer profiles when a question needs them. A profile can include a customer’s email address, phone number, location and consent status.
• Meta Ads.Your selected ad account’s identity, currency and time zone; campaign and ad information; and advertising performance reports, including spend, impressions, clicks and conversions when available. We use these to answer questions and prepare recommendations. Read-only access cannot make ad changes. If you separately grant ad-management access, changes require your approval as described below.

We add a service to this list, with what we read from it, before you can connect it.

How access works. When you connect a service, it gives Qosmic an access key. We keep that key encrypted on our servers. Every request the AI agent makes goes through one Qosmic gateway, which holds the key and checks the request before it is sent. The agent never sees the key.

A service you connect is yours, not one of our providers. Its own terms and privacy policy cover what it does with your data.

Qosmic reads on its own. It never changes anything in a connected service on its own.

• You approve each change. Before Qosmic changes anything — a Klaviyo flow, for example — it shows you the exact change. Nothing is sent until you approve it.
• One approval, one change. We send an approved change once. Another change needs another approval.
• Scheduled runs only read. A run you schedule can look and report back. It cannot change anything in a connected service.
• Some things we never do. Even with your approval, Qosmic does not send email or SMS to your customers, reply to them, change their consent or subscriptions, delete their records, or send their data to an outside address.
• Read-only where that is all we ask for. For Google Analytics we ask Google for read-only access, so we cannot change anything there.

This section is about connected services. Changes to your Shopify store are covered in our Terms of Service.

Sign in with Google. If you choose it, Google tells us your name, email address and a stable account identifier so we can create or match your account. We do not receive your Google password. Signing in gives us your identity and nothing else. Connecting a Google product is a separate choice.

Google products you connect. You can connect a Google account so Qosmic can read your own data. Google shows you what we ask for before you agree. You can connect:

• Google Analytics (read-only). The email address of the Google account you connect. The Analytics accounts, properties and web data streams it can see, so you can pick one. Reports for the property you pick: totals and breakdowns over the dates asked for, such as visits, users, engagement, traffic sources, pages, devices, countries and cities, events, purchases, revenue and ad cost.

We will add each new Google product here, with what we read from it, before you can connect it.

How we use it. Only to give you features you see in Qosmic: your analytics, your audits and Opportunities, and answers in chat. We do not use it in benchmarks or in anything shown to another merchant.

Who receives it. To answer you, Qosmic’s AI agent sends the parts it needs to one of our AI providers (see “AI processing”). Our hosting, database and tracing providers hold it for us. We share it with no one else, except to keep the Services secure, to comply with the law, or if Qosmic is merged or sold — and then only after we ask you first.

What we never do. We do not sell Google user data. We do not use it for advertising, including retargeting and personalised or interest-based ads. We do not pass it to data brokers or information resellers. We do not use it to develop, improve or train generalised AI or machine-learning models, and neither do our AI providers.

Who at Qosmic can read it. People at Qosmic do not read your Google data, except when:

• you ask us to look at specific data, for example in a support request;
• we need to investigate a bug, a security problem or abuse;
• the law requires it; or
• it is aggregated and used for our internal operations.

What we keep. We keep your Google access key encrypted. Report figures that appeared in a chat stay in that chat; see “Disconnecting and deleting”.

Limited Use. Qosmic’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Page speed measurement. To report how fast your storefront loads, we submit your public storefront URL to Google’s PageSpeed Insights API. Only the URL is sent — the same address anyone can visit — and no merchant or shopper personal data goes with it. This needs no Google account.

Some services you connect hold details about your customers. Klaviyo holds subscriber profiles; a support tool holds tickets and chats. Shopify does not give us your customers’ names, emails, phone numbers or addresses, but these services can.

• We read as little as we can. Qosmic works from counts and rates where it can. It reads a person’s record only when your question is about that person or cannot be answered without it.
• We do not build a copy of your customer list. The gateway passes data through without storing it. What the agent reads stays in the chat where you asked, and in the logs below.
• AI providers. Details the agent reads can go to our AI providers to answer you, under the terms in “AI processing”.
• How long we keep them. In the chat, until you delete the chat or the brand. In our agent logs and traces, for 14 days. With our AI providers, for about 30 days or less.
• Deletion. When you disconnect a service, we delete its access key at once and stop reading. Details it already sent stay only in the chats where they appeared. When you delete a chat or a brand, we delete those chats from our systems within 30 days.
• Your data, your instructions. You are the controller of your customers’ details, and we process them on your instructions. If a customer asks you to delete their data, tell us and we will remove what we hold.

• Disconnect in Qosmic. Open Integrations for the brand and press Disconnect. We delete the access key at once, stop reading, and ask the service to revoke our access.
• Or disconnect at the service. You can remove Qosmic from the service itself. For Google, use the third-party connections page of your Google Account. Our next request then fails, and we stop.
• What we delete. The copy of Analytics totals goes when you disconnect Google. Customer details from a service go as described in “Your customers’ details in connected services”.
• Ask us. Email hello@qosmic.ai to delete data from any connected service, a brand or your whole account. We tell you when it is done.
• Uninstalling the Shopify app also deletes the brand’s connections, as described in “How long we keep information”.

Where a shopper has given analytics consent, our web pixel collects page, product, search, cart and checkout events; a session identifier; the path visited; the referring domain; and UTM parameters. This is what makes before-and-after measurement possible.

Where a shopper has not consented, we collect none of it.

If you run a test, and only with the same consent our storefront events require, two things are stored:

• a first-party identifier on the visitor’s own device, so they see the same version of your store on each visit rather than flickering between them;
• a marker naming the test and which version was shown, attached to that visitor’s cart and to the resulting order.

The marker records the version only. The device identifier is never attached to a cart, an order, or anything Qosmic receives from your store — the two are deliberately kept apart. A visitor who has not consented is excluded from the test and sees your storefront unchanged.

When you use our website or app we collect technical information: IP address, browser and operating system, device characteristics, language and time zone, referring and exit pages, pages viewed, and timestamps. We use it to run the Services, diagnose faults and prevent abuse.

Cookies are small files placed on your device. Similar technologies include local storage and web beacons — also called clear GIFs, pixel tags or single-pixel GIFs — small files that record that a page was viewed. We use:

• Strictly necessary — sign-in, session integrity and security. The Services do not work without these.
• Preference — remembering choices so you are not asked twice.
• Analytics and performance — counting visits and understanding which parts of the product get used. Ours is configured to record page views and specific events we have chosen; broad automatic capture of clicks and text is switched off.
• Referral attribution — when you arrive through a partner link, Rewardful stores a first-party referral identifier for up to 60 days. We use it to connect a later subscription to that partner and calculate their commission, not to build an advertising profile.

We use no advertising or interest-based tracking cookies. We run no ad-network tags, build no advertising profiles, and share no hashed email or user identifier with advertising partners.

Most browsers let you refuse or delete cookies in their settings. Blocking strictly necessary ones will break parts of the Services. Browser controls are per-browser and per-device, so a choice made in one place does not follow you to another. Some browsers send a “Do Not Track” or Global Privacy Control signal; we do not engage in the cross-site tracking those signals exist to stop.

We contact ecommerce businesses about Qosmic who have not signed up. If that is how you heard from us, this is what we hold and why.

• What. Business contact details — name, role, company, work email address, company website and public professional profile.
• Where from. Publicly available sources, and third-party business data providers who represent to us that they collected it lawfully.
• Why. To tell you about Qosmic and, if you reply, to follow up. We hold it in a customer relationship system and send through email tools.
• Basis. Our legitimate interest in reaching businesses likely to want the product, balanced against your interests — and consent where the law where you are requires it.

Every message we send carries an unsubscribe option. You can also email hello@qosmic.ai and ask us to stop contacting you, to tell you where your details came from, or to delete them. We will do all three, and suppressing your address means keeping the minimum record needed to make sure we do not contact you again.

• Audit your storefront and produce Opportunities, analytics and benchmarks.
• Answer your questions in chat, using data from your store and the services you connect.
• Make the changes you approve, and measure whether they worked.
• Run tests and report their results.
• Provide, maintain, secure and improve the Services.
• Diagnose faults, investigate incidents and prevent abuse or fraud.
• Support you and respond to what you send us.
• Send service messages about your account, and marketing where you have not opted out.
• Meet our legal, tax and contractual obligations, and establish or defend legal claims.

Qosmic uses AI models to generate recommendations, copy, code and analysis, and to answer you in chat. To do that we send the context a task needs to OpenAI, Google (Gemini models) and Anthropic, who process it for us under their business and API terms.

That context can include product and page content, metrics, audit findings, what you write in chat, voice messages you record, and data from services you connect — including Google Analytics reports and, when a question needs them, your customers’ details. Which provider handles a task depends on the task. If one provider is down, we switch to another of the three.

Under those terms, your data is not used to train their general-purpose models. OpenAI and Anthropic delete API inputs and outputs within about 30 days by default. Google keeps Gemini prompts and responses only for a limited period, to detect abuse. We do not train models of our own on merchant data either.

Qosmic does not make decisions about an individual on a solely automated basis that produce legal or similarly significant effects. Its output is a recommendation to a merchant, and a person decides whether to accept it.

Our pixel runs through Shopify’s customer privacy API and follows the consent state your store collects. Where a visitor has not given analytics consent, we do not collect their storefront events and do not include them in tests.

Presenting your shoppers with a consent banner that satisfies the law in every market you sell into is your responsibility as the merchant and the controller of that data, not ours.

• Service providers who perform services on our behalf, bound to protect the information and use it only to provide that service. They are named individually in the next section.
• Shopify, the platform your store runs on and the source of most store data we hold.
• Services you connect — when you approve a change, we send that change to the service.
• Within your organisation — where you use Qosmic in a professional capacity, your use may be visible to the workspace owner and your team.
• Legal and regulatory — where required by law, court order, subpoena or regulator; to enforce our Terms of Service; or to protect the rights, property or safety of Qosmic, our merchants or others.
• Corporate transactions — to a buyer or successor in a merger, acquisition, financing or sale of assets. This policy keeps applying until it is replaced with notice to you.
• Anywhere you direct us to send it.

We do not sell personal information, and we do not share it for cross-context behavioural advertising as California law defines those terms. We have not done so in the preceding twelve months.

The providers below process data on our behalf, and each is bound to protect it and to use it only to provide their service to us. This is our principal set of providers as at October 29, 2026.

• Shopify — the platform your store runs on, and the source of the store data we hold.
• Supabase — our primary database and authentication. Holds account and store data.
• Vercel — hosting for our website and web app.
• Fly.io — hosting for the Shopify app.
• Cloudflare — network, delivery and protection.
• Upstash — caching and rate limiting.
• OpenAI, Google (Gemini) and Anthropic — AI models. Receive the context a task needs, including data from services you connect; see “AI processing”.
• LangChain / LangSmith — orchestration and tracing for our agents. Traces can include the context sent to a model, including data from services you connect.
• Sentry — error monitoring. Receives diagnostic data, which can include identifiers present when a fault occurs.
• PostHog — product analytics for our own site and app.
• Stripe — payment processing. Card details go to Stripe directly and are never stored by us.
• Rewardful — referral attribution and partner commission calculation. Receives referral, customer and subscription details through our website and Stripe.
• Resend — transactional email, such as team invitations.
• Google — sign-in identity if you use it; the PageSpeed Insights API, which receives only your public storefront URL; and Gemini AI models, above.
• HubSpot — our customer relationship system. Holds merchant contact details and audit status, and prospect details from outreach.
• Sanity — the content system behind our blog. Holds no merchant or shopper data.

The services you connect — Google Analytics or Klaviyo, for example — are not on this list. They are your providers, not ours. We read from them on your behalf.

That list is illustrative rather than exhaustive, and is accurate as at the date shown rather than continuously. Our infrastructure changes, and we may add, replace or remove a provider at any time without updating this page first.

What does not change is the categories of provider we use and the terms they are held to. We use, and may in future use, providers for: referral attribution and partner commission tracking; cloud hosting and infrastructure; databases and storage; caching and rate limiting; network delivery and protection; error, performance and security monitoring; product analytics; AI model providers and agent orchestration; transactional and marketing email; customer relationship management; payment processing; content management; and customer support.

Any provider we use, named here or not, is bound by contract to protect your information, to use it only to provide their service to us, and to obligations no less protective than those in this policy. If you need to know exactly who processes your data at a particular moment — for a security review, for example — email hello@qosmic.ai and we will tell you.

We produce aggregated and de-identified information — held in a form not reasonably capable of being associated with or linked to an individual, a merchant or a store. Benchmarks are the example: a conversion-rate range across a sector says nothing about who contributed to it.

We may use and publish that information to run, improve and market the Services, and we maintain it in de-identified form rather than attempting to re-identify it.

We are based in the United States and your information is stored and processed there, and in other countries where our service providers operate. We do not currently offer regional data residency.

If you are outside the United States, data protection there may differ from, and be less protective than, the law where you live. Where personal data moves out of the UK, EEA or Switzerland we rely on the transfer mechanisms available to us, including the European Commission’s Standard Contractual Clauses.

We keep personal information for as long as we reasonably need it to provide the Services and maintain our relationship with you; to meet our legal, tax and contractual obligations; and to establish, exercise or defend legal claims.

When you uninstall the app your access token is revoked immediately and we stop collecting. We then delete, anonymise or restrict access to the associated data once it is no longer needed for the purposes above. Backups, security logs and legal records may persist for a limited further period before ageing out on their normal cycle.

We implement Shopify’s mandatory privacy webhooks and act on customer data requests, customer redaction requests and shop redaction requests when Shopify sends them. A shop redaction also deletes the connections to services you connected for that store.

Data from services you connect has its own rules. See “Google user data”, “Your customers’ details in connected services” and “Disconnecting and deleting”.

We take reasonable steps to protect personal information from loss, misuse and unauthorised access, disclosure, alteration or destruction, taking into account the risks involved and the nature of the information.

Because Qosmic can write to your live store, the questions worth answering plainly are what it can reach and what happens when you stop using it:

• What we can access. Only what the Shopify permissions you granted allow, listed above and in our Terms, and what each service you connect lets us read. Nothing on any other merchant’s.
• What we do not ask Shopify for. Shopper name, email address, phone number and street address. Those are optional protected fields in Shopify and we decline them. A service you connect may hold them; see “Your customers’ details in connected services”.
• Nothing changes without your approval. Write access exists so we can act on changes you accept. Qosmic proposes; you decide. In a connected service, each change needs its own approval.
• Encryption. Data is encrypted in transit and at rest by our infrastructure providers. Access keys for services you connect are encrypted again by us, and the AI agent never sees them.
• Who can see it. Access to merchant data is limited to the people who need it to operate the Services and is not shared between merchants.
• On uninstall. Your access token is revoked immediately and we stop collecting. Retention of what we already hold is covered above.
• If something goes wrong. We investigate security incidents, and where a breach affects your data we will notify you and take the steps the law requires.

No application, internet or email transmission is ever fully secure or error-free, and we cannot guarantee the security of any personal information. You are responsible for keeping your credentials confidential and for who on your team you grant access to.

Merchants running a security review can write to us at hello@qosmic.ai.

Depending on where you live, you may have some or all of the following rights. California residents have all of them; residents of other US states with comprehensive privacy laws have most; and we extend the same process to everyone who asks.

• to know what personal information we collect and how we use it;
• to access a copy of it;
• to have inaccurate information corrected;
• to have it deleted;
• to receive it in a portable format;
• to opt out of the sale or sharing of personal information — we do neither;
• to limit the use of sensitive personal information;
• to opt out of marketing at any time;
• to withdraw consent you previously gave;
• to object to or restrict processing, including for direct marketing;
• not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects;
• to complain to your data protection or consumer protection authority.

To exercise any of these, email hello@qosmic.ai. We respond as soon as reasonably possible and within the period the applicable law allows. We may need to verify your identity first, and an authorised agent may make a request for you with proof of their authority.

We will not discriminate against you for exercising any of these rights. We will not deny you the Services, charge a different price, provide a different quality of service, or suggest that we will, because you exercised one.

Where the UK or EU GDPR applies to you, our legal bases are performing our contract with you, your consent for storefront event collection, our legitimate interests in security, debugging, improving the product and business outreach, and compliance with the law.

If you shopped on a store that uses Qosmic, that merchant is the controller of your data. They decide what is collected and why; we process it on their instructions. The same goes if your details sit in a service the merchant connected to Qosmic, such as Klaviyo.

Send access, correction or deletion requests to the merchant. They can pass the request to us through Shopify or directly and we will act on it. You can also email us and we will route it to them.

Merchants with specific data protection requirements — a data processing agreement, a security review, or questions about how we handle a particular category of data — can contact us at hello@qosmic.ai and we will work through them with you.

The Services link to and work alongside third-party services, including Shopify and the other apps you have installed. This policy does not cover them. What they do with your information is governed by their own policies, and we are not responsible for their practices.

The Services are a business tool and are not intended for anyone under 18, or under the age of majority where you live. We do not knowingly collect personal information from children. If you believe a child has given us information, email hello@qosmic.ai and we will delete it.

We may update this policy as the Services or the law change. The date at the top changes when we do, and for material changes we will give notice in the app or by email before they take effect. Continuing to use the Services afterwards means you accept the update.

Privacy questions, data requests and complaints: hello@qosmic.ai.