Privacy Policy

Words with a capitalized initial letter have meanings defined below. These definitions apply whether the term appears in singular or plural form.

Personal Data — While using our Service, we may collect the following personally identifiable information:

• Merchant email address and shop name
• Shop domain and Shopify store ID
• Customer order data (order ID, status, tracking information)
• Customer account data — wishlists, store credit balances, and account preferences
• App configuration and onboarding settings set by the merchant

Usage Data — Collected automatically when you use the Service, and may include:

• Device IP address, browser type and version
• Pages and features accessed within the app, and time spent
• Unique device identifiers and diagnostic data
• App analytics events (feature interactions, dashboard views)
• Automated activity logs related to your use of the app

We use cookies and similar tracking technologies to operate the Service and gather usage insights. Technologies used include beacons, tags, and scripts.

You can instruct your browser to refuse all cookies or to alert you when cookies are being sent. However, some parts of the Service may not function correctly if cookies are disabled.

Cosmoverse Apps may use collected Personal Data for the following purposes:

• To provide and operate the Service — including order tracking, wishlist, store credit, and the customer account portal.
• To manage your account — enabling access to all app features available to registered merchants.
• To fulfill contractual obligations — processing your subscription plan and app billing through Shopify's Billing API.
• To contact you — sending transactional emails, security alerts, billing notices, and support responses.
• To send app updates — informing you of new features, improvements, or changes to the Service.
• To manage your support requests — responding to tickets and queries submitted via email or live chat.
• For analytics and improvement — understanding usage patterns to improve app performance, features, and merchant experience.
• For business continuity — in the event of a merger, acquisition, or asset sale, your data may be transferred with appropriate notice.

We may share your information in the following situations:

• With Service Providers — MongoDB Atlas (database), Fly.io (hosting), and Tawk.to (live chat support) — limited to what is necessary for the Service.
• With Shopify — as required to operate within the Shopify platform and comply with its Partner Program Agreement.
• For business transfers — in connection with any merger, acquisition, or sale of assets, with prior notice to you.
• With your consent — for any other purpose, only with your explicit approval.

We retain your Personal Data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy — or as required by law to resolve disputes and enforce agreements.

• Shop and merchant data is retained while the app remains installed on your store.
• Upon uninstallation, shop data is scheduled for permanent deletion within 48 hours.
• Customer data associated with your store is permanently erased from our database upon a valid redaction request.
• Usage and analytics data is retained in anonymized form for a shorter period unless required for security or legal compliance.

Your data — including Personal Data — is processed and stored on our infrastructure hosted in the Singapore region (Fly.io) and MongoDB Atlas cloud servers. This means your data may be maintained on servers outside your state, province, or country, where data protection laws may differ.

Your installation of the app and acceptance of this Privacy Policy represents your consent to this transfer. We take all reasonable steps to ensure your data is treated securely. No transfer of Personal Data will take place to any organization or country unless adequate security controls are in place.

Business Transactions — If Cosmo Infotech is involved in a merger, acquisition, or asset sale, your Personal Data may be transferred. We will provide notice before your data becomes subject to a different privacy policy.

Law Enforcement — Under certain circumstances, we may be required to disclose your Personal Data in response to valid requests by public authorities (e.g., a court or government agency).

Other Legal Requirements — We may disclose your Personal Data in good faith when necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of Cosmo Infotech
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users of the Service or the public
• Guard against legal liability

The security of your Personal Data is important to us. We implement industry-standard measures including:

• Encryption of all data in transit via HTTPS / TLS
• Encryption of data at rest on MongoDB Atlas
• Restricted access controls — only authorized systems can access merchant data
• Regular security monitoring and review of our infrastructure

Depending on your location, you or your customers may have the following rights under applicable privacy laws (GDPR, CPRA, and others):

To exercise any of these rights, please contact us at support@cosmoinfotech.com. We aim to respond to all requests within 30 days.

As required by Shopify, our app subscribes to and responds to mandatory compliance webhooks. These ensure merchant and customer data rights are honored at the platform level:

Our Service is designed exclusively for Shopify merchants (businesses) and does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from children under 13.

If you are a parent or guardian and believe your child has provided us with Personal Data, please contact us immediately at support@cosmoinfotech.com. If we become aware of such collection without verifiable parental consent, we will take prompt steps to remove that information from our servers.

Our Service may contain links to third-party websites or services not operated by us. If you click a third-party link, you will be directed to that site. We strongly advise reviewing the Privacy Policy of every external site you visit.

We have no control over, and assume no responsibility for, the content or privacy practices of any third-party sites or services.

We may update this Privacy Policy from time to time. When we do, we will notify you by posting the revised policy on this page and updating the "Last updated" date at the top.

For significant changes, we will provide notice via email to your registered merchant email address or through a prominent in-app notification, prior to the change becoming effective.

You are advised to review this Privacy Policy periodically. Continued use of the Service after any changes constitutes your acceptance of the updated policy.