Privacy Policy

Privacy Policy

Introduction

This Privacy Policy describes how Cosmisk, a sole proprietorship of Sanskar Saxena, and its affiliates (collectively "Cosmisk", "we", "our", "us") collect, use, share, protect or otherwise process your information and personal data through our website https://cosmisk.com (hereinafter referred to as the "Platform"). Please note that you may be able to browse certain sections of the Platform without registering with us.

Cosmisk is operated from India. Our Chrome extension can be used in any country; paid plans are currently billed in Indian rupees. Your personal data will primarily be stored and processed in India. By visiting this Platform, providing your information or availing any product or service offered on the Platform, you expressly agree to be bound by the terms and conditions of this Privacy Policy, the Terms & Conditions and the applicable service terms, and agree to be governed by the laws of India including but not limited to the laws applicable to data protection and privacy, in particular the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and rules made thereunder. If you do not agree, please do not use or access our Platform.

Collection

We collect your personal data when you use our Platform, our services, or otherwise interact with us during the course of our relationship. Some of the information we may collect includes, but is not limited to:

• Account information provided during sign-up or registration, such as your name, business name, email address, telephone or mobile number, and authentication credentials.
• Billing information. Subscription payments are processed by a third-party payment gateway. We receive confirmation of payment and a masked reference only. We do not collect, store or have access to your full card number, CVV, UPI PIN, net-banking password or any other payment credential.
• Advertising platform data. Where you connect an advertising account, we access campaign, ad set, ad-level and performance data through that platform's official API, with your explicit authorisation via its OAuth flow.
• Usage data about how you interact with the Platform, including pages visited, features used, session duration, and browser or device information.
• Communications. If you contact us by email or through our contact form, we retain that correspondence in order to respond and to improve our support.

You always have the option not to provide information, by choosing not to use a particular service or feature on the Platform. You understand that your access to certain services may be affected if the necessary permission is not provided to us.

Usage

We use personal data to provide the services you request. Specifically, we use your data:

• To operate and deliver the Cosmisk platform, including analytics dashboards and AI-generated insights.
• To generate analysis and recommendations based on your advertising data.
• To authenticate your identity and maintain the security of your account.
• To process subscription payments, issue invoices and manage renewals.
• To send transactional communications such as account confirmations, billing notices and service updates. We do not send marketing communications without your consent, and where we do market to you we will provide the ability to opt out.
• To diagnose technical issues and improve Platform performance and reliability.
• To detect, prevent and protect against error, fraud and other criminal activity, and to enforce our Terms & Conditions.
• To comply with legal obligations applicable under Indian law.

Sharing

We do not sell your personal data. We share personal data only as set out below.

We may disclose personal data to third-party service providers who process data strictly on our instruction and only to the extent necessary to operate the Platform. These currently include our cloud hosting and database provider, our AI model provider, and our payment gateway. Each receives only the data necessary for its specific function.

We may disclose personal and sensitive personal data to government agencies or other authorised law enforcement agencies if required to do so by law, or in the good faith belief that such disclosure is reasonably necessary to respond to subpoenas, court orders or other legal process; to enforce our Terms & Conditions or this Privacy Policy; to respond to claims that content violates the rights of a third party; or to protect the rights, property or personal safety of our users or the general public.

Security Precautions

To protect your personal data from unauthorised access or disclosure, loss or misuse, we adopt reasonable security practices and procedures, including:

• All data is transmitted over HTTPS using TLS encryption.
• Access tokens obtained from connected advertising platforms are stored encrypted and are never exposed in client-side code or in logs.
• Server infrastructure uses environment-level secrets management and is not publicly accessible beyond the API layer.
• Internal access to user data is limited to what is required to operate the service.

However, transmission of information over the internet is not completely secure for reasons beyond our control. By using the Platform, users accept the security implications of data transmission over the internet, which cannot always be guaranteed as completely secure, and therefore certain inherent risks remain. Users are responsible for protecting the login and password records for their account. If you believe your account has been compromised, contact us immediately at support@cosmisk.com.

Data Deletion and Retention

You have the option to delete your account by visiting your profile and settings on the Platform. This action will result in you losing all information related to your account. You may also write to us at the contact information provided below and we will assist you with the request.

In the event of any pending grievance, claim or dispute, we may refuse or delay deletion of the account until the matter is resolved. Once the account is deleted, you will lose access to it.

We retain your personal data for no longer than is required for the purpose for which it was collected, or as required under applicable law. Backup copies may persist for up to 30 days following deletion to protect against accidental data loss. We may retain data if we believe it is necessary to prevent fraud or future abuse, or for other legitimate purposes, and we may continue to retain data in anonymised form for analytical and research purposes.

Your Rights

You may access, rectify and update your personal data directly through the functionality provided on the Platform. Under the Digital Personal Data Protection Act, 2023, and under other applicable data protection laws where they apply to you, you have the right to:

To exercise any of these rights, write to us at support@cosmisk.com. We will respond within 30 days. We may ask you to verify your identity before acting on a request.

Consent

By visiting our Platform or by providing your information, you consent to the collection, use, storage, disclosure and processing of your information in accordance with this Privacy Policy. If you disclose to us any personal data relating to other people, you represent that you have the authority to do so and permit us to use that information in accordance with this Privacy Policy.

You have the option to withdraw consent already provided by writing to the Grievance Officer at the contact information provided below, mentioning "Withdrawal of consent for processing personal data" in the subject line of your communication. We may verify such requests before acting on them. Withdrawal of consent will not be retrospective and will be in accordance with the Terms & Conditions, this Privacy Policy and applicable laws. In the event you withdraw consent, we reserve the right to restrict or deny the provision of services for which we consider such information to be necessary.

Affiliate Programme

Creators can apply to share Cosmisk with their audience and earn a commission on sales made through their link.

If you visit through an affiliate link. When you open a Cosmisk page through a link containing ?ref= and the code belongs to an approved affiliate, we set one first-party cookie called cosmisk_ref. It holds only that affiliate's code, nothing about you, and lasts 60 days. We use it for one purpose: if you buy during those 60 days, the affiliate who sent you is credited with the sale. We also count clicks on each affiliate's link per day, as a plain number; we do not store your IP address or any identifier for you. If you then buy, the affiliate sees that a sale was made and the amount earned, never your name, email or phone number. You can remove the cookie at any time by clearing cookies for cosmisk.com in your browser settings; clearing it has no other effect on the Platform.

If you apply to be an affiliate. We collect your name, email address, phone number, a link to your channel or page, a description of your audience and how you would share Cosmisk. We use these only to review your application, to contact you about it and, if you are approved, to run your affiliate account.

If you are approved. We ask you by email, not on the website, for your payout details (UPI id or bank account) and, where tax has to be deducted, your PAN. We collect these from approved affiliates only, and use them only to pay your commissions and to meet tax obligations under Indian law.

How long we keep it. Applications that are not approved are deleted within 12 months. For approved affiliates, we keep account, commission and payout records for as long as you take part, and afterwards only for as long as Indian tax and accounting law requires. The rights described above apply to this data too; to use them, or with any question about it, write to support@cosmisk.com.

Cosmisk browser extension (Chrome)

The Cosmisk extension is published on the Chrome Web Store by Smashed Agency on Cosmisk’s behalf. It runs on the Meta Ad Library (facebook.com/ads/library), and on another website only when you click its toolbar icon there and choose Store X-ray (below). It does not access your Facebook account, messages, feed, friends or cookies.

Three features that read other pages, only when you click them.

• Check countries opens up to 10 Ad Library pages in background tabs, one at a time about 15 seconds apart, reads the number of active ads Meta lists for that country and closes each tab. The tabs open with your own Facebook session, as if you had opened the search yourself.
• Store Pulse asks the store you choose for its public product list (products.json and meta.json on that store’s own website), directly from your browser and without cookies. The store sees an ordinary request from your IP address, and that the request came from the Ads Library page. Nothing from it is sent to Cosmisk.
• Store X-ray runs when you click the Cosmisk icon in Chrome’s toolbar on a store’s website and then “X-ray this store”. Chrome then lets the extension read that one tab until you leave the site. It reads the page’s script addresses, its shop theme name and any review counts shown, and asks the same store for its public best-selling page and product list, and the own pages of up to 10 best sellers (about 1.5 seconds apart) for their review counts, from your browser and without cookies. The result is shown in a page of the extension and kept only until you close the browser, apart from those review counts for up to 15 stores, kept on your computer so a later X-ray can show the change. Nothing from it is sent to Cosmisk.

Stored only in your browser. Your watchlist, boards, saved ads, report snapshots (including country counts and the targeting of ads whose details you opened), your country list, Store Pulse history (product IDs and summary numbers for up to 15 stores), the current price list, panel position, trial start date, your reach and ad labelling choices, the labels of ads you had labelled (so an ad is sent only once), a random install ID and your licence token. The trial start date is also stored in Chrome sync if you have it turned on. Removing the extension deletes this data from the browser.

Sent to Cosmisk (cosmisk.com), over HTTPS:

• When you install, and every few days after: the extension’s random install ID and the date your trial started on this browser, to start your trial on our server and to credit referrals (the date only ever makes our record of your trial end earlier, never later). We keep a fingerprint (hash) of that ID, a fingerprint of your network (the first part of your IP address, never the full address) to stop one network starting endless trials, and your trial end date.
• Invites (Ad Strength card): when you make a card, the extension asks for your own invite link (sent: your install token). If someone opens your invite link, cosmisk.com keeps the invite code in a cookie on their browser for 30 days. Right after they install, the extension opens a cosmisk.com welcome page in a normal tab with their random install ID in the page address (after the #, so it is not sent with the page request); that page sends the install ID with the invite cookie to our server so their install can be linked to yours, deletes the cookie, and removes the ID from the address. The extension itself never sends your cookies. Once, after their first finished scan, their extension tells our server (sent: their install token); once they have also had at least one ad labelled in their trial’s creative breakdown, we add 7 trial days to yours, up to 4 friends. At most 3 installs per network a week can be linked to an invite. We never show either of you the other’s name or email. The card image itself is made on your computer and is never uploaded.
• Weekly update (only if you turn it on in the Watchlist and confirm by email): your email address, the watched brands’ names and Facebook Page IDs, and, each time you finish a scan of a watched brand, its summary counts (ads loaded, new and stopped ads since your last scan, proven winners, the longest-running ad, the scan date). No ad text and no ad IDs. We send these emails through our email provider (Resend). Deleted at once when you unsubscribe (one click in any email, or the switch in the Watchlist), after 7 days if you never confirm, and 90 days after you last confirmed, opened a link in one of the emails or scanned a watched brand. If you get the weekly update during your free trial, we also send one email about 2 days before the trial ends. If you haven’t scanned a watched brand for 14 days, the weekly email pauses and we send at most one email every 30 days showing where your brands stood at your last check.
• “About you” (optional, asked once in the extension’s popup, after you activate a plan or finish your first scan in the trial; you can skip it): what you are (D2C brand owner, agency, freelancer, marketer at a brand or other) and, only if you type them, your brand or agency name, your website and, on a paid plan, your GSTIN for invoices, with your licence token (or, during the trial, your install token) and install ID. We use it to tailor Cosmisk and to put your GSTIN on your invoices. We never sell it. We keep only those answers and the time you sent them: on a paid plan until 90 days after your licence ends, and in the trial with your trial install record (12 months after the install). GST invoices are kept by our billing provider as the law requires. Your answers are also kept on your computer, so if you answered during the trial and then choose a paid plan, the popup can ask once for your GSTIN. If you then add that brand to your watchlist, its name is kept on your computer like any other watched brand.
• When you choose a plan and pay: if you type your email on the extension’s plan page, we give it to Razorpay with your order (in its notes and payment notification), so the check described under “When you activate a plan” can match it.
• When you cancel a monthly or yearly plan in the extension’s popup: your licence token and install ID. We ask Razorpay to cancel at the end of the period you have paid for.
• Anonymous usage counts, only if you answer Yes when the welcome page asks after you install (nothing is counted before you answer; change it any time in the extension’s popup): once a day, how many times that day you opened a Brand Report, made an Ad Strength card, ran Store X-ray, exported, or hit an error, with the extension’s version and a random ID that changes every month. Never your install ID, email, pages, brands, ads or anything you typed. Kept for 400 days.
• If you remove the extension, Chrome opens cosmisk.com/uninstall with only the version number in the address. If you choose a reason or write a note there and press Send, we keep that answer, without your email or any ID, for 12 months.
• When you activate a plan: the email address you paid with, your Razorpay payment or subscription ID, and the install ID. We use them to find your purchase, issue a licence and limit how many devices one licence can be used on. If we can’t find your payment yet (for example, Razorpay’s notice to us was delayed), cosmisk.com asks Razorpay to check that payment or subscription ID and that it belongs to your email, and creates your licence only if both match. If you type your email on the cosmisk.com pricing page before paying, we pass it to Razorpay with your order, so this check can match it. To stop guessing, we count these checks per device and per network for 2 days, as one-way hashes (never your IP address).
• When you click Pay in the extension’s plan chooser: the plan you chose. Your browser sends your cosmisk.com cookies with this request, including the cosmisk_ref affiliate cookie if you have one, so the affiliate who sent you is credited, and your Cosmisk sign-in cookie if you are signed in to cosmisk.com. We use them only to create your Razorpay payment page and to credit the affiliate. No email or card details are sent; you enter those on Razorpay’s page.
• To show current prices: a request for the price list, about every 6 hours while you use the extension. It contains nothing about you.
• To check whether ad labelling is switched on: a request for that setting, at most about every 6 hours while it is off and about once an hour while it is on. It contains nothing about you.
• To check whether spend estimates are switched on: a request for that setting (and, if on, the estimate model’s numbers), about every 6 hours while off and every hour while on. It contains nothing about you. Estimates stay off until a study shows they meet our accuracy bar, and any estimate is then worked out on your computer.
• About once a day while you have a licence: the licence token and install ID, to confirm the plan is still active.
• Only if you allow reported reach in the extension: when you open a Brand Report, the advertiser’s Page ID and the Ad Library IDs of the ads loaded on the page, with your licence token and install ID. Our server asks Meta’s Ad Library API for the reach Meta publishes for those ads and returns it to you. You can turn this off at any time in the extension’s popup.
• Only if you turn on ad labelling in the extension: when you open a Brand Report, the Ad Library ID and the ad text of each ad loaded on the page (up to 150 per report), with your licence token (or, during the free trial, your install token) and install ID. We send the ad text to OpenRouter (the Jev model) to label it, for example its hook and offer, and return the labels to you. Paid plans, and two reports during the free trial; the extension asks before the first request.

Our hosting provider receives your IP address with each request, as every web server does, and keeps it in short-lived request logs for security. We do not store it in our database.

How long we keep it. Licence records (email, payment reference, plan and dates) are kept while your licence is active and for 6 years afterwards, for tax and accounting. Install IDs are deleted 90 days after a licence ends. Trial install records (the fingerprints and trial end date) are deleted 12 months after the install. “About you” answers are deleted with the trial install record, or, on a paid plan, 90 days after the licence ends. Reach figures are stored by ad, not by user, and are discarded after 7 days; we do not keep a per-user log of reach lookups. For ad labelling we store only a hash of the ad text and its labels, by ad, not by user, for 180 days; we do not store the ad text itself. We keep a monthly count of labelling calls per licence, to apply the monthly limit.

We do not sell extension data, we do not use it for advertising or marketing, and we do not use it to decide creditworthiness. We share it only with the services needed to run Cosmisk: Razorpay and Smashed Agency for payments, our hosting and database providers, Meta’s Ad Library API (Page IDs and Ad Library IDs only), OpenRouter (ad text only, for ad labelling), and Resend (your email address and the weekly update’s contents, only if you turn the weekly update on).

The use of information received from the Cosmisk extension will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Ask ChatGPT / Ask Claude. If you click these buttons in a Brand Report, your browser opens chatgpt.com or claude.ai with the report summary filled in. That text goes to that service under its own terms. It does not pass through Cosmisk.

Find the product. If you click this button on an ad, your browser opens Google Lens with the address of that ad’s image, so Google can look for similar products. The image address goes to Google under its own terms. It does not pass through Cosmisk.

To delete your licence record, write to support@cosmisk.com.

Cookies and Local Storage

Cosmisk uses browser local storage and session cookies for authentication and user preferences, such as keeping you logged in, and the cosmisk_ref cookie described under Affiliate Programme above. We do not use third-party advertising cookies or tracking pixels. You may clear local storage or cookies through your browser settings at any time, though this may log you out of the Platform.

Changes to this Privacy Policy

Please check this Privacy Policy periodically for changes. We may update it to reflect changes to our information practices, and when we do we will revise the "Last updated" date at the top of this document. If the changes are material, we will notify you by email or through a notice on the Platform in the manner required under applicable law.