Privacy Policy

Cosmora processes a small amount of data to operate the service: your account details, the leads and contacts in our curated database, the email activity your campaigns generate, and the encrypted SMTP credentials you connect.

We do not sell personal data. We do not use your SMTP credentials for anything other than sending the campaigns you queue. And we do not read or process the content of your lead database beyond the queries your own ICPs generate.

We collect the following categories of data:

• Account data — your name, email address, password hash and, if you provide one, your organization name.
• Lead database data — company and contact records held in our curated database, including business contact details. This is data we curate rather than data you provide.
• ICP and campaign data — the profiles you describe, the leads you unlock and save, and the email content you create.
• Campaign activity data — send timestamps, delivery status, bounces, opens, clicks, replies and unsubscriptions, linked to the message and the contact it was sent to.
• SMTP credentials — the server, port, username and password of the sending accounts you connect, stored encrypted at rest.
• Technical data — session identifiers and security logs needed to keep accounts secure and to maintain an audit trail of administrative actions.

We process this data on the following bases:

• To provide the service — matching your ICPs against the lead database, unlocking leads you select, composing your emails, and sending campaigns through your connected SMTP account.
• To operate and secure the platform — authenticating you, enforcing role-based access, and preventing abuse.
• To meet legal obligations — including suppression and unsubscribe handling, which we are required to honour.
• To contact you about your account or the service. We do not send marketing email without your consent.

We share data only with the service providers that run the platform: database and object storage hosting, the AI provider that converts your ICP descriptions into filters and drafts emails, and authentication infrastructure. Each of these processes data on our instructions and is bound by contract.

We may also disclose data where required by law, to respond to valid legal process, or to protect the rights and safety of ourselves, our users or the public.

Email delivery passes through your own SMTP provider and the recipient’s mail server. We do not sell, rent or trade personal data, and we do not share it for others’ marketing.

Outbound email includes an open pixel and a click redirect keyed to a tracking token, which record when a message is opened or a link is clicked. That information is visible to the recipient’s mail client and some clients block images, so open counts are an estimate rather than a certainty.

Every message includes an unsubscribe link. Unsubscribing suppresses the address permanently, and we re-check the suppression list at send time.

SMTP passwords are encrypted at rest and are never exposed in the interface. Access to lead contact details is enforced server-side and re-checked on every read, not only when a page loads. Administrative actions are recorded in an audit log.

We retain account and campaign data while your account is active. When an account is deleted we remove or anonymise personal data, except where retention is required by law or needed to honour a suppression.

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to have it erased, to restrict or object to how we process it, and to data portability.

You can export or update much of your own data directly from your workspace settings. For anything else, contact us and we will action the request within the period the applicable law requires.

We use a session cookie to keep you signed in and to protect administrative routes. We do not run advertising or cross-site tracking cookies.

If we make a material change to this policy, we will update the date at the top of this page and notify you in-product or by email before the change takes effect.

Privacy questions and data requests can be sent to privacy@cosmora.dev.