Privacy Policy

CosmicBuilt is operated by Cosmic LLC, a limited liability company formed in Wisconsin, United States. We are the data controller for the information described here.

This policy covers two different groups of people, and it matters which one you are:

• Customers — people with a CosmicBuilt account, who build sites.
• Visitors to a customer’s site — people who fill in a contact form on a site built here. If that is you, the business whose site you contacted decides what happens with your enquiry; we store and deliver it on their behalf. Section 5 is the part about you, and the business itself is the right first place to ask.

• Your account — email address, your name if you give it, and when you agreed to the terms and which version. Your password is handled by Supabase Auth and we never see it.
• Your business description and site content — everything you type to build and edit the site, the generated pages, and any images or video you upload.
• Your organisation — its name, the people you invite, and their roles.
• Billing records — which plan you are on, when it renews or lapsed, and the identifiers Stripe gives us. We never see or store your card number.
• Usage — how many edits you have used, your domain and publishing status, and the record of publishes.
• Operational logs — errors and job records that let us work out what went wrong.

We keep this list specific rather than saying “trusted partners”. Each of these providers handles some of your data because the product cannot work otherwise:

We do not sell your data, and we do not share it for advertising. We will disclose it if the law actually requires us to, and if we are permitted to tell you about it, we will.

These providers operate in the United States and, for some of them, elsewhere. Using CosmicBuilt means your information is processed in the United States.

There are no advertising cookies and no third-party analytics on this application. No Google Analytics, no advertising pixels, no session recording.

The cookies we set are the ones that keep you signed in — Supabase Auth session cookies, which are strictly necessary for the app to function. Clearing them signs you out.

Sites we generate for you contain no trackers either, unless you add them. If you host your own site elsewhere, whatever that host does is between you and them.

When someone submits an enquiry on a site built here, we store the following and show it to the business in their dashboard:

• What they typed: name, phone number, email address, message, and service requested.
• Which page they submitted from, the referring page, and any campaign tags in the link (UTM parameters).
• Their browser’s user-agent string.
• A hashed version of their IP address. Not the address itself. It is combined with a secret value and hashed, then truncated, so it can be compared against other submissions but cannot be turned back into an IP address or a location. It exists to enforce rate limits and to spot the same source submitting repeatedly.
• Spam signals and a score. Each submission is assessed for signs of automation — a filled hidden field, a form submitted implausibly fast, link-stuffed text, a mismatched origin, and similar. The reasons and a score from 0 to 100 are stored alongside the enquiry. Suspicious enquiries are flagged, not discarded, so a real customer is never silently dropped by a filter; the business decides.

This happens whether the site is hosted by us or downloaded and hosted by the business itself, because the form posts back to us either way. If you are a visitor and want your enquiry removed, ask the business, or write to us at support@cosmicbuilt.com and we will pass it on and act on it.

Plainly, including where the answer is not tidy:

• Enquiries are kept for as long as your account exists. There is currently no automatic deletion schedule for them — they are business records and businesses need their history. If you want them removed sooner, ask us. Deleting a site or an organisation deletes the enquiries attached to it.
• Your account and site content are kept until you ask us to delete them. Cancelling a subscription does not delete anything — the site comes offline and the content stays, so subscribing again restores it.
• Download archives are generated on request and deleted within about a day. Request another whenever you need one.
• Uploaded files no longer used by any version of your site are removed after about thirty days.
• Abuse logs — the hashed values behind rate limiting on the contact form and on password resets — are short-lived records kept only to make the limits work.
• Billing records are kept as long as tax and accounting rules require, even after an account is closed.

Export is built in and free. You can download your complete site — every page, every asset, ready to host anywhere — at any time, on any plan, including after cancelling. Your enquiries are visible in your dashboard.

Deletion is handled by a person, not by a button. There is no self-serve “delete my account” control yet, and we would rather say so than imply there is. Write to support@cosmicbuilt.com from the address on your account and we will delete your account, your sites and your enquiries, take any published site offline, and confirm when it is done. We aim to do this within thirty days. Billing records we are legally required to retain are the exception, and we will tell you what they are.

You can also ask us for a copy of what we hold about you, ask us to correct something inaccurate, or object to how we are handling it. Depending on where you live you may have these as formal rights; we will honour the requests regardless of whether you do.

Access to customer data is enforced in the database itself through row-level security, so one organisation cannot read another’s data even if application code has a bug. Third-party credentials you give us — such as a domain or hosting token — are encrypted before being stored. Contact-form IP addresses are hashed rather than stored, as described above.

No system is perfectly secure, and we are not going to claim otherwise. If a breach affects your data we will tell you what happened, what was affected, and what we are doing about it, without waiting until we have a comfortable version of the story.

CosmicBuilt is for businesses and is not intended for children. We do not knowingly collect information from anyone under 13. If you believe a child has given us information, write to us and we will delete it.

We will update this policy as the product changes — in particular, the retention and deletion sections above describe how things work today, and we intend to improve both. Each revision has a version, shown at the top of this page. For material changes we will tell you before they take effect.

The Terms of Service share the same version number, because you agree to both together.

Anything at all about your data: support@cosmicbuilt.com. Cosmic LLC, Wisconsin, United States.