CosmoMango documents

Privacy Policy

Effective from 22 October 2026

This is an English translation. The Polish version (Polityka prywatności) prevails.

1.Controller and contact

The controller of your personal data is Piotr Wąsowicz, running a business under the name vascoo Piotr Wąsowicz, ul. Zagnańska 84A/207, 25-528 Kielce, Poland, tax ID (NIP) 9591876791, REGON 384911630 ("we" or "CosmoMango").

For anything about personal data, write to contact@cosmomango.com or by post to the address above. We have not appointed a data protection officer.

This policy covers the CosmoMango service: the web app at cosmomango.com and cosmomango.pl, also when installed on a phone or computer as an app (PWA). The rules for using the service are in the Terms of Service.

2.What data we process and where it comes from

1. Use without an account. The website address you enter, the brand strategy conversation, the brand scan results, the sample week and free materials. We link them to your browser with a random identifier stored in a cookie. We do not ask for your name or email then.
2. Account. Email address, sign-in data (one-time codes and sessions), the dates the account was created and last used.
3. Your brands and content. Brand name and details, colours, fonts, industry, the Brand Brain, texts, descriptions, photos, recordings, files, the schedule and the materials you make or order.
4. Orders and payments. Order type and number, amount, payment status, invoice details (company name, tax ID, address) and, for a reel with an actor, the product, script, notes and chosen day. We do not receive payment card data; Stripe handles it.
5. Parcels. Sender details on the parcel when you send us a product to film, and address details when you ask us to return it.
6. Correspondence. The content of emails and the data you include in them, for example in a complaint.
7. Technical data. IP address, browser and device type, request times. We use the IP address to protect the service against abuse (request limits); in our database we store it only as a one-way hash.
8. Site statistics. Which pages and steps you visit (for example entering a website address, opening the cart, editing a material), how long they took, which errors and messages were shown, the device type, the country derived from the IP address and where you came from (for example our ad or another website). A visit is recognised by a random number that is gone when the page is closed, and a person within one day by a hash of the IP address and the browser that changes every day; we do not store the IP address itself for statistics. When you are signed in, we link the statistics to your account. Nothing is stored on your device for this. Of what you type, we keep only the name of the website you enter for the brand scan. We do not collect statistics in the CosmoMango apps for iPhone and Android.
9. Chat. When you write to your brand agent (the “Your agent” tab on the right), your messages, the photos you add and the agent’s answers pass through Anthropic (the Claude model), which prepares the answer. Without an account the agent knows what the scan of the website you gave found. With an account the chat knows the Brand brain of the brand open in the app, and adds a fact about the brand to it only when you click “Add to the brand brain”. Do not share other people’s personal data in the chat.
10. Voice. When you click the microphone ("Mów", Speak) in a text field, your voice (up to one minute) goes to ElevenLabs (Scribe), which turns it into text while you speak; if that fails, Google (Gemini API) turns the recording into text. We do not store the recording.
11. Visit recordings (only with your consent). Microsoft Clarity records how a visit goes: mouse movements and clicks, taps, scrolling and how the pages look, so that we can see where the site causes trouble. What you type into fields is hidden in the recording.
12. Ad measurement (only with your consent). Identifiers from Meta cookies (_fbp, _fbc), the address of the page you visit and the steps you take on it: entering a website address, opening the cart and buying a package, with its value. With a purchase also the IP address, the browser type, and the email address and country from the payment details, the last two as a hash (SHA-256). Meta uses them to match the purchase with the ad you saw.
13. Website data. The brand scan reads only publicly available content of the website you enter, respecting its robots.txt file. If the website does not allow automatic reading, we may use a Google Search summary prepared by the Gemini model. If the website shows personal data (for example the owner's name or contact details), it may end up in the brand profile.

Data of people shown in your content

If photos, recordings, texts or files you upload contain data of other people (for example your customers, employees or models), you are the controller of that data. We process it on your behalf as a processor, under the data processing terms in § 16 of the Terms of Service. You are responsible for having a legal basis to use it, including consent to publish a person's image where required.

3.Purposes and legal bases

1. Providing the service: use without an account, running your account, making materials, fulfilling orders and contacting you about them. Legal basis: contract (Art. 6(1)(b) GDPR). If you act for a company, for example as its employee, we process your contact details based on our legitimate interest in contacting our customer (Art. 6(1)(f) GDPR).
2. Invoices, accounting and taxes: legal obligation under tax and accounting law (Art. 6(1)(c) GDPR).
3. Security and abuse prevention: limits, logs, account protection. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
4. Establishing, pursuing and defending claims: legitimate interest (Art. 6(1)(f) GDPR).
5. Answering messages and complaints: contract or legitimate interest (Art. 6(1)(b) or (f) GDPR).
6. Showing your materials as examples of our work: only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
7. Site statistics, to fix errors and improve the service: visits, steps, times and errors counted without cookies. Legal basis: legitimate interest in the service working well (Art. 6(1)(f) GDPR). You can object by writing to us.
8. Chat, to answer your questions and improve its answers: we review the chat’s messages and answers so that it answers well. Legal basis: performance of a contract (Art. 6(1)(b) GDPR), and for a guest and for improving the answers legitimate interest (Art. 6(1)(f) GDPR). You can object by writing to us.
9. Measuring how our ads on Meta's services (Facebook, Instagram) work, and visit recordings in Microsoft Clarity: only with your consent (Art. 6(1)(a) GDPR), given with the "Accept" button on the bar at the bottom of the page. You can withdraw it at any time in "Cookie settings" in the main page's footer.

We do not send marketing messages without your consent. An email address is required to create an account, and invoice details to issue an invoice. Everything else is voluntary, but without it we cannot make some materials.

4.Artificial intelligence

1. To make materials, we send your content to AI model providers: texts, brand data, photos and recordings, and content read from your website. We send only what the task needs.
2. CosmoMango does not train AI models on your data or content and does not give it to anyone for that purpose.
3. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR). The only automatic rules are the limits that protect the service against abuse.
4. Our team reviews the materials for paid orders.

5.Who receives the data

We share data only with providers that help us run the service, and only as much as needed. They act on our instructions under data processing agreements or terms.

Infrastructure and hosting

Cloudflare, Inc.: application servers, database and file storage, sending sign-in code emails and order messages, protection against attacks, and routing requests to AI models.

AI models for text

OpenAI (GPT models) and Anthropic (Claude models), depending on the feature: strategy conversation, Brand Brain, scripts, texts, captions, translations and checking a material's layout.

AI models for images

Google (Gemini API): brand scan, including the Google Search summary, editing product photos and generating images. Replicate: removing photo backgrounds.

AI models for video and sound

Google (Gemini, Veo, and turning a microphone recording into text when ElevenLabs does not), MiniMax, Kling AI, Higgsfield (including changing the background and the person's look in reels with an actor) and ElevenLabs (voice and turning a microphone recording into text).

Payments

Stripe Payments Europe, Limited and, for some methods, their operators (for example BLIK, Przelewy24) and banks. Stripe processes some data as a separate controller, for example to prevent fraud and meet legal obligations.

Ad measurement (only with your consent)

Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland: the Meta pixel in your browser and the Conversions API from our server. We and Meta are joint controllers for collecting this data on our page and sending it to Meta: we are responsible for informing you and for your consent on our page, Meta for its further processing, which it carries out as a separate controller under its own privacy policy (facebook.com/privacy/policy). You can exercise your rights with us or with Meta.

Visit recordings (only with your consent)

Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland: Microsoft Clarity, recordings of visits and click maps. Microsoft may also use this data for the purposes described in its privacy statement (privacy.microsoft.com).

Fonts

Google Fonts: after you sign in, the app loads some fonts from Google's servers, which then see your IP address. The guest page and this document use only our own fonts.

Email, accounting and shipping

The email provider for contact@cosmomango.com, our accounting office and invoicing software provider, the Polish National e-Invoice System (KSeF), and courier and postal companies when you send us a product or ask for it back.

Our team and public authorities

People on our team can access data as needed to fulfil orders and help you; they are bound by confidentiality. We give data to public authorities only when the law requires it.

6.Transfers outside the EEA

Some providers are based or have servers outside the European Economic Area, including in the USA and Singapore. We transfer data only with the safeguards the GDPR requires: a European Commission adequacy decision (for the USA, for companies participating in the EU-US Data Privacy Framework) or, where there is none, the Standard Contractual Clauses approved by the Commission. Meta may transfer data to Meta Platforms, Inc. in the USA, and Microsoft to Microsoft Corporation in the USA; both participate in the EU-US Data Privacy Framework. You can get a copy of the safeguards by writing to us.

7.How long we keep data

• Account and content: until the account is deleted. You delete it yourself in the menu with “Delete account” (in the phone app and on the website, details). We sign it out on every device at once and block signing in. After deletion we erase the data within 30 days, and database backups are overwritten within a further 30 days.
• Use without an account: as long as the data is needed to show you the results and move them to an account if you create one. We delete it earlier on request. The guest cookie expires after 30 days. We keep the sample week for a website so that we do not make it again for the same website.
• Sign-in: a sign-in code is valid for 10 minutes, a session for 30 days, and limit counters for up to 1 day.
• Orders, invoices and accounting documents: 5 years from the end of the calendar year in which the tax payment deadline passed.
• Data needed to pursue or defend claims: until the limitation period ends.
• Technical and security logs: for a limited time, usually up to 30 days.
• Correspondence: as long as needed to handle the matter, then until claims become time-barred.
• Consent to show materials: until you withdraw it.
• Site statistics: 12 months, then they are deleted automatically.
• Chat: messages and answers 30 days, then they are deleted automatically. We do not store the photos added to messages.
• Visit recordings: Microsoft keeps recordings for up to 30 days and aggregated data (such as click maps) for up to 13 months. Clarity cookies expire after a year at the latest, and withdrawing consent stops the recording.
• Ad measurement: Meta cookies expire after 90 days, and withdrawing consent removes them. The data for reporting a purchase is kept with the payment at Stripe. Your choice on the consent bar stays in browser storage until you change it.

8.Your rights

You have the right to:

• access your data and get a copy (Art. 15 GDPR),
• rectify your data (Art. 16 GDPR),
• erase your data (Art. 17 GDPR); you can also delete the account yourself in the menu: “Delete account”,
• restrict processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on legitimate interest (Art. 21 GDPR),
• withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.

Write to contact@cosmomango.com. We will reply within one month. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland (uodo.gov.pl).

9.Cookies and browser storage

Necessary cookies always work, because without them the service you ask for does not work, so they do not need consent. Our own site statistics use no cookies and no browser storage of visitors (except our team's browsers, described below). We load the cookies and scripts of Meta (measuring our ads) and Microsoft Clarity (visit recordings) only after you click "Accept" on the bar at the bottom of the main page. After "Only necessary" nothing from Meta or Microsoft loads. You can change your choice at any time in "Cookie settings" in the main page's footer.

__Host-cosmo_session

Keeps you signed in. 30 days.

__Host-cosmo_challenge

Ties a sign-in code to the browser that requested it. 10 minutes.

__Host-bp_chat_session

Studio session and protection of forms against request forgery (CSRF). Up to 180 days.

__Host-cm_guest, __Host-cm_guest_chat

A random guest identifier and its conversation session, so your results stay with you without an account. 30 days.

__Host-cm_preview, __Host-cm_preview_chat

Only in the CosmoMango owner's browser: a read-only preview of a client's calendar while preparing materials for them. 2 hours.

cm_theme

Remembers the look you chose (dark or light). 1 year.

cm_consent

Your choice on the consent bar (“Accept” or “Only necessary”), so the bar does not come back on every visit. 1 year.

__Host-cm_tester, __Host-cm_team, cm_as_client

Only in our team's browsers: for testing and to keep our own visits out of the site statistics. 30 days, 1 year and 7 days.

_fbp

Meta, only with your consent: recognises the browser when measuring our ads. 90 days.

_fbc

Meta, only with your consent: remembers a click on our ad (the fbclid parameter in the address). 90 days.

_clck

Microsoft Clarity, only with your consent: recognises the browser on later visits. 1 year.

_clsk

Microsoft Clarity, only with your consent: joins the pages of one visit into one recording. 1 day.

MUID, CLID, ANONCHK, MR, SM

Microsoft, on the clarity.ms domain, only with your consent: for Clarity to work. Up to 1 year.

Browser storage (localStorage, sessionStorage, IndexedDB) keeps on your device, among other things, your choice on the consent bar (cm-ads-consent), the interface language, drafts, the brand and sample week saved without an account, the local schedule and editor settings. You can remove it by clearing the site data in your browser.

10.Security

• Connections are encrypted (HTTPS with HSTS).
• You sign in with a one-time 8-digit code sent by email, valid for 10 minutes. We store no passwords because we do not use them.
• Session cookies cannot be read by page scripts and are sent only over HTTPS.
• Each account's data is kept separate. Only authorised people have access, and our team's access to a customer account is logged.
• We use request limits and protection against attacks.
• We never ask for your sign-in code.

11.Persons under 16

CosmoMango is a service for businesses. It is not intended for persons under 16 and we do not knowingly collect their data.

12.Changes to this policy

We may update this policy, for example when we change providers or features. The current version is always at cosmomango.com/privacy-policy. We will tell account holders about significant changes by email or in the app.

This Privacy Policy is effective from 22 October 2026.