Privacy policy

1. Who we are

Cosmos Connect is a WhatsApp Business messaging platform operated by Graphicosmos, a business registered in Gurugram, Haryana, India ("we", "us", "our"). We provide software that lets businesses ("Customers") communicate with their own customers ("End Users") through the WhatsApp Business Platform.

You can reach our privacy team at privacy@cosmosconnect.io.

2. What this policy covers

This policy explains how we handle personal information in two distinct roles:

• As a controller — for information about our Customers (business owners who sign up for our service): account details, billing information, and usage data.
• As a processor — for information about End Users (the customers of our Customers): message content, phone numbers, and profile information that flows through the WhatsApp Business Platform on behalf of the Customer.

Our Customers are responsible for their own privacy notices to their End Users. Where we act as a processor, we handle End User data strictly according to the Customer's instructions and Meta's WhatsApp Business Terms.

3. Information we collect

3.1 Account information (from Customers)

• Business name, contact person's name, email address, phone number
• Business address, business category, business website (optional)
• Login credentials (passwords are stored as one-way hashes; we never see the plaintext)
• Team members you add (their name, email, role, password hash)

3.2 Payment information

• Subscription plan and billing cycle
• Payment records (amount, date, method, reference ID) — the actual card details are handled by our payment processor, Razorpay, and never stored on our servers
• Invoicing details

3.3 WhatsApp Business Account details (from Meta)

• Your WhatsApp Business Account (WABA) ID and phone number ID
• Business display name, verified name, quality rating
• Access token for API calls (encrypted at rest)

3.4 Message and contact data (as processor, on behalf of Customers)

• End User phone numbers who message the Customer's WhatsApp number
• End User display name and profile picture (as provided by WhatsApp)
• Message content (text, images, documents, location) exchanged between the Customer and their End Users
• Message metadata: send time, delivery status, read status
• Booking details, form submissions, and lead data captured through bot flows

3.5 Usage & technical data

• Log data: IP address, browser type, pages visited, actions taken, timestamps
• Device information: operating system, screen size
• Audit trail of admin actions on your account (who did what, when)

4. How we use it

We use collected information for the following purposes only:

• Delivering the service: processing messages, storing conversations, running automations, showing analytics.
• Billing & account management: processing subscriptions, sending invoices, providing customer support.
• Security: preventing fraud, abuse, and unauthorised access; maintaining an audit trail.
• Product improvement: understanding how features are used in aggregate (never identifying individual End Users) to prioritise improvements.
• Legal compliance: meeting our obligations under Indian law and Meta's WhatsApp Business Terms.
• Communicating with Customers: service announcements, security alerts, and (with your consent) product updates.

We do not: sell personal information; run advertising on the platform; use End User message content for any purpose beyond delivering it to the Customer; train AI models on Customer or End User data.

5. WhatsApp & Meta data

Cosmos Connect uses the official WhatsApp Business Platform (Cloud API) provided by Meta. When Customers connect their WhatsApp Business Account through our platform (via Meta's Embedded Signup), Meta grants us permission to send and receive messages on their behalf. Our use of this data is governed by:

• Meta's WhatsApp Business Terms
• Meta's WhatsApp Business Messaging Policy
• Meta's Platform Terms

Message content transits Meta's infrastructure end-to-end. Meta may retain message metadata as described in their own privacy policies. We do not access, read, or process End User messages for any purpose other than delivering them to the Customer's inbox and applying the automations the Customer has configured.

6. When we share

We share personal information only with the following categories of recipients, and only to the extent needed:

• Meta / WhatsApp: for the delivery of messages through the WhatsApp Business Platform.
• Razorpay (payment processor): for processing subscription payments. Razorpay's privacy policy applies.
• Cloud infrastructure providers: our servers are hosted with cloud providers who process data on our behalf under strict data-processing agreements. Data is stored in India.
• Legal & compliance: if required by law, court order, or to protect our legal rights.
• Business transfers: if Graphicosmos is acquired or restructured, personal information may transfer to the acquiring entity, subject to the same protections.

We do not sell personal information to third parties. Ever.

7. Where we store data

All personal data is stored on servers located in India. Backups are encrypted and stored in the same jurisdiction. Some technical processing (e.g., email delivery, analytics aggregation) may occur through providers with international infrastructure, always under contractual data-protection safeguards.

8. How long we keep it

• Account information: for as long as your account is active. If you cancel, we keep account information for 30 days to allow recovery, then permanently delete it.
• Message history: retention depends on your plan (Basic: 90 days · Standard: 1 year · Pro: unlimited). You can delete individual conversations at any time.
• Payment records: we retain invoices and payment records for 7 years to comply with Indian tax law (Income Tax Act).
• Audit logs: retained for 2 years for security and compliance purposes.
• Anonymised aggregate data: may be retained indefinitely for product analytics.

9. Your rights

You have the right to:

• Access — request a copy of the personal information we hold about you
• Correct — ask us to fix incorrect or incomplete information
• Delete — request permanent deletion of your account and associated data (see Data deletion instructions)
• Export — receive a copy of your data in a portable format (JSON / CSV)
• Object — opt out of specific processing activities (e.g., marketing emails)
• Withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, email privacy@cosmosconnect.io. We respond within 30 days.

End Users of our Customers should contact the Customer directly to exercise these rights, as the Customer is the controller of that data. We will assist Customers in responding to such requests.

10. Security

We implement industry-standard technical and organisational measures to protect personal information:

• Encryption in transit (TLS 1.2+) for all data moving between systems
• Encryption at rest for sensitive fields (passwords, access tokens, payment references)
• Role-based access controls — team members only see what their role permits
• Audit logs of all admin actions
• Regular security updates and dependency scanning
• Physical security through our cloud infrastructure providers

No system is perfectly secure. If we detect a security breach affecting personal data, we will notify affected Customers within 72 hours and, where required, notify the relevant authorities.

11. Cookies

We use only strictly necessary cookies:

• cc_session — HTTP-only session cookie for authentication. Expires after 7 days of inactivity.
• cc_super_return — short-lived (30 min) cookie used only during super-admin support sessions.

We do not use tracking cookies, third-party advertising cookies, or analytics cookies without your explicit consent. There is no cookie banner because there is nothing to consent to beyond the essential login cookie.

12. Children

Cosmos Connect is a business-to-business service and is not intended for anyone under 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact privacy@cosmosconnect.io and we will delete it.

13. Changes to this policy

We may update this policy from time to time. Material changes will be announced via email to Customer account holders at least 30 days before taking effect. The "Last updated" date at the top of this page always reflects the current version. Previous versions are available on request.

14. Contact us

For any question about this policy or your personal data:

Graphicosmos — Privacy team
Email: privacy@cosmosconnect.io
Address: Gurugram, Haryana, India
Response time: within 30 days