Data processing agreement
Last updated 5 October 2026
This agreement applies when you use Cosmic Social to process personal data about other people — typically your clients and their audiences. You are the controller of that data and Cosmic LLC is your processor.
Who this is between
It is between you (the controller) — the agency or business holding an account with us — and Cosmic LLC, a limited liability company in Wisconsin, United States, at 6516 S Crane Dr, Oak Creek, WI 53154, United States (the processor).
It takes effect when you accept the terms of service, and it forms part of them. You do not need to sign anything separately; if your own compliance process requires a countersigned copy, email legal@usecosmicsocial.com and we will send one.
What we process, and why
Only what the product needs to do the job you asked it to do:
- Your account data — the email addresses and names of the people at your agency who sign in.
- Your clients’ brand information — business name, brand voice, facts about the business, topics to avoid, posting schedule. Whatever you enter.
- Connected social accounts — the access tokens the platforms issue, the account identifier and name, and when the token expires.
- Content and its performance — drafts, reviewer notes, approvals, published posts, the clips and images made for them, and the public metrics those posts earn.
- Approver contact details — the email addresses of people you invite to approve posts, who may work for your client rather than for you.
We process it to provide the service and for no other purpose. We do not sell it, we do not use it for advertising, and we do not use it to train any model of our own. Whether a sub-processor may train on what it receives is decided by its own terms, and is stated for each one in the table below rather than promised for all of them.
Your instructions
We process personal data only on your documented instructions. Using the product is the instruction: creating a brand, approving a post, connecting an account and scheduling are each an instruction to do that thing.
We will tell you if we think an instruction breaks data protection law, and we will not carry it out until you confirm.
Confidentiality and who can see your data
Everyone at Cosmic LLC with access to your data is bound to keep it confidential. Access is limited to the people who need it to run and support the service.
To be plain about a small company: the operator of Cosmic LLC can technically read the contents of your account, as the holder of the database credentials. We access customer data only to fix a fault you have reported, to investigate abuse, or where the law requires it.
Sub-processors
We use the companies below. Each is bound by terms no less protective than these, and each one is here because the product cannot work without it.
| Sub-processor | What it does | Where | What it keeps, and training |
|---|---|---|---|
| Supabase | Database, authentication and file storage. Everything described in this policy. It is where the service keeps its data. | Canada (ca-central-1) | For as long as we keep it (see "How long we keep it"). Database backups are kept for at most 30 days. Not applicable: it stores data and runs no models on it. |
| Netlify | Application hosting. Every request to the service, including your IP address and browser. | United States (us-east-1) | Function logs for up to 7 days. Not applicable: it hosts the application. |
| Anthropic | Writing and reviewing post copy, Studio scripts and research. The brand information for the client a post is for, recent post history, drafts being reviewed, topics you type into Studio, and research questions about the brand — which Anthropic may pass to its web-search provider to answer. | Not stated by Anthropic (a US company) | Deleted within 30 days. Content flagged for a usage-policy violation is kept for up to 2 years. Not used to train its models, under its commercial terms. |
| Generating images; speech when Resemble is unavailable, and voice previews. Image prompts, which carry the brand name, style and colours; and, for a voice preview or when Resemble is unavailable, the script or line to be spoken. | Not fixed: Google may process and cache it in any country | Prompts and outputs kept for 55 days for abuse monitoring. Not used to improve Google’s products on the paid tier, which is what we use (checked 5 October 2026). | |
| Resemble AI | Speaking the voiceover for video. The voiceover script for each clip. The voice is a synthetic voice cloned from our founder’s own voice; no customer’s voice or audio is sent to Resemble. | United States | Scripts and generated audio are not kept after delivery. Not used to train its general models, under its privacy policy. |
| Shotstack | Rendering video. The script and captions, brand name and colours, and links to the images, voiceover and any audio you uploaded for the clip. Those links stay valid for one year. | Not stated by Shotstack (an Australian company) | The finished video stays on Shotstack’s servers, and we cannot currently delete it there. Working files are deleted after 24 hours. We use none of Shotstack’s AI features. Its terms allow training on the inputs and outputs of those features unless switched off, and say nothing either way about an ordinary render, so we make no promise about it. |
| Stripe | Payments and subscriptions. Your agency name, billing email and plan. Card details go to Stripe directly; we never see them. | United States | For as long as the law requires it to. Stripe also acts as an independent controller for fraud prevention. Your Stripe customer record is kept when you close your account, as a billing record. Not applicable. |
| Resend | Sending email. Each email we send: the recipient, subject and body — approval requests, invitations, trial and billing notices, and alerts. Recipients can include the client staff you invite as approvers. | United States | Email content and logs for 30 days. Not applicable. |
The platforms you connect — TikTok and Google — receive the posts you approved, on your instruction. They are not our sub-processors: you have your own relationship with each of them, and what they do with a published post is governed by their terms.
We will tell you at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds, you may end your subscription and we will refund unused credits under the refund terms.
Security
What is actually in place, rather than a list of intentions:
- Data is encrypted in transit (TLS) and at rest by our hosting provider.
- Social access tokens are encrypted with AES-256-GCM before they are stored, under a key held outside the database. A copy of the database alone does not yield a usable token.
- Access between accounts is separated at the database with row-level security, so one agency’s queries cannot reach another’s rows.
- We never see full card numbers. Payments are handled by Stripe.
- Passwords are handled by our authentication provider and are not stored by us in any readable form.
What we do not claim: we hold no SOC 2 or ISO 27001 certification, and there is no third-party penetration test to show you. If your procurement requires either, we are not a fit yet, and we would rather say so than promise one.
If there is a breach
We will tell you without undue delay, and within 72 hours of becoming aware, if personal data you control is breached. We will tell you what happened, which data and roughly how many people are affected, what we are doing about it, and what we suggest you do.
Notice goes to your account’s owner email, and to your escalation address if you have set one.
Helping you answer your clients
If someone asks you for their data, or asks you to delete it, the product does most of the work without us:
- Disconnecting a social account deletes its stored tokens immediately.
- Deleting a client removes that client and everything under it.
- Deleting your account removes the lot — see deleting your data for exactly what that covers and what it cannot.
Where the product cannot answer a request on its own, email privacy@usecosmicsocial.com and we will help within 30 days at no charge.
Keeping and deleting data
We keep personal data for as long as your account is open. When you delete your account we remove, within 30 days, what we hold — the database rows, the files you uploaded, the images and voiceovers generated for you, and the logins of everyone at your agency. Deleting one client removes its rows at once and its files within two days.
What we cannot remove. Copies already held by a sub-processor are kept for its own period, stated in the table above — Anthropic up to 30 days (2 years if flagged), Google 55 days, Resend 30 days. Finished videos stay on Shotstack’s servers, and we cannot currently delete them there. Links we gave Shotstack and the platforms to your files are valid for up to a year, and stop working once we delete the file.
Two deliberate exceptions on our own side, both stated rather than buried:
- Records we must keep. Billing records, for seven years, because tax law requires it. A record that a deletion happened, so we can show that it did.
- Backups. Deleted data can persist in encrypted database backups for up to 30 days, until they are overwritten. We do not restore deleted data from a backup, and we do not surgically edit backups, because doing so reliably is not something we can promise.
What deletion cannot do: posts already published to a social platform stay there. They belong to that account, not to us.
Where your data is
Stored in Canada, and processed in the United States — and, for Google, possibly elsewhere. Anthropic and Shotstack do not say where they process it. The table above gives each sub-processor. If you are in the UK or EEA, transfers from you to us rely on the applicable Standard Contractual Clauses, which are incorporated into this agreement by reference and which we will provide executed on request.
Audits
On reasonable notice, and at most once a year unless a regulator requires otherwise, we will answer a written security questionnaire and provide the information you need to show that we meet this agreement.
We do not offer on-site audits. For a company of this size that would be a promise we could not keep at scale, and a promise we could not keep is not worth making.
How to reach us about this
legal@usecosmicsocial.com for the agreement itself, or privacy@usecosmicsocial.com for a request about someone’s data. Cosmic LLC, 6516 S Crane Dr, Oak Creek, WI 53154, United States.