Privacy Policy
Last updated: October 23, 2026
This Privacy Policy explains how Cosmetica Solutions Inc., a Florida corporation in formation ("Cosmetica", "we", "us" or "our"), collects, uses, shares and protects personal information, and how we use the business data customers upload to our Platform.
It covers:
- our website at getcosmetica.com, including its marketing pages, articles and free tools (the "Website");
- the Cosmetica compliance-analysis platform that customers sign in to (the "Platform");
- our support channels (email and Slack); and
- our business development and sales activity.
Cosmetica serves businesses. The Platform is not intended for consumers or for anyone under 18.
1. Our two roles
We handle personal information in two different roles, and your rights depend on which role applies.
1.1 Where we decide how data is used (controller). We are responsible for (as a "controller" or "business") the personal information we collect for our own purposes:
- account information about the people who use the Platform;
- security and sign-in records;
- Website visitor and marketing information;
- support conversations; and
- business contact information.
This policy describes that processing in full.
1.2 Where we act for our customers (processor). Our customers upload product formulas, supplier documents, labels, artwork and other records to the Platform ("Customer Data"). Customer Data sometimes contains personal information, for example:
- a supplier contact's name or signature in a specification sheet; or
- details of a person who reported an adverse reaction to a product.
For personal information within Customer Data we act as a "processor" or "service provider". We process that personal information only on the customer's instructions, under our Terms of Service and our Data Processing Addendum, and we do not use it to train AI models. Customer Data that is not personal information, such as formulas and documents, is owned by Cosmetica under our Terms of Service and used as Section 4.3 describes. The customer is responsible for having a lawful basis for that data and for giving the people concerned any required notice. If your personal information is in Customer Data and you want to exercise your rights, please contact the organisation that uploaded it. If you contact us instead, we will pass your request to that organisation where we can identify it.
2. Information we collect
2.1 Account information
When you are invited to the Platform, register, or are set up by our team, we collect:
- your name and email address;
- the organisation you belong to and your role in it (for example Owner, Admin or Member);
- your password, stored only as a one-way cryptographic hash (we never store it in readable form); or, if you sign in with Google, your Google account identifier, name, email address and profile image;
- whether and when your email address was verified;
- invitations: the email address invited, who sent the invitation, and when it was accepted;
- the time of your most recent sign-in, and a sign-in entry in the activity record of each organisation you belong to; and
- your notification preferences.
2.2 Security information
To protect accounts and the Platform, we collect:
- a count of failed sign-in attempts and any temporary lock, recorded against the email address used and the IP address the attempt came from;
- server and application logs, which include IP addresses, browser (user-agent) information, the pages and interfaces requested, and error details; and
- for Cosmetica personnel who perform privileged operations: passkey (WebAuthn) public-key credentials and the device and browser used to register them. Passkeys never give us your fingerprint, face or device PIN.
2.3 Customer Data
Customer Data is whatever a customer chooses to upload or enter:
- product formulas and ingredient lists;
- supplier documents such as quantitative and qualitative ingredient workbooks, allergen declarations and safety data;
- labels and artwork;
- product information;
- regulatory identifiers; and
- the Reports the Platform produces.
Customers who use our adverse-event features may record an adverse-event report. It can include the reporter's name, email address and phone number; the affected person's initials, age and gender; and a description of the reaction and how the product was used. That is health information, and we handle it only as the customer's processor. If a customer connects a Shopify store, we receive product catalogue data through read-only access. We do not receive that store's customer or order data.
2.4 Support information
When you contact support, we collect what you send and the details needed to respond:
- Email: messages sent to support@getcosmetica.com or amar@getcosmetica.com.
- Slack: messages you send to our support bot in a shared Slack channel or direct message, plus your Slack user name and ID.
- Support tickets: any support ticket you file, including its subject and description.
2.5 Website and marketing information
When you visit the Website, the following apply. Section 6 lists the cookies involved.
- Google Analytics records the pages you view, the site that referred you, your device and browser type, your approximate location (derived from your IP address), and actions such as opening the demo form or submitting it.
- Google Ads tags record whether you arrived from one of our ads and whether you then submitted a form, so we can measure our advertising.
- Apollo's website tracker uses your IP address to identify the company you may be browsing from, and records the pages visited.
- First-visit details. When you first arrive, the Website stores in your browser the referring site, any campaign (UTM) parameters in the link, and the page you landed on. If you later submit a form, it sends those details with the form. This record stays in your browser until you clear it.
- Demo requests. If you request a demo, we collect your name, email address, company and message.
- Free tools. If you use a free tool that asks for your email address, we collect your email address, your company (if given), the tool you used and the inputs you entered.
- Form protection. When you submit a form, Cloudflare Turnstile checks that you are not an automated bot, using signals from your browser and your IP address. ZeroBounce checks that the email address you entered can receive mail.
2.6 Business contact information from other sources
When you request a demo, we add you as a contact in our customer-relationship tool, Apollo. Apollo may add publicly available professional information about you, such as your job title, employer, and professional profile links. We also obtain business contact information about potential customers from Apollo and similar business-data providers, to contact people about our services.
2.7 Billing information
We keep your organisation's Plan, usage, billing contact, invoices and payment records. Payments are processed by Stripe, which receives the card or bank details you enter at checkout under its own privacy policy. We receive the payment status, the billing name, email and address, and the card brand and last four digits, not full card numbers. You do not enter payment card details in the Platform itself.
3. How we use information, and our legal bases
The table gives the legal basis we rely on under the EU and UK General Data Protection Regulations (GDPR) for each use. The same uses apply wherever you are.
| Purpose | Information used | Legal basis (EU/UK GDPR) |
|---|---|---|
| Create and run your account, give you access to your organisation, and provide the Platform | Account information; Customer Data (as processor) | Performance of our contract with you or your organisation; our legitimate interest in providing the service your organisation has bought |
| Produce Reports: read documents, extract ingredients, match them against our regulatory corpus, and write explanations | Customer Data (as processor) | On the customer's instructions (the customer determines the basis) |
| Keep the Platform and accounts secure, prevent fraud and abuse, and investigate incidents | Security information; account information; logs | Legitimate interests in securing our service and our customers' data |
| Send service emails: verification codes, invitations, password resets, welcome messages, regulatory-change alerts for your products and deadline reminders | Account information | Performance of contract; legitimate interests |
| Provide support and respond to requests | Support information; account information | Performance of contract; legitimate interests |
| Understand how the Website is used and measure our advertising | Website information | Legitimate interests in understanding how our Website is used and measuring our advertising |
| Respond to demo and tool requests, verify submissions are genuine, and follow up with prospective customers | Website forms; business contact information | Legitimate interests in growing our business; steps you ask us to take before entering a contract |
| Send business-to-business marketing emails | Business contact information | Legitimate interests, or consent where the law requires it |
| Improve our regulatory corpus and Platform, for example by adding support for new document layouts (never to train AI models) | Customer Data that is not personal information (such as formulas, ingredient lists, supplier documents, labels and Reports); de-identified usage data | Our ownership of that data under our Terms of Service; legitimate interests in improving our service |
| Invoicing, accounting, tax and legal obligations | Billing information; account information | Legal obligation; legitimate interests |
| Enforce our Terms, and establish or defend legal claims | Any relevant information | Legitimate interests; legal obligation |
We do not use personal information to make decisions that have legal or similarly significant effects on individuals by automated means alone. The Platform's automated analysis produces findings about products, not about people.
4. Artificial intelligence
4.1 What AI does in the Platform. The Platform uses AI models to:
- read uploaded documents and images;
- extract ingredients, concentrations and label text;
- index documents your organisation adds to its knowledge base so they can be searched; and
- write the explanatory text in Reports.
Findings come from matching your ingredients against our regulatory corpus.
4.2 Where it runs. We run these models through Amazon Bedrock, a service of Amazon Web Services (AWS), in AWS regions in the United States. The models are currently Anthropic's Claude models and Amazon's Titan text-embedding model. Requests to them contain the parts of Customer Data needed for the task, such as ingredient names and document text.
4.3 No training on your data. We do not use Customer Data, including formulas, ingredient lists, concentrations, supplier documents, labels, artwork and Reports, to train or fine-tune AI models. We may use Customer Data that is not personal information to improve our regulatory corpus and Platform, for example to add support for a new supplier document layout, as our Terms of Service provide. We do not disclose a customer's data to other customers in a form that identifies that customer, its clients or a specific product. Amazon Bedrock does not use the prompts and responses we send to train the model providers' own models, and does not share them with model providers such as Anthropic.
4.4 People who can see Customer Data. Authorised Cosmetica personnel may access Customer Data when needed to provide support, investigate a problem, maintain the accuracy of the Platform, or keep it secure. They are bound by confidentiality obligations.
5. How we share information
We do not sell personal information for money. We share personal information only as described here.
5.1 Service providers and subprocessors
We use the providers below. Each processes personal information only to provide its service to us, under contractual confidentiality and data-protection terms.
| Provider | What it does for us | Information involved | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing, subscriptions and invoicing | Billing name, email and address; payment details entered at checkout | United States |
| Amazon Web Services, Inc. | Hosting and computing (Amazon EC2); document storage (Amazon S3); databases (Amazon RDS); service email delivery (Amazon SES); AI processing (Amazon Bedrock); key management and logs | All Platform information, including Customer Data | United States |
| Anthropic, PBC | Provides the Claude models that AWS runs within Amazon Bedrock. Anthropic does not receive our requests or their results | None, beyond what Section 4.3 describes | — |
| Google LLC | Google Analytics and Google Ads measurement on the Website; "Sign in with Google" | Website information; Google sign-in details | United States |
| Apollo.io | Website company identification; customer-relationship management and contact enrichment; prospecting data | Website information; demo-request details; business contact information | United States |
| Cloudflare, Inc. | Bot protection (Turnstile) on Website forms | Browser signals; IP address | United States and globally |
| ZeroBounce | Email-address validation on Website forms | Email address | United States |
| Slack Technologies, LLC | Support conversations with our support bot, for customers who reach us through Slack | Support information | United States |
| Namecheap, Inc. (Private Email) | Hosting of our getcosmetica.com mailboxes | Emails you send us | United States |
We will update this list before a new provider begins processing Customer Data, and will notify customers as our Data Processing Addendum describes.
5.2 Within your organisation
Your organisation's Owners and Admins can see who belongs to the organisation, their roles, invitations, and activity in the organisation, including when each member last signed in.
5.3 Integrations you choose
If your organisation connects a third-party service such as Shopify, we exchange data with that service as the integration requires.
5.4 Legal and safety reasons
We may disclose information if we believe in good faith that it is required by law, court order or a valid request from a public authority. We may also disclose it to protect the rights, property or safety of Cosmetica, our customers or others, or to enforce our agreements.
5.5 Business transfers
If Cosmetica is involved in a merger, acquisition, financing, reorganisation or sale of assets, personal information may be transferred as part of that transaction. It will remain subject to the commitments in this policy.
5.6 Advertising and analytics tags
The Website's Google Analytics, Google Ads and Apollo tags let those providers collect information from your browser, as Section 2.5 describes. Some US state privacy laws treat this kind of disclosure as "selling", "sharing" or "targeted advertising". Section 6.3 explains your choices.
6. Cookies and similar technologies
We keep a strict split between the Website and the Platform.
6.1 On the Website (marketing pages)
| Technology | Set by | Purpose | Type |
|---|---|---|---|
_ga, _ga_V3CDMEJV2N cookies |
Google Analytics | Distinguish visitors and sessions to measure how the Website is used | Analytics |
_gcl_au and related Google Ads cookies |
Google Ads | Measure whether ad visits lead to form submissions | Advertising measurement |
| Apollo tracker cookies and local storage | Apollo | Identify the company a visit may come from, and record the pages visited | Marketing |
| Turnstile challenge | Cloudflare | Tell people from bots when you submit a form | Strictly necessary for the form |
| First-visit attribution entry (browser local storage) | Cosmetica | Remember how you first reached the Website, and send it with any form you submit | Marketing |
6.2 In the Platform (after you sign in)
The Platform does not load Google Analytics, Google Ads, Apollo or any other analytics or advertising technology. It uses only:
| Technology | Purpose | Type |
|---|---|---|
authjs.session-token (served with a __Secure- prefix) |
Keep you signed in | Strictly necessary |
authjs.csrf-token (served with a __Host- prefix) and authjs.callback-url |
Protect sign-in against cross-site request forgery; return you to the page you were on | Strictly necessary |
| Privileged-operation challenge cookies (Cosmetica personnel only) | Complete passkey verification for privileged operations | Strictly necessary |
| Browser local storage entries | Remember interface state, such as which tabs are open and which analysis runs you have not yet viewed | Functional |
6.3 Your choices
You can block or delete cookies and local storage in your browser settings. Blocking the strictly necessary Platform cookies will stop you from signing in. To limit Google's measurement, you can:
- install the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout); and
- manage ad personalisation at myadcenter.google.com.
The Website does not yet provide a cookie-settings tool. You can block or delete cookies in your browser settings, and you can opt out of Google Analytics with Google's opt-out browser add-on.
The Website does not currently respond to Global Privacy Control signals.
7. International transfers
Cosmetica is based in the United States. We store personal information and Customer Data with AWS in the United States, and some of our providers process data in the United States or in other countries. If you are outside the United States, your information will be transferred to and processed in the United States, where data-protection laws may differ from those where you live.
When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum and the Swiss amendments where applicable. For customers, these are incorporated in our Data Processing Addendum. You can ask for a copy of the relevant safeguards at support@getcosmetica.com.
8. How long we keep information
| Information | How long we keep it |
|---|---|
| Account information | While your account is active, then 90 days after it is closed, except where the law requires us to keep it longer |
| Customer Data that is not personal information (formulas, ingredient lists, documents, labels and Reports) | Kept indefinitely, including after your organisation's account ends, as our Terms of Service provide |
| Copies of files uploaded to the Platform, including files we could not read or import, kept to troubleshoot uploads and add support for new document layouts | 12 months from upload, then deleted; you can ask us to delete a copy sooner from the Uploads tab in Settings or at support@getcosmetica.com |
| Personal information within Customer Data | While your organisation's account is active, then deleted within 60 days after it ends (a 30-day export window followed by deletion within 30 days) |
| Backups | Deleted when the backup expires, within 35 days |
| Ingredient identity records created from uploads (ingredient names and identifiers only, with no link to any customer) | Kept indefinitely as part of our regulatory corpus |
| Organisation activity records, including sign-in entries | While the organisation's account is active, then deleted with it |
| Failed sign-in counters | Until they reset or are superseded, and no longer than 30 days |
| Application logs | 90 days |
| Support tickets and emails | 3 years after the conversation closes |
| Demo-request and tool-lead details | 2 years from your last interaction with us, unless you become a customer |
| Google Analytics data | 14 months |
| Invoices and billing records | As long as tax and accounting law requires, typically 7 years |
When a retention period ends, we delete the information or de-identify it so that it can no longer be linked to you.
9. Security
We protect personal information and Customer Data with:
- encryption of data in transit using TLS;
- encryption of stored data at rest in our databases and document storage;
- separation of each organisation's data, with role-based access within organisations;
- least-privilege access to our cloud environment using short-lived credentials;
- passkeys (WebAuthn) for privileged operations;
- sign-in rate limits and temporary lockouts; and
- activity records of significant actions.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Keeping your password and devices secure is your responsibility.
10. Security incidents
If a security breach involves personal information, we will investigate promptly, take steps to contain it, and notify affected people and authorities as the law requires. In particular:
- Florida. For personal information of Florida residents covered by section 501.171 of the Florida Statutes, we will notify affected individuals as quickly as practicable and no later than 30 days after we determine that a breach occurred, or have reason to believe one did. The only exceptions are where law enforcement asks us to delay, or where the statute otherwise permits delay or does not require notice. We will notify the Florida Department of Legal Affairs where a breach affects 500 or more Florida residents.
- EU and UK. Where we are the controller, we will notify the relevant supervisory authority within 72 hours of becoming aware of a breach where the GDPR requires it. We will also notify affected individuals where the breach is likely to result in a high risk to them.
- Customer Data. Where a breach affects Customer Data, we will notify the affected customer without undue delay, and give it the information it reasonably needs to meet its own obligations.
11. Your rights
11.1 Everyone. Wherever you are, you can ask us to:
- give you access to, or a copy of, the personal information we hold about you;
- correct it;
- delete it; or
- stop sending you marketing emails.
We will respond within the time the law requires, and in any case within 45 days. If we need more time where the law allows it, we will tell you.
11.2 EU, EEA and UK residents. You also have the right to:
- restrict our processing;
- object to processing based on our legitimate interests, including direct marketing;
- receive your information in a portable format; and
- withdraw consent at any time, without affecting processing that took place before you withdrew it.
You may complain to your local data-protection supervisory authority; in the UK, that is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first.
11.3 US state residents. Residents of some US states have rights under state privacy laws:
- to know what personal information we collect and how we use and disclose it;
- to access, correct and delete it;
- to opt out of the sale or sharing of personal information and of targeted advertising; and
- to appeal a decision we make about a request.
We will not discriminate against you for exercising these rights. To appeal, reply to our decision and write "Appeal" in the subject line. If your appeal is denied, you may contact your state attorney general.
11.4 How to make a request. Email support@getcosmetica.com with "Privacy request" in the subject line. We will verify your identity before acting, usually by confirming control of the email address on your account. An authorised agent may make a request for you with your signed permission, and we may confirm the request with you directly. If your request concerns Customer Data, see Section 1.2.
11.5 Limits. We may keep information where the law requires or allows it, for example to comply with legal obligations, resolve disputes, keep records of your requests, or protect the security of the Platform.
12. Emails from us
Service emails, such as verification codes, invitations, password resets and security notices, are part of the Platform and cannot be unsubscribed from while you have an account. You can manage product notifications, such as regulatory-change alerts and deadline reminders, in the Platform's notification settings. Every marketing email includes an unsubscribe link, and you can also ask us to stop at support@getcosmetica.com.
13. Children
The Website and Platform are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe we have, contact us and we will delete it.
14. Changes to this policy
We may update this policy. If we make a material change, we will notify account Owners and Admins by email and post a notice in the Platform before the change takes effect. We will update the "Last updated" date at the top of the policy for every change.
15. Contact us
Cosmetica Solutions Inc. Attention: Amar C. Bhakta, Co-Founder and Chief Operating Officer Privacy requests and questions: support@getcosmetica.com Other enquiries: amar@getcosmetica.com