📄 Privacy Policy

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use.

Do we process any sensitive personal information? Uploaded images may reveal characteristics that are treated as sensitive in some jurisdictions. We process user-provided images only as needed to provide the requested media-generation features and do not use them for biometric identification or authentication.

Do we collect any information from third parties? We may collect information from public databases, marketing partners, social media platforms, and other outside sources.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information.

How do you exercise your rights? The easiest way to exercise your rights is by submitting a data subject access request, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

We store and process user-provided images to preview them, translate character styles, create starting frames and videos, return generated outputs, apply safety controls, troubleshoot failures, secure the Services, and provide support.

In Short: We may share information in specific situations described in this section and/or with the following third parties.

We may need to share your personal information in the following situations:

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Affiliates. We may share your information with our affiliates, in which case we will require those affiliates to honor this Privacy Policy. Affiliates include our parent company and any subsidiaries, joint venture partners, or other companies that we control or that are under common control with us.
• Vendors and Service Providers. We may provide user content, including uploaded images, to hosting, storage, security, cloud, and AI or media-generation providers only as reasonably necessary to operate the Services and generate the output you requested.
• Business Partners. We may share your information with our business partners to offer you certain products, services, or promotions.

In Short: We use necessary and functional cookies to operate the Services, and Microsoft Clarity analytics cookies to understand how visitors use the Services.

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.

Necessary cookies. We use first-party cookies where required for authentication, security, session management, and core operation of the Services.

Necessary session navigation. To provide navigation between the commercial homepage and the authenticated CosmosBites app, we use a first-party functional cookie named cosmosbites_app_session for up to 48 hours. This cookie is necessary for that navigation feature because it allows the commercial homepage to recognize that this browser recently used the authenticated app and route it directly back to the app. It contains only a boolean marker and does not contain an authentication token, account identifier, email address, or other profile information. It is not used to authenticate or authorize access to the app.

Microsoft Clarity behavioral analytics. On the commercial site and authenticated app, we use Microsoft Clarity to understand interactions such as clicks, scrolling, navigation, and usability patterns through heatmaps and session recordings. Clarity may process browser and device characteristics, IP-derived approximate location, referring pages, URL paths, timing information, and click, pointer, or scroll activity. We configure content masking in the Clarity projects to protect sensitive page content.

Clarity uses first-party cookies, including _clck and _clsk, to distinguish browsers and connect page views into sessions, and Microsoft may use related third-party cookies for operational and analytics purposes. Microsoft processes Clarity data under the Microsoft Privacy Statement.

We also permit third parties and service providers to use online tracking technologies on our Services for analytics and advertising, including to help manage and display advertisements, to tailor advertisements to your interests, or to send abandoned shopping cart reminders (depending on your communication preferences). The third parties and service providers use their technology to provide advertising about products and services tailored to your interests which may appear either on our Services or on other websites.

You can restrict cookies through your browser settings, although disabling necessary cookies may affect requested features. You can also use Microsoft's privacy choice tools to opt out of supported Microsoft telemetry.

In Short: We implement industry-standard security measures to protect your data.

We protect your information using the following security measures:

• Encryption in Transit: All data transmitted between your device and our servers uses HTTPS/TLS encryption to protect against interception.
• Encryption at Rest: Sensitive data including OAuth tokens and user credentials are encrypted using industry-standard AES-256 encryption when stored in our databases.
• Secure Token Storage: OAuth access and refresh tokens are encrypted and stored securely with strict access controls to prevent unauthorized access.
• Data Segregation: We maintain strict technical and operational separation between different data sources to ensure compliance with third-party policies (such as Google's Limited Use requirements).
• Access Controls: User data is protected by authentication and authorization mechanisms, ensuring only authorized personnel and systems can access your information.
• Security Monitoring: We continuously monitor our systems for unauthorized access, security incidents, and potential vulnerabilities.
• Regular Updates: We keep our security measures current by regularly updating our systems and implementing the latest security best practices.

If you have any questions about our security practices or believe you have discovered a security vulnerability, please contact us immediately at Security@Cosmosbites.com.

Our Services offer you the ability to register and log in using your third-party social media account details (like your Facebook or X logins). Where you choose to do this, we will receive certain profile information about you from your social media provider. The profile information we receive may vary depending on the social media provider concerned, but will often include your name, email address, friends list, and profile picture, as well as other information you choose to make public on such a social media platform.

We will use the information we receive only for the purposes that are described in this Privacy Policy or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend that you review their privacy policy to understand how they collect, use, and share your personal information, and how you can set your privacy preferences on their sites and apps.

In Short: We may transfer, store, and process your information in countries other than your own.

Our servers are located in Israel. Regardless of your location, please be aware that your information may be transferred to, stored by, and processed by us in our facilities and by the facilities of the third parties with whom we may share your personal information (see "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?" above), including facilities at and other countries.

If you are a resident in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, then these countries may not necessarily have data protection laws or other similar laws as comprehensive as those in your country. However, we will take all necessary measures to protect your personal information in accordance with this Privacy Policy and applicable law.

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Policy unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

Our Services do not address anyone under the age of 13. We do not knowingly collect personal identifiable information from children under 13. In the case we discover that a child under 13 has provided us with personal information, we immediately delete this from our servers. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us so that we will be able to do necessary actions.

In Short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at Support@Cosmosbites.com.

In Short: You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below.

However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Revised" date at the top of this Privacy Policy. If we make material changes to this Privacy Policy, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Policy frequently to be informed of how we are protecting your information.