COSMO PRIVACY POLICY

(a) Information you provide:

(i) Waitlist and account information: name, display name, username, email address, password (stored only in hashed form), account type (Client or Pro), profile photo, bio, and city.

(ii) Beauty profile (quiz answers): hair type and condition, skin tone and type, the services you are interested in, your goals, and your budget range. Health-related answers, such as allergies or hair loss, are optional and collected only with your consent (see Section 8).

(iii) Interests: interest categories seeded from your quiz answers, interests you add or remove, and custom interests you type. Custom interests are private to you.

(iv) Profile and community information: posts, photos, captions, comments, reviews, recommendations, Group membership and Group posts, Cosmo Crew selections, mentions (including names of Pros not yet on Cosmo), direct messages, and favorite Pros.

(v) Booking information: the service, Pro, date, time, appointment status, deposit status, and notes you share with a Pro.

(vi) Pro information: business name, services, pricing, availability, business address and whether it is shown publicly, portfolio images, and credentials or licenses you choose to display. Pros may also choose to self-identify business attributes (for example, Black-owned, women-owned, or LGBTQ+-owned) and the client groups they serve. These appear on the Pro's profile only if provided. We never infer them.

(vii) Billing information for Pros: if you subscribe to a paid plan or pay new-client fees, our payment processor (Stripe) collects your payment card details. Cosmo does not store full card numbers. Cosmo does not collect Clients' payment information, because payment for services happens directly between Clients and Pros.

(viii) Support requests and communications with us: the category, description, screenshots you attach, and technical diagnostics (account identifier, screen visited, and device and browser details).

(b) Information collected automatically:

(i) Device and usage data, such as IP address, browser and device type, operating system, app version, pages and screens viewed, referring URLs, and dates and times of access.

(ii) Interaction data, such as likes, comments, posts opened, profiles viewed, follows, Groups joined or left, bookings created, feed filters selected, interests added or removed, and searches. We do not read the contents of your direct messages for marketing.

(iii) Approximate location, based on the city you provide or your IP address. We do not collect precise GPS location.

(iv) Push notification tokens, if you turn on notifications.

(v) Information collected through cookies and similar technologies (see Section 5).

(c) Information from others:

(i) Information about you from users who invite you, recommend you, mention or tag you, or add you to a Group.

(ii) Information from service providers, such as your name and email from Google Sign-In or Sign in with Apple if you use them.

(iii) Information from social media platforms, if you interact with our accounts.

We use personal information to: (a) provide, operate, and maintain the Services, including accounts, bookings, messaging, Groups, Cosmo Crew, and recommendations; (b) match Clients with Pros using quiz answers, and connect Clients and Pros to support bookings; (c) process Pro subscriptions and fees; (d) send transactional messages and, with any required consent, marketing about launches, features, and early access; (e) personalize your feed and recommendations (your budget range quietly informs ranking and is never shown publicly); (f) analyze and improve the Services; (g) give Pros aggregated, de-identified performance metrics about their listing, such as profile views, booking rates, and how clients discovered them, without identifying individual viewers; (h) verify Pro information and protect against fraud, abuse, and security incidents; (i) moderate content and enforce our Terms and Community Guidelines; (j) respond to support requests; and (k) comply with legal obligations.

Cosmo plans to introduce sponsored placements, affiliate product links, and brand recommendations. If a future feature involves sharing personal information for cross-context behavioral advertising, we will update this policy and provide a clear opt-out before that feature launches.

We do not sell personal information. We do not share it for cross-context behavioral advertising. In the past 12 months, Cosmo has not sold or shared personal information. We disclose information only as follows:

(a) With other users. Your display name, username, bio, profile photo, public posts, Cosmo Crew selections, and published reviews are visible to other signed-in users. If you switch to a private account, your posts and Cosmo Crew are visible only to accepted followers. Content posted in a Group is visible to that Group's members. Direct messages are shared with your conversation partner. When you book, Clients and Pros receive each other's information needed to complete the booking. A Pro's address is public only if the Pro chooses; otherwise it is shared with a Client after a booking is confirmed. Booking history, direct message contents, quiz answers, health-related answers, private interests, budget preferences, interaction data, and support tickets are never made public.

(b) With service providers that process information for us under contractual confidentiality and data protection obligations: Supabase and Lovable (database, file storage, website and app hosting, authentication, transactional email, and aggregated visitor statistics); Google Sign-In and Sign in with Apple (sign-in); push notification services run by Apple, Google, and browser makers (alerts contain a short summary, never full message text or quiz answers); an encrypted off-site storage provider (weekly backups for disaster recovery); Stripe (Pro subscriptions and fees, once billing is switched on); and Google Fonts (website fonts, which receives your IP address when a page loads).

(c) For legal reasons: to comply with law or legal process, or to protect the rights, safety, or property of Cosmo, our users, or others.

(d) In business transfers, such as a merger, acquisition, financing, reorganization, or sale of assets, subject to this Privacy Policy's commitments.

(e) With your consent or at your direction, for example when you connect an AI assistant to your Cosmo account and authorize it to read your profile, bookings, or notifications.

Links to external payment apps (such as Venmo, Cash App, Zelle, or Square) or other websites take you outside Cosmo, and those services' privacy policies apply.

We keep personal information as long as your account is active or as needed to provide the Services. We may keep it longer to comply with legal obligations, resolve disputes, enforce agreements, and keep moderation records (for example, records of accounts banned for safety violations). Specifically:

• Waitlist emails: if you do not create an account, deleted 12 months after you join the waitlist, or sooner if you ask us to delete them.
• Deleted posts and comments: removed from the Services immediately; cached or backup copies are purged within 30 days.
• Account deletion: personal information is permanently erased or anonymized within 90 days.
• Health-related answers: deleted when you delete them or withdraw consent.
• Activity and interaction data: automatically deleted after 12 months.
• In-app notifications: automatically deleted after 90 days.
• Closed support requests and screenshots: automatically deleted after 24 months.
• Backups: database backups roll off automatically after about 14 days.

When we no longer need information, we delete or de-identify it.

(a) We use cookies and similar technologies, such as browser storage, that are necessary to operate the Services, for example to keep you logged in and remember your settings. We also use our hosting provider Lovable's built-in visitor statistics (pages viewed, referring site, device type, country, and visit length) to understand how the Services are used. We do not use Google Analytics, advertising pixels (such as Meta or TikTok pixels), session-recording tools, or any other third-party analytics or advertising trackers.

(b) We do not use advertising cookies or allow third parties to track you across other websites for advertising.

(c) You can control cookies through your browser settings.

(d) We treat Global Privacy Control (GPC) signals as a request to opt out of the sale or sharing of personal information. Because we do not sell or share personal information, no further action is needed. We do not respond to browser "Do Not Track" signals, which have no common standard.

We use reasonable administrative, technical, and physical safeguards to protect personal information. These include TLS encryption in transit, AES-256 encryption at rest through our hosting provider, hashed password storage, row-level database access controls, encrypted off-site backups, and access limited to authorized personnel. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. We encourage you to use a strong, unique password.

(a) All users. You may access, update, or delete your profile details, quiz answers, interests, and content in Settings, or delete your account in Settings > Delete Account. You may switch between a public and private account at any time. Pros may change whether their address is shown publicly. You can also email support@bookwithcosmo.com. You may opt out of marketing emails using the unsubscribe link. Essential account messages, such as booking confirmations and security alerts, continue while you have an account.

(b) State privacy rights. Depending on where you live, you may have the right to: (i) know what personal information we collect and how we use and disclose it; (ii) access and receive a portable copy of it; (iii) correct or delete it; (iv) opt out of its sale, sharing for targeted advertising, or profiling; (v) limit the use of sensitive personal information; and (vi) appeal our decision on your request. To make a request, email support@bookwithcosmo.com or use our "Do Not Sell or Share My Personal Information" page. We will verify your identity before responding. An authorized agent may submit a request for you with proof of authority. We will not discriminate against you for exercising these rights. If we deny your request, you may appeal by replying to our decision.

(c) California residents. California residents may also request information about disclosures of personal information to third parties for direct marketing (Cal. Civ. Code § 1798.83). We do not make such disclosures.

Some optional quiz questions touch on health-related topics: allergies and sensitivities, hair and scalp conditions, skin concerns, and interest in med-spa treatments. We ask for your explicit consent before collecting any of these answers, either through the optional health-data box at sign-up or by turning it on in Settings, and you can decline and still use Cosmo. These answers are stored privately, visible only to you, and used only to match you with suitable Pros. We do not sell them, share them with other users or Pros, or use them for advertising. Under California law this information may be "sensitive personal information," and we use it only to provide the features you request. If you withdraw consent, we delete these answers and stop using them in matching. You can view, change, or delete them at any time in Settings > Privacy > "Health-related answers." Our Consumer Health Data Privacy Policy describes how we handle health-related information under Washington's My Health My Data Act and similar laws.

The Services are for adults 18 and older only, and we ask users to confirm their age at sign-up. We do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it and close the account. Contact us if you believe a minor has given us information.

Cosmo is based in the United States. If you access the Services from outside the U.S., your information will be processed in the U.S. and in other countries where our service providers operate.

We may update this Privacy Policy from time to time. We will post changes on this page and update the "Last updated" date. For material changes, we will notify you by email or through the Services before they take effect.

Cosmo App LLC, 8 The Green, Ste A, Dover, DE 19901 · support@bookwithcosmo.com