IntroductionCosmos | AI Catalog Manager ("Cosmos", "the app", "we", "us") is a Shopify app developed by 9x9 Digital, a brand of The Desi Co Group Ltd, located at 124 City Road, London, United Kingdom. This policy explains what data the app collects when you install and use it on your Shopify store, how we use and share that data, and the choices you have. By installing Cosmos you agree to this policy. If you do not agree, please do not install or use the app.

1. What the app doesCosmos helps merchants complete and improve their product listings. It reads source material you provide — product label photos, packaging images, and barcodes — and uses AI to extract structured product data (for example: brand, ingredients, nutrition, allergens, size, country of origin), generate studio-style product images, score listing completeness, and write approved data back to your Shopify products and metafields.

2. Information we collectWhen you install and use Cosmos, we collect and process: • Store information — your Shopify store domain, store ID, and basic configuration needed to connect the app. • Staff/user account information — the name and email address of staff members who access the app, provided through Shopify's authentication. We use this to operate the app, provide support, and secure your account. • Product and catalog data — product and variant titles, descriptions, metafields, tags, and related catalog fields read from and written to your Shopify store. • Files you upload — product/label and packaging images (JPEG, PNG, or WebP) you add to a product for enrichment. • AI-generated content — structured data extracted from your source material and product images generated by the app. • Usage and log data — processing logs, timestamps, actions taken in the app, and technical/diagnostic information used to operate, debug, and improve the service. We do not access, collect, or store your customers' personal data. Cosmos operates on product/catalog data, not on your store's customer or order records.

3. How we use informationWe use the information above to: • Provide the app's core functions — data extraction, image generation, completeness scoring, and syncing approved data to Shopify. • Keep your in-app product list in sync with Shopify (via product webhooks). • Provide customer support and respond to your requests. • Maintain security, prevent abuse, and debug and improve the service. We do not sell your data, and we do not use it for advertising.

4. Third-party AI providersTo deliver enrichment and image generation, Cosmos sends the relevant source material (such as product images and extracted text) to OpenRouter, an AI model-routing provider. OpenRouter forwards the data to underlying AI model providers — which may include OpenAI and Google (Gemini) — to perform text/vision extraction and image generation, and returns the results to us. These providers process the data on our behalf to fulfill your request. We also rely on the following infrastructure and platform providers: • Railway — application hosting and our PostgreSQL database, where your store configuration, product/enrichment data, and app session data are stored. • Amazon Web Services (AWS S3) — storage of the images you upload and the product images Cosmos generates. • Shopify — the platform your store runs on and the destination for approved enrichment data written back to your products and metafields. We share data with these providers only as needed to operate the app. We do not authorize them to use your data for their own independent purposes.

5. Data storage & securityYour store configuration, product, and enrichment data are stored in our PostgreSQL database hosted on Railway. Images you upload and images we generate are stored in AWS S3. AI processing is performed by the providers listed in Section 4. We apply security best practices, including: • Encryption of data in transit (TLS) and encryption at rest provided by our hosting and storage providers. • Storage of API keys and credentials in managed environment configuration, never in code. • Validation of Shopify session tokens on requests to the app. • Multi-tenant isolation, so one store's data is scoped to that store and not exposed to another. • HMAC verification of all incoming Shopify webhooks. • Logging of processing actions and errors for operability and debugging. No method of transmission or storage is 100% secure, but we work to protect your information using commercially reasonable safeguards.

6. Data retentionWe retain your data for as long as the app is installed and as needed to provide the service. If you uninstall Cosmos, we retain the non-personal enrichment and product data associated with your store (for example, extracted product attributes and generated images), so that your enrichment history can be restored if you reinstall. We do this because re-creating enrichment from scratch is costly and time-consuming. We do not retain this data to identify any individual. Staff account information (name and email) is stored only as part of your app session. When you uninstall Cosmos, your app sessions are deleted immediately, which removes this staff account information. You can request deletion of your retained data at any time by contacting us at prabhav.pathak@9x9digital.com — see Section 8.

7. Shopify complianceCosmos honors Shopify's mandatory data-protection webhooks. When Shopify notifies us of a data request or erasure obligation (customers/data_request, customers/redact, shop/redact), we respond in accordance with those requirements. Because Cosmos does not process your customers' personal data, the customer-data webhooks generally return no customer information.

8. Your rightsDepending on your location (including under the GDPR and UK GDPR), you may have the right to access, correct, export, or delete personal data we hold about you, and to object to or restrict certain processing. To make a request, or for any privacy question, contact: Email: prabhav.pathak@9x9digital.com Postal: The Desi Co Group Ltd, 124 City Road, London, United Kingdom We will respond within the timeframes required by applicable law.

9. International transfersYour data may be processed in countries other than your own, including by the providers listed in Section 4. Where required, we rely on appropriate safeguards for such transfers.

10. Children's privacyCosmos is a business tool not directed to children and is not intended for use by anyone under 16. We do not knowingly collect personal data from children.

11. Policy changesWe may update this policy from time to time. We will revise the "Last updated" date above and, where appropriate, notify you within the app. Continued use of Cosmos after changes take effect constitutes acceptance of the updated policy.

12. ContactThe Desi Co Group Ltd (9x9 Digital) 124 City Road, London, United Kingdom prabhav.pathak@9x9digital.com