Terms of Service

Effective Date: March 4, 2026
Last Updated: May 16, 2026

PLEASE READ THESE TERMS OF SERVICE CAREFULLY BEFORE USING THE SERVICE.

These Terms of Service ("Terms") constitute a legally binding agreement between Kosmatic Solutions Inc. ("Kosmatic," "we," "us," or "our") and you ("Customer," "you," or "your") governing your access to and use of the Kosmatic AI-powered customer analytics platform and related services (collectively, the "Service").

By accessing or using the Service, you agree to be bound by these Terms. If you do not agree to these Terms, do not access or use the Service.

1. Definitions

Swipe the table sideways to see every column.

2. Account Registration and Security

2.1 Eligibility

To use the Service, you must:

• Be at least 18 years old
• Have the legal capacity to enter into binding contracts
• Register a valid business entity
• Provide accurate and complete registration information

2.2 Account Security

You are responsible for:

• Maintaining the confidentiality of your account credentials
• All activities that occur under your account, including actions taken via the MCP API or AI Workflows
• Notifying us immediately of any unauthorized access
• Ensuring your account information remains current
• Safeguarding third-party integration API keys stored in your account settings

We reserve the right to suspend or terminate accounts that violate these Terms.

2.3 Multi-Factor Authentication

We strongly recommend enabling multi-factor authentication (MFA) for all account access. Kosmatic is not liable for unauthorized access resulting from failure to use MFA.

3. Service Description

3.1 Overview

Kosmatic provides AI-powered customer lifetime value (CLV) prediction and behavioral analytics for e-commerce merchants. The Service includes:

• Real-time visitor behavioral signal collection (three-tier consent model)
• On-device (WebGPU) behavioral archetype classification, where supported by the visitor's browser
• Server-side AI-powered archetype classification fall-back
• CLV prediction and scoring using Bayesian statistical models (Gamma-Poisson-Gamma family)
• Automated playbook recommendations and intervention optimization
• A/B testing with Bayesian analysis and epsilon-greedy exploration
• AI Workflows for scheduled automated analysis and actions
• MCP API for AI assistant integration
• Element Picker — a merchant-initiated tool that captures storefront DOM text and ships per-archetype text variants back to the storefront via Customer's installed Theme App Embed
• Programmatic Shopify App Embed activation, which writes a single block entry to the Customer's published theme's config/settings_data.json (no other theme content is modified)
• Integration with marketing platforms (Klaviyo, HubSpot, Meta, Google, Slack)
• Audience segment sync to advertising platforms
• Analytics dashboard, reporting, and data export
• Configurable data retention and privacy controls

3.2 AI and Automated Features

The Service uses artificial intelligence, machine learning, and automated processing. You acknowledge and agree that:

• AI predictions are probabilistic, not deterministic. Archetype classifications, CLV scores, favourite-product detection, and purchase probability predictions are statistical estimates and may be inaccurate, incomplete, or misleading for any individual visitor.
• AI outputs may reflect biases present in training data, signal coverage, or third-party model providers. No representation is made that outputs are free from statistical bias, are appropriate for protected-class decision-making, or constitute professional advice of any kind.
• You are solely responsible for any decision made on the basis of AI outputs, including but not limited to which visitors receive discounts, which receive personalised copy, which are routed into which marketing segment, and which are flagged for human review.
• AI Workflows execute autonomously on the schedules and triggers you configure. You are responsible for reviewing workflow configurations, outputs, and actions before enabling auto-execution.
• Playbook recommendations are suggestions. When auto-execute is enabled, interventions fire without per-action approval. You are responsible for ensuring automated interventions comply with applicable laws (including consumer protection, anti-discrimination, telemarketing, and electronic communications laws).
• AI-Generated Copy is not auto-published to your storefront. Variants proposed by AI through the Element Picker workflow require explicit merchant approval (an "Approve & Save" action) before they ship to the storefront. You are responsible for reviewing all proposed text before approval; once approved, you are the publisher of record for that copy.
• A/B tests assign visitors to variants automatically. The epsilon-greedy exploration algorithm may expose some visitors to less-proven strategies to gather performance data.
• MCP API access allows AI agents to read and modify your data. You are responsible for controlling which AI agents have access and reviewing their actions via the AI action log.
• AI Workflows that contact End Users (emails, SMS, push, or third-party platform messages) are sent under your account and your sending domain. You are the sender of record for the purposes of CAN-SPAM, CASL, GDPR, the EU ePrivacy Directive, and equivalent laws. Kosmatic is not the sender.
• AI training data and model providers. Kosmatic may route generation requests to one or more third-party model providers listed in the Sub-Processor list (currently including Anthropic, OpenAI, Google Gemini, and Moonshot / Kimi). Routing may change without notice subject to the Sub-Processor change-notice procedure in Section 7.2. Outputs are subject to the upstream provider's own terms and acceptable-use policies; Kosmatic does not warrant that any specific provider will be available at any specific time.
• Storefront DOM modification. The Element Picker writes textContent only to selectors the merchant has explicitly chosen via the picker UI, and never modifies child nodes, attributes, scripts, or styles. The programmatic Shopify App Embed activation writes one block entry to config/settings_data.json and modifies no other content in the theme. Customer is responsible for verifying that picker selectors target text the Customer is licensed to modify and that the selector remains stable across theme updates.

3.3 Service Availability

We strive to maintain 99.9% uptime, measured monthly (excluding scheduled maintenance and force majeure). However:

• Scheduled maintenance: 24-hour notice (max 4 hours/month)
• Emergency maintenance: May occur without notice
• SLA Credits: If uptime falls below 99.9%, contact support for service credit (sole remedy)
• We are not liable for downtime caused by Third-Party Services (e.g., Shopify, Klaviyo)
• Force majeure events are excluded from uptime calculations

Detailed SLA available at kosmatic.com/sla

3.4 Service Modifications

We reserve the right to modify, suspend, or discontinue the Service (or any part thereof) at any time, with or without notice. We will provide 30 days' notice for material changes that significantly reduce functionality.

4. Customer Obligations

4.1 Lawful Use

You agree to use the Service only for lawful purposes and in accordance with these Terms. You must not:

• Violate any applicable law or regulation
• Infringe intellectual property rights
• Transmit malware, viruses, or harmful code
• Attempt to gain unauthorized access to the Service or other customers' data
• Interfere with other users' access to the Service
• Use the Service to stalk, harass, or harm individuals
• Collect data from children under 16 without verifiable parental consent
• Use automated features (AI Workflows, Playbooks, MCP API) for purposes that violate applicable consumer protection laws

4.2 Data Compliance

As a Customer using our Service to collect End User data, you are the Data Controller under applicable privacy laws. You must:

• Provide a clear privacy policy to your End Users that discloses the use of behavioral analytics, automated profiling, archetype classification, and CLV prediction
• Obtain appropriate consent for data collection (particularly Tier 3 / Identified data)
• Comply with GDPR, CCPA/CPRA, PIPEDA, Quebec Law 25, and other applicable privacy laws
• Honor End User data subject requests (access, deletion, portability, objection to profiling)
• Not use the Service to collect sensitive personal data (health, biometrics, etc.) without explicit consent
• Ensure your data collection practices comply with Shopify's Terms of Service
• Conduct a Data Protection Impact Assessment (DPIA) where required by GDPR Article 35
• Disclose to End Users that automated decision-making and profiling is used, as required by GDPR Articles 13(2)(f) and 14(2)(g)
• Represent and warrant that your store is not directed to children under 13 within the meaning of the U.S. Children's Online Privacy Protection Act (COPPA), and not deploy the Service on any child-directed website or section of a website. If your store becomes child-directed, you must uninstall the Service and notify us
• Where your store sells health-related products (for example supplements or wellness goods), comply with applicable consumer health data laws (including Washington's My Health My Data Act and Nevada's SB 370), including obtaining any required opt-in consent before behavioral data is collected from visitors in those jurisdictions, for example by adding those regions to your platform's consent banner settings

4.3 Prohibited Data

You may not submit to the Service:

• Credit card numbers or financial account credentials
• Social security numbers or government IDs
• Health or medical information (unless explicitly authorized)
• Biometric data
• Data classified as "special category" under GDPR Article 9

4.4 Integration Compliance

When using Third-Party Services (Klaviyo, HubSpot, Meta, Google, Slack, etc.), you must:

• Comply with their respective terms of service and advertising policies
• Maintain valid accounts in good standing
• Not use integrations to circumvent platform restrictions
• Be responsible for data shared with these platforms, including audience syncs
• Ensure audience segments synced to advertising platforms comply with anti-discrimination policies
• Not use archetype-based audiences for discriminatory targeting based on protected characteristics

4.5 AI Workflow and MCP Responsibilities

When using AI Workflows or the MCP API, you must:

• Review and approve workflow configurations before enabling them
• Monitor AI action logs regularly for unexpected or undesired actions
• Not configure workflows that violate applicable laws or these Terms
• Not use the MCP API to exfiltrate data in violation of End User rights
• Not grant MCP API access to unauthorized third parties
• Accept responsibility for all actions taken by AI agents acting on your behalf

4.6 Custom Webhook Responsibility

If you configure a custom webhook URL to receive visitor classification data, you are solely responsible for:

• The security and privacy practices of the receiving endpoint
• Ensuring data received via webhook is handled in compliance with applicable laws
• Any downstream use or disclosure of data received via webhook

Kosmatic has no control over and accepts no liability for data handling by custom webhook endpoints.

5. Fees and Payment

5.1 Subscription Fees

Service fees are based on your selected plan and usage (visitor count, email captures). Current pricing is available at kosmatic.com/pricing. We reserve the right to change pricing with 30 days' notice.

5.2 Billing

• Fees are billed monthly in advance
• Payment is due via credit card or approved payment method (Stripe or Shopify Billing)
• Failed payments may result in service suspension
• All fees are in USD unless otherwise specified

5.3 Taxes

You are responsible for all applicable taxes, including sales tax, VAT, or GST. Prices do not include taxes unless stated.

5.4 Refunds

• Annual subscriptions: Prorated refund if cancelled within 30 days
• Monthly subscriptions: No refunds for partial months
• Overages: No refunds for usage-based charges

5.5 Free Trials

Free trials are offered at our discretion. At trial end:

• Your account automatically converts to a paid plan unless cancelled
• You authorize us to charge your payment method
• You may cancel before trial end to avoid charges
• Reminder: We email you 3 days and 1 day before trial ends
• Quebec Residents: You have additional cancellation rights under the Quebec Consumer Protection Act

6. Intellectual Property

6.1 Kosmatic IP

All Intellectual Property in the Service, including:

• Software, code, and algorithms
• AI/ML models, predictions, and archetype classification logic
• Dashboards, reports, and visualizations
• MCP API and protocol specifications
• Documentation and training materials
• Trademarks, logos, and branding

are owned by Kosmatic or our licensors. These Terms do not grant you any ownership rights.

6.2 Customer Data

You retain all rights to your Customer Data. By using the Service, you grant Kosmatic a limited license to:

• Process Customer Data to provide the Service
• Use Customer Data to train and improve AI models (archetype classifier, CLV predictor) in aggregate and anonymized form only — individual visitor data is not used for cross-merchant model training
• Aggregate and anonymize data for platform-wide analytics
• Create case studies (with your prior written consent)

6.3 Feedback

Any feedback, suggestions, or feature requests you provide may be used by Kosmatic without restriction or compensation.

6.4 Open Source

Certain components of the Service may use open-source software. Such software is governed by its respective licenses.

7. Data Protection and Security

7.1 Data Processing

Kosmatic processes Customer Data as a Data Processor under GDPR and similar laws. We will:

• Process data only on your documented instructions
• Implement appropriate technical and organizational security measures
• Not engage sub-processors without your authorization (see Section 7.2)
• Assist with data subject requests, breach notifications, and DPIAs
• Return or delete data upon contract termination

7.2 Sub-Processors

We use the following sub-processors. The authoritative, continuously-updated list is at kosmatic.com/sub-processors; the table below is summary and may lag the authoritative list by up to 30 days.

Swipe the table sideways to see every column.

The four AI model providers above are selectable by the Customer. The Customer's selection in Settings → AI Agent determines which provider receives generation requests originated from that Customer's account. Customer may revoke any provider at any time.

We will provide 30 days' notice before adding new sub-processors. You may object within 14 days; if the objection is unresolved, you may terminate affected services pursuant to Section 11.

7.3 Security Measures

We implement industry-standard security measures including:

• Encryption at rest (Render-managed disk encryption) and in transit (TLS)
• Argon2id password hashing (m=65536, t=3, p=4)
• JWT access tokens with 15-minute expiry and httpOnly cookies
• Account lockout after 5 failed login attempts (15-minute window)
• Rate limiting on authentication and API endpoints
• Role-based access controls
• Incident response procedures
• Annual SOC 2 Type II audits (planned)
• Automated data retention enforcement (daily)
• AI action logging for all MCP and workflow operations

7.4 Data Breaches

In the event of a data breach affecting your Customer Data:

• We will notify you within 24 hours of discovery
• We will provide details of the breach and affected data
• We will cooperate with your breach notification obligations
• We will take reasonable steps to mitigate harm

8. Confidentiality

8.1 Confidential Information

Each party ("Receiving Party") agrees to:

• Keep the other party's ("Disclosing Party") Confidential Information confidential
• Use Confidential Information only for the purpose of these Terms
• Disclose only to employees/contractors with a need to know
• Protect with the same care as its own confidential information

Integration API keys, webhook URLs, and AI Workflow configurations are your Confidential Information. We store them securely and access them only to provide the Service.

8.2 Exceptions

Confidentiality obligations do not apply to information that:

• Is or becomes publicly available
• Was known prior to disclosure
• Is independently developed
• Is required to be disclosed by law

8.3 Duration

Confidentiality obligations survive termination for 5 years.

9. Limitation of Liability

9.1 Disclaimer of Warranties

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.

WE DO NOT WARRANT THAT:

• THE SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE
• AI PREDICTIONS (INCLUDING ARCHETYPE CLASSIFICATIONS, CLV SCORES, FAVOURITE-PRODUCT DETECTION, AND PURCHASE PROBABILITIES) WILL BE ACCURATE, RELIABLE, FAIR, OR UNBIASED
• AI OR ML OUTPUTS WILL BE FREE FROM STATISTICAL BIAS REFLECTING TRAINING DATA, SIGNAL COVERAGE, OR THIRD-PARTY MODEL PROVIDER LIMITATIONS
• AI OR ML OUTPUTS ARE APPROPRIATE INPUTS TO ANY DECISION CONCERNING A PROTECTED CLASS, CREDIT, EMPLOYMENT, INSURANCE, HEALTHCARE, HOUSING, OR ANY OTHER REGULATED USE
• AI WORKFLOWS WILL EXECUTE WITHOUT ERROR OR PRODUCE CORRECT OUTPUTS
• PLAYBOOK RECOMMENDATIONS WILL ACHIEVE DESIRED BUSINESS OUTCOMES
• A/B TEST RESULTS WILL BE STATISTICALLY SIGNIFICANT OR ACTIONABLE
• ELEMENT-PICKER RULES WILL REMAIN STABLE ACROSS THEME UPDATES OR PRODUCE THE COPY THE CUSTOMER INTENDED ON ANY PARTICULAR PAGE
• THE SERVICE WILL MEET YOUR SPECIFIC REQUIREMENTS
• DEFECTS WILL BE CORRECTED

9.2 Limitation of Damages

TO THE MAXIMUM EXTENT PERMITTED BY LAW:

• OUR TOTAL LIABILITY SHALL NOT EXCEED THE AMOUNTS PAID BY YOU IN THE 12 MONTHS PRIOR TO THE CLAIM
• WE SHALL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES
• WE SHALL NOT BE LIABLE FOR LOST PROFITS, REVENUE, OR DATA
• WE SHALL NOT BE LIABLE FOR THIRD-PARTY SERVICE FAILURES, INCLUDING THIRD-PARTY AI MODEL PROVIDER OUTAGES, RATE LIMITS, OR CONTENT FILTERING
• WE SHALL NOT BE LIABLE FOR ACTIONS TAKEN BY AI WORKFLOWS, MCP-CONNECTED AGENTS, OR AUTOMATED PLAYBOOKS THAT YOU CONFIGURED OR ENABLED
• WE SHALL NOT BE LIABLE FOR THE CONTENT OR LEGALITY OF AI-GENERATED COPY YOU APPROVE AND PUBLISH TO YOUR STOREFRONT VIA THE ELEMENT PICKER OR ANY OTHER MECHANISM
• WE SHALL NOT BE LIABLE FOR ELECTRONIC COMMUNICATIONS SENT UNDER YOUR ACCOUNT (EMAIL, SMS, PUSH, OR THIRD-PARTY PLATFORM MESSAGES) WHERE YOU ARE THE SENDER OF RECORD
• WE SHALL NOT BE LIABLE FOR DATA SHARED VIA CUSTOM WEBHOOKS OR MERCHANT-CONFIGURED INTEGRATIONS
• WE SHALL NOT BE LIABLE FOR ANY DECISION YOU MAKE ON THE BASIS OF AI OR ML OUTPUTS, INCLUDING WHICH VISITORS TO TARGET, WHICH TO DISCOUNT, WHICH TO ROUTE INTO WHICH MARKETING SEGMENT, AND WHICH TO EXCLUDE

9.3 Exceptions

The limitations in Section 9.2 do not apply to:

• Fraud or willful misconduct
• Gross negligence
• Death or personal injury
• Violations of privacy laws (to the extent prohibited by law)
• Breaches of Section 8 (Confidentiality)

10. Indemnification

10.1 Customer Indemnification

You agree to indemnify, defend, and hold harmless Kosmatic and our officers, directors, employees, and agents from and against any claims, damages, losses, and expenses (including reasonable attorneys' fees) arising from:

• Your use of the Service in violation of these Terms
• Your Customer Data or End User data practices
• Your failure to provide adequate privacy disclosures to End Users (including disclosure of automated profiling under GDPR Articles 13(2)(f) and 14(2)(g))
• Your failure to conduct a Data Protection Impact Assessment where required by GDPR Article 35
• Your failure to obtain required consent for data collection, profiling, or cookieless tracking
• Your configuration and use of AI Workflows, Playbooks, or MCP API access
• Your approval and publication of AI-generated copy via the Element Picker or any other mechanism, including any claim that such copy is misleading, defamatory, discriminatory, or infringes a third party's rights
• Your authorisation of the programmatic Shopify App Embed activation, including any dispute with Shopify or any theme vendor regarding modification of config/settings_data.json
• Audience segments you sync to advertising or messaging platforms, including claims of unlawful discrimination or differential treatment
• Electronic communications sent under your account where you are the sender of record (CAN-SPAM, CASL, GDPR, ePrivacy, TCPA equivalents)
• Data shared via custom webhooks or Merchant-configured integrations
• Your violation of any law or regulation
• Your violation of any third-party rights
• Your negligence or willful misconduct

10.2 Kosmatic Indemnification

Kosmatic will indemnify you against third-party claims that the Service infringes a valid patent, copyright, or trademark, provided you promptly notify us and cooperate in the defense.

11. Term and Termination

11.1 Term

These Terms commence when you create an Account and continue until terminated.

11.2 Termination by You

You may terminate your Account at any time by:

• Cancelling through the dashboard, or
• Emailing support@kosmatic.com

11.3 Termination by Us

We may suspend or terminate your Account for:

• Violation of these Terms
• Non-payment of Fees
• Fraudulent or illegal activity
• Extended inactivity (12+ months)
• Use of AI features in violation of applicable laws

We will provide 30 days' notice for non-material breaches before termination.

11.4 Effect of Termination

Upon termination:

• Your access to the Service ceases immediately
• All AI Workflows are disabled and cease execution
• All MCP API access is revoked
• All outstanding Fees become due
• We will delete your Customer Data within 90 days (per our Privacy Policy)
• Sections 6, 8, 9, 10, and 12 survive termination

11.5 Data Export

Prior to termination, you may export your data through the dashboard (CSV or JSON format) or via the MCP API. After termination, data retrieval may incur fees.

12. Dispute Resolution

12.1 Governing Law

These Terms are governed by the laws of the Province of British Columbia, Canada, without regard to conflict of law principles.

12.2 Jurisdiction

Any disputes shall be resolved in the courts of Vancouver, British Columbia.

12.3 Informal Resolution

Before filing any claim, you agree to attempt informal resolution by contacting support@kosmatic.com.

12.4 Class Action Waiver

You agree to resolve disputes on an individual basis. Class actions and representative proceedings are waived to the maximum extent permitted by applicable law (noting that such waivers may be unenforceable in Quebec, the EEA, or other jurisdictions where such waivers are prohibited).

12.5 Limitation Period

Any claim must be filed within 1 year of the event giving rise to the claim, except where a longer period is required by mandatory applicable law.

13. General Provisions

13.1 Entire Agreement

These Terms, together with the Privacy Policy, Cookie Policy, and Data Processing Agreement, constitute the entire agreement between you and Kosmatic regarding the Service.

13.2 Amendments

We may amend these Terms at any time. Material changes require 30 days' notice. Continued use constitutes acceptance.

13.3 Waiver

Our failure to enforce any provision does not constitute a waiver.

13.4 Severability

If any provision is invalid, the remaining provisions remain in effect.

13.5 Assignment

You may not assign these Terms without our written consent. We may assign without restriction.

13.6 Force Majeure

Neither party is liable for failures due to events beyond reasonable control.

13.7 Notices

Notices to Kosmatic: support@kosmatic.com or legal address
Notices to you: Email on file or dashboard notification

13.8 Headings

Headings are for convenience only and do not affect interpretation.

13.9 Third-Party Beneficiaries

No third-party beneficiaries except as expressly stated.

14. Specific Terms for Shopify Merchants

14.1 Shopify Partner Program

If you access the Service through Shopify:

• You must comply with Shopify's Terms of Service
• You must comply with Shopify's App Store requirements
• We act as a Shopify Partner and are subject to their policies

14.2 Data Processing

For Shopify merchants, we process End User data as a Data Processor under Shopify's Data Processing Addendum.

14.3 GDPR Webhooks

We support Shopify's mandatory GDPR webhooks:

• customers/data_request — Data portability
• customers/redact — Right to erasure
• shop/redact — Store data deletion

14.4 Script Tag and Tracking

The Service injects a tracking script into your Shopify storefront via Script Tags. This script:

• Collects behavioral signals according to the three-tier consent model
• Loads configuration (processing interval, hover threshold) from your account settings
• Operates within Shopify's Script Tag API policies

15. Contact Information

Kosmatic Solutions Inc.
Email: support@kosmatic.com
Legal: legal@kosmatic.com
Address: Vancouver, British Columbia, Canada

BY USING THE SERVICE, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THESE TERMS OF SERVICE.

END OF TERMS OF SERVICE