Privacy Policy
Draft last updated 1 August 2026
1. Scope
This policy explains what personal data Cosmic Monkey collects, why, and what rights you have. It covers this marketing website and the Cosmic Monkey analytics product. It is written to align with India's Digital Personal Data Protection Act, 2023 (DPDP Act) as the primary framework, and with the EU / UK GDPR for visitors and end users in the EEA and UK.
2. Who is the data fiduciary / controller
Cosmic Monkey is operated by an entity registered in India, which acts as the data fiduciary (DPDP Act) and data controller (GDPR) for account and billing data. For analytics data collected on behalf of our customers about their website visitors, our customer is the fiduciary / controller and Cosmic Monkey acts as a data processor.
3. What we collect
a. Traffic and event data (via the tracking script)
When a website uses the Cosmic Monkey tracking script, we collect page views and events such as: page URL and referrer, UTM / campaign parameters, a coarse device and browser type, approximate location derived from IP (country / region — the raw IP address is not stored), and a non-identifying session reference used to stitch a visit together.
The tracking script is designed to be cookie-free. It does
not set cookies and does not use cross-site identifiers; session continuity
uses localStorage / sessionStorage on the visitor's
own browser. See the Cookie Policy for detail.
b. Payment and conversion data
When a customer connects a Razorpay or Cashfree account, we receive webhook notifications about completed payments — amount, currency, payment method (UPI, card, netbanking), timestamp and a processor reference — so we can attribute revenue to a channel. We do not receive or store full card numbers, UPI PINs, or bank credentials.
c. Account and billing data
To create and run an account we collect your name, work email, company name, and authentication data. For paid plans we collect billing details and GST information needed to issue a compliant invoice. Subscription charges are processed by our payment processor; we store only the last four digits and card type or the UPI handle, plus the processor's transaction records.
4. Why we process it (legal bases)
- To provide the Service — performance of a contract (GDPR Art. 6(1)(b)); necessary for the specified purpose (DPDP Act consent / legitimate use).
- Billing, tax and fraud prevention — legal obligation and legitimate interests.
- Product analytics on our own website — see the Cookie Policy; where consent is required it is requested.
- Service email — legitimate interests / contract. Marketing email only with your consent, withdrawable at any time.
5. Payments are processed by Razorpay and Cashfree
Card, UPI and netbanking transactions — both our customers' end-user payments and our own subscription billing — are handled by Razorpay and / or Cashfree as independent controllers of the payment data they process. We do not restate their practices here; please read them directly:
- Razorpay — razorpay.com/privacy
- Cashfree Payments — cashfree.com/privacy-policy
6. Sharing
We share personal data only with: infrastructure and sub-processors that host or operate the Service (e.g. cloud hosting, error monitoring, email delivery); the payment processors above; and authorities where required by law. We do not sell personal data. A current sub-processor list is available on request.
7. International transfers
Data is primarily processed in India. Where a sub-processor processes data outside your jurisdiction, we rely on appropriate safeguards — for EEA / UK data, Standard Contractual Clauses or an adequacy decision; for DPDP Act data, transfers are made only to jurisdictions not restricted by the Central Government.
8. Retention
Analytics event data is retained for the period tied to the customer's plan (3 or 12 months) and then deleted or aggregated. Account and billing records are kept for as long as the account is active and for the period required by tax and accounting law afterwards.
9. Your rights
Subject to the applicable law, you may request access to, correction of, or erasure of your personal data; object to or restrict certain processing; withdraw consent; request portability; and, under the DPDP Act, nominate another individual to exercise your rights in the event of death or incapacity. End users of our customers' websites should contact that website operator first; we will assist them as processor.
To exercise a right, email privacy@cosmicmonkey.in. You also have the right to complain to the Data Protection Board of India or, in the EEA / UK, your local supervisory authority.
10. Grievance / Data Protection contact
Grievance Officer (DPDP Act) / Data Protection point of contact: privacy@cosmicmonkey.in. We aim to acknowledge requests within the statutory timeframe.
11. Changes
We will post material changes to this policy on this page and update the "last updated" date.
Finally,
you found us.
We were looking for you too. Cosmic Monkey is web analytics built for indie developers — see where your traffic actually comes from, without wading through a dashboard built for a marketing team of twenty. If you're tired of analytics tools that assume you have a team you don't, you're exactly who we built this for.