Legal
Privacy Policy
Cosmic Innovators Collective LLC ("CIC," "we," "us," or "our") operates the SQL Security Sandbox at cosmicsoc.io. This Privacy Policy explains what information we collect, how we use it, and your rights with respect to that information. We are committed to collecting only what we need and never selling your data.
1. Who We Are
Cosmic Innovators Collective LLC is a SAM.gov-registered, veteran-owned small business registered in Texas, United States. SAM.gov UEI: YPT4XJH79QR7. We build practical cybersecurity training products for security analysts, IT professionals, and career-changers.
2. Information We Collect
2.1 Information you provide directly
- Purchase information: When you purchase access to SQL Security Sandbox, your payment and order are processed by Gumroad (our payment processor). We receive your email address and order confirmation from Gumroad. We do not receive or store your credit card number.
- Contact form submissions: If you contact us via the contact form or by email, we receive your name, email address, and message content.
- Discount code usage: If you use a discount code (e.g., LAUNCH99, VETERAN20, STUDENT20), Gumroad records this as part of your transaction. We see aggregate redemption counts only.
2.2 Information collected automatically
- Web analytics: We use Cloudflare Web Analytics (privacy-first, no cookies, no cross-site tracking, GDPR-compliant by design). It collects aggregated page views, referrer domains, and general geographic region (country level). No personally identifiable information is linked to these analytics.
- Server logs: Our hosting infrastructure (Cloudflare Pages) may log IP addresses and HTTP request data for security and performance purposes. These logs are retained for a short period and are not used for marketing.
- Browser storage: The SQL Security Sandbox application stores your theme preference (light/dark mode) in your browser's local storage. This data never leaves your device and is not transmitted to us.
2.3 Information we do NOT collect
- We do not use Google Analytics, Facebook Pixel, or any third-party advertising trackers.
- We do not build advertising profiles or sell data to third parties.
- We do not use cross-site tracking cookies.
- The SQL Security Sandbox application runs entirely in your browser (SQLite/WASM). No query data, lab results, or exercise progress is transmitted to our servers.
3. How We Use Your Information
- To fulfill your purchase: We use your email address to deliver product access and respond to support requests.
- To communicate with you: We may send transactional emails (receipts, product updates). We do not send unsolicited marketing email without your consent.
- To improve our products: Aggregated, anonymized analytics help us understand which pages are most useful.
- To respond to inquiries: We use contact form data solely to respond to your message.
4. Legal Bases for Processing (GDPR)
If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:
- Contract performance: Processing your email address to deliver your purchase.
- Legitimate interests: Aggregated analytics to improve our website; security logging to protect against abuse.
- Legal obligation: Retaining transaction records as required by applicable law.
5. Third-Party Services
- Gumroad: Payment processing and digital product delivery. Gumroad's privacy policy is available at gumroad.com/privacy. Gumroad is the merchant of record for your purchase.
- Cloudflare: DNS, CDN, and web hosting (Cloudflare Pages). Cloudflare's privacy policy is at cloudflare.com/privacypolicy.
- GitHub: Source code hosting. Used for the free demo at GitHub Pages. GitHub's privacy policy applies to that subdomain.
6. Data Retention
- Purchase records: Retained for 7 years as required for tax and accounting purposes.
- Contact form messages: Retained until your inquiry is resolved, or for up to 2 years.
- Analytics data: Aggregated, anonymized. Cloudflare Web Analytics retains data per their standard retention schedule.
- Browser storage: Retained on your device until you clear your browser data. Under your sole control.
7. Your Rights
Depending on your jurisdiction, you may have the following rights:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate data.
- Deletion: Request deletion of your personal data (subject to legal retention requirements).
- Portability: Receive your data in a structured, machine-readable format.
- Objection: Object to processing based on legitimate interests.
- California residents (CCPA): You have the right to know what personal information we collect, the right to delete it, and the right to opt out of sale. We do not sell personal information.
To exercise any of these rights, contact us at privacy@cosmicsoc.io. We will respond within 30 days.
8. Children's Privacy
Our services are not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately at privacy@cosmicsoc.io.
9. Security
We implement reasonable technical and organizational measures to protect personal information against unauthorized access, loss, or disclosure. The SQL Security Sandbox application itself runs entirely in your browser with no server-side component — your query data never leaves your device.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. Material changes will be communicated via email to customers with active accounts. Continued use of our services after the effective date constitutes acceptance of the updated policy.
11. Contact Us