Legal
Privacy Policy
CosmiComply is a SaaS platform operated by ML Cosmetic Science Consulting AB.
| Field | Details |
|---|---|
| Organisation | ML Cosmetic Science Consulting AB |
| Org. no. | 559399-9252 |
| Registered | Sweden (2022-10-04) |
| Address | Surbrunnsgatan 37, 113 48 Stockholm, Sweden |
| Contact | hello@cosmicomply.com |
| Last updated | 14 August 2026 |
1. Who we are
ML Cosmetic Science Consulting AB (“we,” “us,” “ML,” operating the CosmiComply platform) is a Swedish limited company (aktiebolag) and the data controller — and, for content you submit to the platform, in most cases the data processor — responsible for personal data under the EU General Data Protection Regulation (GDPR) and the Swedish Data Protection Act (Dataskyddslagen).
If you have questions about this policy or how we handle your data, contact us at hello@cosmicomply.com.
2. Our role: controller vs. processor
Because CosmiComply is a self-serve SaaS platform rather than a bespoke advisory engagement, your role and ours differ depending on the data type:
- As controller, we determine the purpose and means of processing your account and billing data (name, email, company, payment records, usage logs). This Privacy Policy governs that data.
- As processor, when you upload ingredient lists, formulas, PIFs, or other product data into the platform on behalf of your business, you (the client) are the controller of that data, and we process it strictly on your instructions under our Data Processing Agreement (DPA) — see Section 9.
3. What data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email, company, job title, login credentials | You, at signup |
| Platform content (client-controlled) | Ingredient lists, product formulas, INCI names, PIF documents, compliance check submissions | You, uploaded to the platform |
| Payment information | Billing name, address, subscription tier, transaction history (card details handled by our payment processor) | You, via our payment processor |
| Usage / product data | Login times, features used, in-app actions, support tickets | Automatically, via the platform |
| Website usage data | IP address, browser type, pages visited, referral source, session recordings / heatmaps (Microsoft Clarity, where you consent) | Automatically, via cookies / analytics — see our Cookie Policy |
| Communications | Support emails, onboarding calls, chat messages | You, directly |
We do not knowingly collect special category data (e.g. health data about identifiable people). Ingredient lists and formulas relate to products, not individuals — please avoid including personal or health data in any upload.
4. Why we process your data (legal basis)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the CosmiComply platform and its features (account, dashboard, compliance checks) | Performance of a contract — Art. 6(1)(b) |
| Processing client-uploaded formula / ingredient data | Performed under instruction as processor, per our DPA with each client |
| Responding to support enquiries | Legitimate interests — Art. 6(1)(f) |
| Sending product updates or marketing emails | Consent — Art. 6(1)(a) — withdrawable anytime |
| Website analytics and advertising cookies | Consent, via our cookie banner |
| Complying with tax, accounting, and invoicing law | Legal obligation — Art. 6(1)(c) |
| Improving and securing the platform | Legitimate interests, balanced against your rights |
5. How long we keep your data
| Data type | Retention period |
|---|---|
| Account data | Duration of your subscription, then a reasonable period after closure for account recovery and dispute handling |
| Client-uploaded formulas / ingredient lists | Duration of your subscription; deleted or returned within a reasonable period after account closure per our DPA, unless you request earlier deletion |
| Free compliance check submissions (no account) | Typically up to 90 days, then deleted or anonymised |
| Billing / invoicing records | 7 years (Swedish Bookkeeping Act requirement) |
| Marketing contact list | Until you unsubscribe or after prolonged inactivity |
| Website analytics data | Per each analytics tool’s default retention, subject to your cookie choices |
6. Who we share data with
We use categories of subprocessors / recipients, each bound by a data processing agreement (see also Section 10):
- Hosting / infrastructure — application and database hosting
- Cloud storage — uploaded formulas and compliance documents
- Payment processor — subscription billing
- Email / CRM — transactional and (with consent) marketing email, including Omnisend where you have opted in
- Support tools — where used for customer support
- Analytics / advertising — e.g. Google Analytics / Search Console, Microsoft Clarity, LinkedIn Insight Tag, Meta Pixel — only where you consent via our cookie banner; see our Cookie Policy. Clarity session recordings are also subject to the Microsoft Clarity Terms of Use
- Legal / regulatory authorities — where required by law
We do not sell personal data. We do not share client formulas or ingredient lists with other clients or unrelated third parties.
International transfers
Some subprocessors may process data outside the EU/EEA (e.g. in the US). Where this occurs, we rely on EU Standard Contractual Clauses, an adequacy decision, or another approved safeguard, as required by GDPR Chapter V.
7. Your rights
Under GDPR you have the right to:
- Access your data
- Correct inaccuracies
- Request deletion
- Restrict or object to processing
- Data portability
- Withdraw consent at any time
You may also lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or your local EU data protection authority.
To exercise these rights, contact hello@cosmicomply.com. We respond within one month as required by law.
Where you are our client’s end user and we act only as processor, we will direct your request to the relevant client (controller) unless you contact us with an account-level request.
8. Security
We use appropriate technical and organisational measures — including encryption in transit and at rest, and access controls — to protect account data and uploaded formulas against unauthorised access, loss, or disclosure. See our DPA for the full security commitments made to business clients.
9. Data Processing Agreement (DPA)
Business clients uploading product / formula data to the platform are covered by our standard DPA, incorporated by reference into our Terms of Service.
Contact hello@cosmicomply.com to request a signed copy for your records.
10. Subprocessor list
An up-to-date list of subprocessors is available on request. We will notify clients of material changes to this list per the notice period in our DPA.
11. Cookies
See our full Cookie Policy for details on cookies and how to manage your preferences.
12. Changes to this policy
We may update this policy periodically. The “Last updated” date at the top reflects the latest version. Material changes will be communicated via email, in-app notice, and/or a website banner where appropriate.
13. Contact
ML Cosmetic Science Consulting AB
Surbrunnsgatan 37, 113 48 Stockholm, Sweden
Org. no. 559399-9252
Email: hello@cosmicomply.com
© 2026 CosmiComply. Questions? Contact us.