Privacy Policy

1. Introduction

Cozy Sleep Systems Corp. ("Cozy," "we," "us," or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our website at cozysleepsystem.com, use the Breathe by Cozy™ application, purchase or pre-order our products, or participate in our research programs.

By accessing our services, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of our services.

2. Information We Collect

2.1 Information You Provide

• Account and Contact Information: Name, email address, shipping address, and phone number when you create an account, place a pre-order, or join our waitlist.
• Payment Information: Credit card numbers, billing addresses, and transaction details processed through Stripe and PayPal. We do not store full payment card numbers on our servers.
• Communications: Information you provide when contacting customer support or responding to surveys.

2.2 Information Collected Automatically

• Device and Sleep Data: When using the Somnara Aura™ Pro and Breathe by Cozy™ app, we collect sleep stage data (via Cozy EchoLoom™ Radar), environmental readings (air quality, temperature, humidity), audio preferences, and DawnLoom™ wake settings.
• Usage Data: Browser type, IP address, pages visited, time spent on pages, and referring URLs.
• Cookies and Tracking: We use essential cookies for session management and analytics cookies to understand site usage. You may disable non-essential cookies through your browser settings.

2.3 Research Participation Data

If you opt into the Clarity by Cozy™ Research Marketplace, we collect anonymized and de-identified sleep data as described in Section 6 below. Research data is governed by additional protections and is always voluntary.

3. How We Use Your Information

• To process and fulfill your pre-orders, subscriptions, and purchases
• To personalize your sleep experience through the Breathe by Cozy™ app
• To provide Clarity by Cozy™ predictive diagnostics and adaptive audio
• To send transactional emails (order confirmations, shipping updates) via Resend
• To send marketing communications if you have opted in (waitlist, product announcements)
• To improve our products, services, and website through aggregated analytics
• To comply with legal obligations and protect against fraud

4. Payment Processing

We use Stripe and PayPal as our payment processors. When you make a purchase, your payment information is transmitted directly to these processors via encrypted connections. We do not store, process, or have access to your full credit card number.

Both Stripe and PayPal are PCI DSS Level 1 certified — the highest level of payment security certification. For more information, see Stripe's Privacy Policy and PayPal's Privacy Policy.

5. Data Sharing and Third Parties

We do not sell your personal information. We share data only with:

• Payment Processors: Stripe and PayPal for transaction processing
• Email Service: Resend for transactional and marketing email delivery
• Analytics: Aggregated, non-identifying usage data for product improvement
• Research Partners: Only de-identified data, only with your explicit opt-in consent, and only under the protections described in Section 6
• Legal Requirements: When required by law, court order, or governmental authority

6. HIPAA Compliance and Research Data Protections

Cozy Sleep Systems takes the protection of health-related data with the utmost seriousness. While consumer sleep wellness data is not automatically classified as Protected Health Information (PHI) under HIPAA, we voluntarily adopt HIPAA-grade protections for all sleep and health data collected through our platform:

• Business Associate Agreements (BAAs): All third-party data custodians who process sleep or health data on our behalf are bound by executed BAAs that contractually require HIPAA-level safeguards.
• Safe Harbor De-Identification: Research data is de-identified in accordance with the HIPAA Safe Harbor method (45 CFR §164.514(b)), removing all 18 categories of identifiers before any data leaves our secure environment.
• SOC 2 Type II Custodians: All data processing and storage partners maintain current SOC 2 Type II certification, ensuring continuous monitoring of security controls.
• IRB Oversight: All research studies conducted through the Clarity by Cozy™ Research Marketplace are subject to Institutional Review Board (IRB) approval before participant enrollment begins.
• Informed Consent: Research participation requires explicit, informed consent. You will be presented with a clear description of what data is collected, how it will be used, who will access it, and for how long.
• Right to Withdraw: You may withdraw from any research program at any time, for any reason, without penalty. Upon withdrawal, your data contribution is removed from future analyses within 30 days.
• Encryption: All health and sleep data is encrypted in transit (TLS 1.3) and at rest (AES-256).

7. Data Retention

• Account Data: Retained for the duration of your account plus 3 years after deletion request
• Sleep History: Up to 1,600 nights of sleep data retained in your personal profile; you may delete at any time
• Payment Records: Transaction records retained for 7 years as required by tax and financial regulations
• Research Data: De-identified research contributions are retained for the duration of the study plus 5 years for reproducibility, unless you exercise your right to withdraw
• Marketing Data: Waitlist and newsletter subscriptions retained until you unsubscribe

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information
• Object to or restrict processing of your data
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent for marketing communications at any time
• Opt out of research participation at any time without penalty

To exercise any of these rights, contact us at privacy@cozysleepsystem.com. We will respond within 30 days.

9. Children's Privacy

The Somnara Aura™ Pro may be used as an air purifier in a child's room. Our website and services are not directed at children under 13. We do not knowingly collect personal information from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. For significant changes affecting your rights, we will provide notice via email to the address associated with your account.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact: