Privacy.

The short version

Mosaic reconciles data between your business systems. In the self-hosted product that work happens entirely on your own infrastructure: the records you reconcile are never sent to us, and we have no route by which to read them. What we hold is what you hand us directly — an account, a licence, an email — plus ordinary information about visits to this website.

If you use the hosted service that changes, and the section below says how.

Who we are

[Legal entity name], [registered address], registered in [country, company number]. In data protection terms we are the controller for the personal data described here.

For anything in this document, write to privacy@getdatamosaic.com. [If a data protection officer is required, name them here.]

What we collect about you

When you take a licence or create an account

• your name and email address;
• your company, and your role if you tell us;
• the licence issued to you and the tier it is on;
• correspondence with us, including support requests.

We use this to provide the thing you asked for, to support it, and to tell you about changes that affect it. The lawful basis is performance of a contract, and legitimate interest for support and service messages.

When you pay us

Payments are handled by [payment processor]. We receive confirmation and the details needed to raise an invoice. We never see or store your card number.

When you visit this website

Our server records what a web server ordinarily records — the page requested, the time, a network address, the browser reported — and we use it to keep the site up and to see which pages are read.

Visits are counted by DataFast, an analytics service, and only if you agree to it. It sets cookies in your browser so that a returning visit, and the pages within one visit, can be counted as the same visitor, and those cookies are not needed for the site to work — so the first time you visit we ask, and until you accept, DataFast is not loaded and your browser never contacts it. If you decline, it stays that way. When it is loaded, DataFast receives the address of the page, the page that linked to it, the browser and device reported, and your network address, from which it takes a country. We use it to see which pages are read and where visits come from, and for nothing else. Nothing you type into a form on this site is sent to it. [Name the cookies and how long each lasts, from DataFast's own documentation. Confirm against its privacy terms and data processing agreement: how long it keeps this, where it is processed, and whether the network address is stored or only used in passing.]

Visits are also counted by Google Analytics, on the same terms: it is loaded only after you accept, and the same answer covers both. It sets the cookies _ga and _ga_ZGKR1Y335S, which last up to two years, so that a returning browser is counted as the same visitor. It receives the address of the page, the page that linked to it, the browser and device reported, and your network address, which Google uses to estimate a country and does not store. Its advertising features are switched off: Google signals and ad personalisation are disabled, and no advertising cookies are set. Google processes this in the United States, under the EU–US Data Privacy Framework. Nothing you type into a form on this site is sent to it. [Confirm the data retention period set in Google Analytics (Admin → Data retention) and state it here.]

Besides pages, both count a handful of actions, by name only: pressing a button that leads into the product (with the button's label), sending a form here, joining the waiting list, downloading a release, and using the free comparison — whether it ran on the sample or on your own files, never the files, their names or anything in them.

When you create an account, ask for an audit or join the waiting list, we also note where you came to this site from — the name of the site that linked here, such as reddit.com, or a campaign name carried in the link — so that we can see which channels bring people to us. It is a site's name only, never the page you were on. If you have accepted analytics, the first such name is kept in your browser for ninety days, so that it is still known a few pages later; if you have not, nothing is kept, and only the page you are on at that moment is read. The name is stored with your account or request, and used for nothing else.

If we contacted you first

We look for people at retailers who may have the problem Mosaic solves, in public sources only: a press release, a news story or a supplier's case study about your company changing its systems, a review your business wrote of an app, and your company's own website. From those we keep your name, your role, your company, the public page we found it on, a link to your public LinkedIn profile, and your business email address only where your company's own website prints it — never one guessed or bought. We use it to write to you, once, about Mosaic, on the basis of our legitimate interest in telling businesses about a product that fits what they have said publicly. Reply “no” to that email, or write to us, and we stop and keep only what we need to make sure we never write to you again. [How long an uncontacted or unanswered lead is kept, and the balancing test behind the legitimate interest, from the records of processing.]

What we never collect

The point of a self-hosted reconciliation tool is that the data stays where it already is. Mosaic reads your systems from inside your own network. Sales, stock, prices, receipts, customer records, the contents of any source or check — none of it reaches us. We could not produce it if we were asked to, because we do not have it.

What a self-hosted installation does send

One thing, once a day: a licence check-in, containing exactly three items.

• The licence key that installation is running.
• An identifier the installation generated for itself.
• The version number.

No hostname, no network address, no account, no user, and nothing whatever about the data being reconciled. It exists so that a licence issued once cannot quietly run in four companies at the same time.

Nothing in the product waits on it or reads the reply. Reconciliations run, schedules fire and checks publish whether it has ever succeeded — a failure and a success are indistinguishable to everything else.

You can switch it off. There is a control on the Tenancy screen, and setting MOSAIC_CHECKIN=off in the environment stops it across a whole fleet.

The hosted service

[Complete this only if the hosted service is live; delete it otherwise.] On the hosted service your data is processed on our infrastructure and we act as a processor on your instructions. That relationship is governed by a data processing agreement, and the sub-processors involved are listed at [link].

Cookies and third parties

This website sets no advertising cookies. The only cookies it sets for measurement are DataFast's and Google Analytics', described under When you visit this website above, and only once you have accepted them.

Your answer is kept in your browser's local storage — not in a cookie, and with nothing about you beside it: the choice and the date you made it. If you accepted, the name of the site you first arrived from is kept there too, for ninety days, as described above. We ask again after six months. You can change your mind at any time with Cookie settings at the foot of every page; declining after having accepted removes DataFast's and Google's cookies, and that name, from your browser. If your browser sends a Global Privacy Control signal we take that as a no and do not ask. [List anything strictly necessary, such as a session cookie on the sign-in flow.]

Typefaces are currently served by Google Fonts, which means Google receives your browser's network address when a page loads. [Self-hosting the font files removes this transfer entirely; do that and delete this paragraph.]

Who else sees it

Service providers who help us run the business — hosting, email, payments, support tooling — and only what each of them needs. They act on our instructions. We do not sell personal data and we do not share it for advertising. Today they are:

• Vercel — hosts this website and runs its support and audit forms, so what you type into a form passes through it.
• Resend — delivers the email those forms send us.
• Supabase — the database behind the waiting list, the accounts and licences of the hosted service, and the emails that confirm an address or sign you in.
• Railway — runs the hosted service and the service that issues licences.
• DataFast — counts visits to this website, only if you accept its cookies.
• Google Analytics — also counts visits to this website, on the same consent, with its advertising features switched off.
• Serper — runs web searches for our own team, to find public forum posts where somebody is asking about the problem Mosaic solves, and public news about retailers changing their systems. It sees our search terms, not your data.
• Anthropic — reads those public posts and pages, as our team’s assistant, to suggest which are worth answering and to draft the first email to a person we found. It never sees customer data. If you connect an AI provider to Mosaic yourself, that is your provider, under your account.
• Google Fonts — serves this site's typefaces, as described under cookies above.
• [payment processor] — once payments start.

None of them sees the data a self-hosted installation reconciles, because none of it reaches us.

Where it goes

[Name the countries data is stored and processed in.] Where personal data leaves the European Economic Area, transfers rely on an adequacy decision or on Standard Contractual Clauses.

How long we keep it

• Account and licence records: for as long as the account exists, then [period].
• Invoices and payment records: as long as tax law requires, typically [period].
• Support correspondence: [period].
• Server logs: [period].

Your rights

You can ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, ask for it in a portable form, and object to anything we base on legitimate interest. Where we rely on consent, you can withdraw it at any time.

If you have an account on Mosaic, two of these you can do yourself, straight away: under Settings → Account, Download my data gives you a copy of what we hold about your account, and Delete account deletes it.

Write to privacy@getdatamosaic.com and we will answer within a month. If you are not satisfied you can complain to your national data protection authority — in [country] that is [authority and link].

Changes

If we change this policy we will update the date at the top, and where the change is significant we will tell account holders directly rather than leave it to be noticed.