Privacy.

The short version

Mosaic reconciles data between your business systems. In the self-hosted product that work happens entirely on your own infrastructure: the records you reconcile are never sent to us, and we have no route by which to read them. What we hold is what you hand us directly — an account, a licence, an email — plus ordinary information about visits to this website.

The hosted service, Mosaic Cloud, is there to try Mosaic on a demo retailer and sample files, and the section on it below says what that means for anything you put in it.

Who we are

DataMosaic, Corso Italia 35, 20821 Meda (MB), registered in Italy. In data protection terms we are the controller for the personal data described here.

For anything in this document, write to privacy@getdatamosaic.com.

What we collect about you

When you take a licence or create an account

• your name and email address;
• your company, and your role if you tell us;
• the licence issued to you and the tier it is on;
• correspondence with us, including support requests.

We use this to provide the thing you asked for, to support it, and to tell you about changes that affect it. The lawful basis is performance of a contract, and legitimate interest for support and service messages.

When you take a scorecard

We ask for your name, your work email and, on some scorecards, your company, and we keep them with your answers and your score. We use them to email you your report and to follow it up ourselves. If you tick the box, we also send a short note now and then, and you can unsubscribe from it at any time. The lawful basis is your request for the report, and your consent for the notes.

When you pay us

Payments are handled by Stripe. We receive confirmation and the details needed to raise an invoice. We never see or store your card number: Stripe holds it, under its own privacy policy as a separate controller for its payment and fraud checks.

When you visit this website

Our server records what a web server ordinarily records — the page requested, the time, a network address, the browser reported — and we use it to keep the site up and to see which pages are read.

Visits are counted by Google Analytics, and only if you agree to it. It sets cookies in your browser so that a returning visit, and the pages within one visit, can be counted as the same visitor, and those cookies are not needed for the site to work — so the first time you visit we ask, and until you accept, Google Analytics is not loaded and your browser never contacts it. If you decline, it stays that way. The cookies are _ga and _ga_ZGKR1Y335S, which last up to two years. When it is loaded, it receives the address of the page, the page that linked to it, the browser and device reported, and your network address, which Google uses to estimate a country and does not store. Its advertising features are switched off: Google signals and ad personalisation are disabled, and no advertising cookies are set. Google keeps the event data for two months, its standard setting, and then deletes it; what is left after that is counts with nobody in them. Google processes this in the United States, under the EU–US Data Privacy Framework. We use it to see which pages are read and where visits come from, and for nothing else. Nothing you type into a form on this site is sent to it.

Besides pages, it counts a handful of actions, by name only: pressing a button that leads into the product (with the button's label), following a link from a blog post to a demo, the product or a download (with which link, and on which post), starting a scorecard (with which one), checking files with a free tool (with whether they were your own files or the example, never what was in them), sending a form here, joining the waiting list, and downloading a release.

The free tools, such as the Italian eInvoice Verifier, read the files you give them in your browser. The files are not sent to us or to anyone else, nothing in them is recorded, and they are gone when you close the page.

When you create an account, ask for an audit, take a scorecard or join the waiting list, we also note where you came to this site from — the name of the site that linked here, such as reddit.com, or a campaign name carried in the link — so that we can see which channels bring people to us. It is a site's name only, never the page you were on. If you have accepted analytics, the first such name is kept in your browser for ninety days, so that it is still known a few pages later; if you have not, nothing is kept, and only the page you are on at that moment is read. The name is stored with your account or request, and used for nothing else.

If we contacted you first

We look for the people who look after retailers' systems — IT managers at retailers, and the IT support businesses and systems integrators that serve them — who may have the problem Mosaic solves, in public sources only: a press release, a news story or a case study about your company's systems or its work for retailers, a review your business wrote of an app, your company's own website, and the public part of your LinkedIn profile, which is where we may have found your name and role. From those we keep your name, your role, your company, the public page we found it on, a link to your public LinkedIn profile, and your business email address only where your company's own website prints it (for an IT support business or an integrator, its general inbox, where it prints no address of yours) — never one guessed or bought. We use it to write to you, once, about Mosaic, on the basis of our legitimate interest in telling businesses about a product that fits what they have said publicly. Reply “no” to that email, or write to us, and we stop and keep only what we need to make sure we never write to you again.

If you never reply, we delete what we hold about you six months after we found it, and we write once, not as a sequence. We weighed that use against your interests before starting: it is business information about your work, taken only from places it was published so that people would read it, used for one email about a product in your field, and easy to stop with one word — and nothing about you is sold, shared or combined with anything bought. A person who asked us to stop is kept only as a name and address on a do-not-contact list, for as long as we look for people at all, so that they are never written to again.

What we never collect

The point of a self-hosted reconciliation tool is that the data stays where it already is. Mosaic reads your systems from inside your own network. Sales, stock, prices, receipts, customer records, the contents of any source or check — none of it reaches us. We could not produce it if we were asked to, because we do not have it.

What a self-hosted installation does send

One thing, once a day: a licence check-in, containing exactly three items.

• The licence key that installation is running.
• An identifier the installation generated for itself.
• The version number.

No hostname, no network address, no account, no user, and nothing whatever about the data being reconciled. It exists so that a licence issued once cannot quietly run in four companies at the same time.

Nothing in the product waits on it or reads the reply. Reconciliations run, schedules fire and checks publish whether it has ever succeeded — a failure and a success are indistinguishable to everything else.

You can switch it off. There is a control on the Tenancy screen, and setting MOSAIC_CHECKIN=off in the environment stops it across a whole fleet.

The hosted service

Mosaic Cloud is for trying Mosaic and seeing it work: on the demo retailer that comes with every workspace, or on sample files and exports you choose to upload. It is not offered for running your business's live reconciliations, and we ask you not to put personal data you are responsible for into it.

For your account there — your name, email, sign-in and settings — we are the controller, as described above. For anything you put into a workspace, we act only as a processor on your instructions: we store it so the workspace works, we never look at it except to fix a problem you have asked us about, and it is deleted when you delete it, the workspace or your account. On request we will sign a data processing agreement for it. The sub-processors involved are Supabase, which holds the database, and Railway, which runs the service; both are listed under Who else sees it below.

Cookies and third parties

This website sets no advertising cookies. The only cookies it sets are Google Analytics', described under When you visit this website above, and only once you have accepted them.

Your answer is kept in your browser's local storage — not in a cookie, and with nothing about you beside it: the choice and the date you made it. If you accepted, the name of the site you first arrived from is kept there too, for ninety days, as described above. We ask again after six months. You can change your mind at any time with Cookie settings at the foot of every page; declining after having accepted removes Google's cookies, and that name, from your browser. If your browser sends a Global Privacy Control signal we take that as a no and do not ask.

The typefaces are served from this site itself, so loading a page contacts nobody but us.

Who else sees it

Service providers who help us run the business — hosting, email, payments, support tooling — and only what each of them needs. They act on our instructions. We do not sell personal data and we do not share it for advertising. Today they are:

• Vercel — hosts this website and runs its support and audit forms, so what you type into a form passes through it.
• Resend — delivers the email those forms send us.
• Calendly — takes demo bookings. Book a demo takes you to its page, where the name, email and time you give it are kept by Calendly and sent to us.
• Supabase — the database behind the waiting list, the accounts and licences of the hosted service, and the emails that confirm an address or sign you in.
• Railway — runs the hosted service and the service that issues licences.
• Google Analytics — counts visits to this website, only if you accept its cookies, with its advertising features switched off.
• Serper — runs web searches for our own team, to find public forum posts where somebody is asking about the problem Mosaic solves, and public news about retailers changing their systems. It sees our search terms, not your data.
• Anthropic — reads those public posts and pages, as our team’s assistant, to suggest which are worth answering and to draft the first email to a person we found. It never sees customer data. If you connect an AI provider to Mosaic yourself, that is your provider, under your account.
• Stripe — takes payments, once paid plans start.

None of them sees the data a self-hosted installation reconciles, because none of it reaches us.

Where it goes

We are in Italy, and the database behind accounts, licences and the waiting list is kept by Supabase. Most of the providers above — Supabase, Vercel, Resend, Calendly, Railway, Google, Anthropic and Stripe among them — are based in the United States, or reach data from there to run and support their service. Where personal data leaves the European Economic Area, the transfer relies on the EU–US Data Privacy Framework where the provider is certified under it, and on the European Commission's Standard Contractual Clauses where it is not.

How long we keep it

• Your account: for as long as it exists. Deleting it removes it at once; sign-in sessions expire after 30 days in any case.
• Licence and contract records: for the life of the licence, then 10 years — the period within which a claim under a contract can be brought in Italy.
• Invoices and payment records: 10 years, as Italian law requires of business records.
• Support correspondence and form messages: 24 months after the last exchange; for a customer, the length of the contract and 12 months after.
• People we wrote to first: six months if there is no reply, as described above.
• Website analytics: two months in Google Analytics; your cookie answer is kept in your browser and asked again after six months.
• Server logs: 30 days at most, then deleted by the hosting provider.

Your rights

You can ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, ask for it in a portable form, and object to anything we base on legitimate interest. Where we rely on consent, you can withdraw it at any time.

If you have an account on Mosaic, two of these you can do yourself, straight away: under Settings → Account, Download my data gives you a copy of what we hold about your account, and Delete account deletes it.

Write to privacy@getdatamosaic.com and we will answer within a month. If you are not satisfied, you have the right to complain to a data protection authority.

Changes

If we change this policy we will update the date at the top, and where the change is significant we will tell account holders directly rather than leave it to be noticed.