Privacy Policy

1. Data Controller

MOZAIC Core is operated by MOZAIC FRANQUICIAS Y FORMACION SL (NIF: B06996706), registered in Málaga, Spain (C/ Miguel Sel Gomez de la Cruz 24, 29000 Málaga). For data protection enquiries, please contact us at privacy@mozaiccore.com.

2. Scope of This Policy

This policy explains how MOZAIC Core handles personal data across two contexts: visitors who submit a demo-access request on our public website, and organisations and their team members, clients, and contacts whose data is processed through the platform once an organisation becomes an active subscriber. Each organisation using MOZAIC Core is separately responsible for its own compliance obligations toward its own clients and end customers.

3. What Data We Collect

Depending on how you interact with MOZAIC Core, we may collect:

• Demo-request data — your name, email address, agency or firm name, team size, and stated interest, submitted via our public access-request form
• Organisation and team member data — names, email addresses, roles, and login credentials for an active subscriber's team
• Client, lead, and case records — information your organisation enters about its own clients, leads, buyers, or cases
• Documents and uploads — files shared through the platform's document-sharing features
• AI-generated content — captions, follow-up suggestions, or other content generated using the platform's AI features, where enabled
• Billing and subscription data — processed by Stripe on our behalf, including payment method details, invoices, and subscription status
• Platform usage data — technical logs needed to operate, secure, and improve the service
• Cookies and similar technologies — see Section 11 below

4. How We Use Your Data

We use this data to operate the platform, provide the features an organisation has subscribed to, process payments, communicate with you about your account, maintain security, and comply with our own legal obligations. We do not sell personal data, and we do not use tenant client data for our own marketing purposes.

5. Lawful Basis

Processing of demo-request data is based on your consent (submitting the form) and our legitimate interest in operating an invite-only platform. Processing of an active subscriber organisation's operational data is based on the performance of our contract with that organisation, alongside our legitimate interest in providing and securing the service. Where consent is the basis, you may withdraw it at any time by contacting us at the address in Section 1.

6. Subprocessors

We use the following subprocessors to operate MOZAIC Core:

• Stripe — payment processing and subscription billing
• Supabase — primary database and file storage
• Vercel — application hosting
• Hostinger — transactional email delivery (SMTP)
• DeepL — runtime translation of platform content, where used
• Anthropic — the platform's own AI assistants (the marketing chatbot and authenticated platform help chatbot). AI features used by tenant organisations themselves, such as caption generation, instead use each organisation's own API key, not ours

7. International Transfers

Some of our subprocessors may process data outside the European Economic Area. Where this occurs, we rely on appropriate safeguards recognised under GDPR, such as Standard Contractual Clauses, to the extent applicable.

8. Data Retention

Demo-request data is retained for a maximum of 12 months. If your request is approved and you become a platform user, your organisation's operational data is retained for the duration of your organisation's active subscription and deleted within 30 days of account closure, subject to any longer retention required for billing, accounting, or legal record-keeping purposes.

9. Multi-Tenant Data Isolation

MOZAIC Core is a multi-tenant platform. Each organisation's data — including agents, buyers, leads, properties, and documents — is completely isolated from all other tenants at the application layer. Private documents are accessed via signed, time-limited URLs.

10. EU Hosting & GDPR

MOZAIC Core infrastructure is hosted on Supabase and Vercel, with data processed in the EU. We follow GDPR data minimisation principles throughout the platform. Tenant organisations using MOZAIC Core are responsible for ensuring their own use of the platform complies with applicable data protection law.

11. Cookies

We use a cookie consent banner to request your permission before loading non-essential cookies, including analytics (Google Analytics 4) and advertising (Meta Pixel) tools. These tools only run after you accept them. Strictly necessary cookies, needed for the platform to function (such as session and login cookies), do not require consent.

12. Your Rights

Under GDPR, you have the right to access, correct, or request deletion of your personal data. To exercise these rights, contact us at privacy@mozaiccore.com. We will respond within 30 days.

13. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of the platform after changes constitutes acceptance of the updated policy.

14. Contact

For questions about this privacy policy, contact us at privacy@mozaiccore.com.