Legal
Privacy and Cookies Policy
At Mosaico Limited ("Mosaico," "we," "our," or "us"), we are committed to safeguarding your privacy. This Privacy Policy explains how we collect, use, and share personal information in connection with our methodology commercialisation and delivery platform ("the Service") and outlines your rights regarding your data. By using the Service, you agree to the terms of this Privacy Policy.
1. Information We Collect
1.1 Account Information
When you register for the Service, we collect the following information:
- Email Address: Used for account identification and login.
- Password: Hashed and never stored in plain text.
- First Name and Last Name: Used for personalization and communication.
1.2 Profile Information
You or your organization administrator may provide additional profile information, including:
- Contact details: phone number, work phone, address, city, state, postal code, country.
- Emergency contact information.
- Profile photo/avatar.
- Demographic information: gender, nationality, date of birth (when provided).
- Employment details: position, team assignments, member ID, hire date.
1.3 Organization Data
Your organization enters data into the Service, including:
- Process configurations: task structures, field definitions, process templates.
- Progress records: task completion status, field responses, due dates.
- Capabilities and skills: proficiency levels per employee.
- Compliance records: certification types, issue dates, expiry dates.
- Team structures and position definitions.
1.4 Uploaded Documents
Organizations can upload documents (policies, handbooks, reference materials) for use as AI context. These documents are stored securely and processed by our AI features to answer user queries.
1.5 Third-Party Integration Data
When connecting Microsoft 365: employee directory data (names, emails, phone numbers, addresses, employee IDs, hire dates) is fetched from your Microsoft tenant. Data is synced only when an authorized administrator initiates the sync. Field mapping is customizable — you control what data is imported.
1.6 Usage Data
We collect data on your interactions with the Service, including:
- Login times.
- Features and functionalities used.
- IP address and browser type.
This data helps us improve the functionality and user experience of the Service.
1.7 Payment Information
All payment transactions are processed securely through Stripe. We do not store credit card or other sensitive payment information on our servers.
1.8 Cookies and Pixels
We use cookies and similar technologies, such as Google Analytics, Google Ads tracking, and LinkedIn pixels, to:
- Analyze website traffic and user behavior.
- Enhance user experience.
- Deliver targeted advertisements.
Please refer to our Cookies Policy section below for additional details.
2. AI Data Processing
2.1 How AI Uses Your Data
Mosaico uses artificial intelligence to provide insights, recommendations, charts, and chat-based assistance. AI processes: organization employee data, team structures, process progress, capability/compliance records, and uploaded documents. All AI processing runs on Mosaico's own infrastructure hosted on AWS. Your data is never sent to third-party AI providers. Your data is never used to train or fine-tune AI models.
2.2 AI Data Retention
AI request and response data may be retained by Mosaico for the purposes of monitoring accuracy, improving response quality, and tracking system performance. This data is not used to train AI models and is not shared with any third party.
2.3 AI Data Scope
AI features only access data within your organization — no cross-organization data sharing. The specific data provided to AI depends on the feature: team data for team insights, process data for process insights, uploaded documents for knowledge queries. AI responses may reference NZ and AU employment law. These references are for general informational purposes only and do not constitute legal advice.
2.4 AI Is Integral to the Service
AI features are a core part of the Service and cannot be disabled independently. By using Mosaico, you consent to AI processing of your organization's data as described in this policy. If you do not wish your data to be processed by AI, you should not use the Service.
3. How We Use Your Information
3.1 Service Delivery and Improvement
We use your personal information to:
- Provide, maintain, and improve the Service.
- Respond to support inquiries.
- Send important communications about your account, such as subscription renewals or updates.
3.2 Analytics
We use aggregated and anonymized data for analytical purposes to:
- Identify trends.
- Enhance the Service's performance and usability.
3.3 Advertising
We use third-party advertising platforms, including Google Ads and LinkedIn, to:
- Deliver personalized ads based on your interactions with our website and Service.
- Measure the effectiveness of advertising campaigns.
3.4 Compliance and Legal Obligations
We may use your information to:
- Comply with legal obligations.
- Enforce our Terms of Service.
- Protect the rights and safety of Mosaico, our users, and others.
4. Data Storage and Security
4.1 Data Storage
Your data is stored on secure servers hosted by Amazon Web Services (AWS) in the Australia region (ap-southeast-2).
4.2 Security Measures
We employ industry-standard security measures to protect your information, including:
- Encryption at rest and in transit.
- OAuth tokens encrypted using AES-256-GCM.
- Authentication managed through AWS Cognito with HTTP-only cookies.
- Regular security audits.
- Role-based access controls.
5. Sharing of Information
We do not sell your personal information. However, we may share your information with:
- Service Providers: Stripe (payment processing), AWS (hosting, authentication via Cognito, email via SES, storage via S3, database via DynamoDB, AI compute infrastructure).
- Microsoft 365: When integration is configured by your administrator, data flows from Microsoft to Mosaico to sync your employee directory.
- Analytics and Marketing: Google Analytics, Google Ads, LinkedIn for website analytics and advertising.
- Legal Authorities: If required by law or to protect our legal rights.
- Business Transfers: In the event of a merger, acquisition, or sale of assets.
Note: AI processing runs entirely on Mosaico's own AWS infrastructure — no data is shared with third-party AI providers.
6. Data Controller and Processor
6.1 Mosaico as Data Controller
We act as the data controller for: account data, usage data, and payment data.
6.2 Mosaico as Data Processor
We act as the data processor for: organization employee data, process data, and compliance/capability data — processed on behalf of the organization.
6.3 Organization Responsibilities
The organization administrator is responsible for ensuring they have lawful basis to enter employee data into Mosaico, and for the accuracy of that data.
7. Your Rights
Under the New Zealand Privacy Act 2020 and Australian Privacy Act 1988, you have the right to:
- Access, update, or delete your personal information.
- Request deletion of AI-related data.
- Opt out of targeted advertising by adjusting your cookie preferences or using tools provided by Google Ads and LinkedIn.
- Withdraw consent for data processing, where applicable.
Note: AI processing cannot be disabled independently — it is integral to the Service. Users who do not wish their data processed by AI should not use the Service (see Section 2.4 above).
To exercise these rights, please contact us at hello@mosaico.one.
8. Cookies Policy
Introduction
We use cookies to enhance your experience and support our marketing efforts. This Cookies Policy explains how we use cookies and similar technologies.
8.1 What Are Cookies?
Cookies are small text files placed on your device to store data. They allow us to recognize your browser and remember your preferences.
8.2 Types of Cookies We Use
- Essential Cookies: Necessary for the operation of our website.
- Performance Cookies: Help us understand how users interact with our website (e.g., via Google Analytics).
- Marketing Cookies: Used to deliver targeted advertisements and measure their effectiveness (e.g., Google Ads tracking and LinkedIn pixels).
8.3 Managing Cookies
You can manage or disable cookies through your browser settings. Note that disabling cookies may affect the functionality of the Service.
8.4 Third-Party Tools
We use the following tools to track website usage and deliver advertisements:
- Google Analytics: Tracks website traffic and user behavior.
- Google Ads Tracking: Measures the effectiveness of ads and retargets users.
- LinkedIn Pixels: Enables targeted advertising and performance measurement on LinkedIn.
For more information about these tools, please visit their respective privacy policies.
9. Changes to This Policy
We may update this Privacy and Cookies Policy from time to time. Changes will be posted on this page, and we will notify you of significant updates. Please review this page periodically to stay informed.
10. Contact Us
If you have questions or concerns about this Privacy and Cookies Policy, please contact us at hello@mosaico.one.