Privacy Notice
What personal data Mosaikin holds, why, for how long, and the rights you have over it — including if you appear in a photo but never used the service.
With our lawyers
This document is with our lawyers for final review. Still to be confirmed: the effective date.
The legal pages are published as one set, so every page carries this notice until the last detail is confirmed. Anything this page quotes that is still outstanding is marked below.
If you need any of it now, email hello@mosaikin.app and we will tell you.
Who we are. Mosaikin is operated by Strict Mode Ltd, a company registered in England and Wales (company number 14561751, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ). We are the data controller for all personal data processed on Mosaikin and are registered with the Information Commissioner’s Office under number ZC188154.
Contact: hello@mosaikin.app (privacy requests: see section 9).
This notice covers three groups of people: hosts (account holders), guests (people who contribute to an event without an account), and — because event photos depict real people — people who appear in content but never use Mosaikin (section 8).
1. What we collect
| From | Data |
|---|---|
| Hosts | Email, name, sign-in identity (via Supabase, including Google sign-in where used), events you create (name, date, optional location), plan and payment linkage (Stripe references — we never see full card details), settings, and the IP addresses you register and sign in from (section 5). |
| Guests | The photos you upload, optional caption and display name, guestbook messages (public and host-only), the event you contributed to, and the IP address (and, where available, the port) each photo or message was sent from (section 5). Guests do not create accounts; a temporary session token links your visit. |
| Buyers of printed products | The delivery name and address and the email you give at checkout (collected by Stripe), what you ordered and the design printed, the order’s status, and the parcel’s tracking. We do not collect a phone number. |
| Everyone | Technical data needed to run and secure the service: IP address, device and browser type, access timestamps, and security-check results (Cloudflare Turnstile). Our audit log records administrative and safety actions. |
| Content itself | Photos may incidentally reveal things about people in them. Location metadata (EXIF/GPS) is stripped from photos before any servable copy exists. |
We do not use facial recognition, build biometric profiles, sell personal data, or serve third-party advertising.
2. Why we process it (lawful bases)
| Processing | Basis (UK GDPR Article 6) |
|---|---|
| Operating host accounts and events | Contract (6(1)(b)) |
| Guest contributions (photos, guestbook) | Consent (6(1)(a)) — captured at the point of contribution, before you submit; withdrawable at any time (section 9) |
| Payments and billing records | Contract and legal obligation (tax and accounting) |
| Making and delivering printed products you order | Contract (6(1)(b)) |
| Security, fraud and abuse prevention (IP logging, Turnstile, audit trail) | Legitimate interests (6(1)(f)) — keeping the service and its users safe |
| Content safety checks and moderation | Legitimate interests and legal obligation — Online Safety Act 2023 duties |
| Reporting child sexual abuse content to the National Crime Agency, including preserving specified evidence | Legal obligation (SI 2026/268) |
| Precise event location (if a host adds one) | Consent |
Photos and free-text messages may incidentally reveal special-category data (for example religion or health). We do not seek or use it; where it arises, the processing rests on the contributor’s explicit consent at upload and the content-safety measures above.
3. Safety checks before anything appears
Every photo and guestbook entry is scanned automatically before it can appear. Uncertain content goes to the host for human review — automated checks alone never publish or permanently reject a contribution; blocked content is quarantined and, where the law requires, reported (section 2). No decision producing legal or similarly significant effects is taken solely by automation.
The provider that performs these checks is Google Cloud Vision and Natural Language, listed with our other processors in section 4.
4. Who receives data (processors)
| Processor | Role | Location |
|---|---|---|
| Supabase | Host sign-in identities | London (eu-west-2) |
| Google Cloud | Running the service, storing photos, and checking content before it can appear | London (europe-west2) |
| Stripe | Payments, and collecting the delivery address and email for printed orders | EU, UK and US (Stripe’s own controller notice applies to card data) |
| Cloudflare (Turnstile) | Bot protection | Global edge |
| Resend | Sign-in emails (sign-up confirmations, sign-in links, password resets, email-address changes and invitations), account, event and order emails | Ireland (eu-west-1) |
Each sits under a data-processing agreement (UK GDPR Article 28). Where a processor stores data outside the UK, transfers rely on the UK International Data Transfer Agreement or Addendum, or on an adequacy decision.
We disclose personal data to public authorities only where the law requires — including mandatory reports of child sexual abuse content to the National Crime Agency, which include specified user data (SI 2026/268, Schedule 1).
5. How long we keep it
| Data | Retention |
|---|---|
| Content on a free event | Lifetime of the event plus a grace period of six months, then permanently deleted |
| Content on a paid keepsake event | Until the host deletes it or closes the account — permanence is the product |
| Host account | Until you close it; dormant accounts (24 months without login) are deleted after notice |
| Guest session tokens | Expire automatically, within hours |
| The IP address and port recorded with each photo or guestbook entry | Twelve months after it was uploaded, then cleared. Where our safety checks blocked the content, it is kept with the record of that content as evidence for a report (the last row) |
| The IP addresses a host account registers and signs in from | Three months after each address was first seen, and deleted at once if you close your account |
| Abandoned upload fragments | Deleted automatically within about four days |
| Photos and videos after deletion or erasure | Removed from Mosaikin at once and never shown again. Our storage provider keeps a recovery copy, which nobody can view through the service, for up to 90 days to protect against accidental loss; it is then deleted automatically |
| Billing records | Statutory tax and accounting periods |
| Stripe webhook metadata | 90 days |
| Delivery address and contact email on a printed order | 90 days after the order is delivered, cancelled or refunded, and at once if you close your account. What you ordered and what you paid are kept as billing records. |
| Our copy of the delivery details Stripe collected for a printed order | 7 days after payment |
| Print files for an order | 90 days after they are made, so a lost or damaged parcel can be reprinted |
| Audit log | Long-lived for accountability; on erasure your identity is tombstoned but the tamper-evident chain is preserved (section 9) |
| Child sexual abuse report evidence | As SI 2026/268 requires: report reference five years; associated content and data one year |
6. Children
Mosaikin is not directed at children, but events are family occasions and children appear in event photos. Contributors must be 13 or over; under-18s should have a parent or guardian’s agreement. We apply the same fail-safe moderation to all content, and a parent or guardian can use the reporting and erasure routes (sections 8 and 9) on a child’s behalf.
7. Security
Content is served only through access-controlled routes — never raw storage URLs. Transport is encrypted (TLS), storage is encrypted at rest, administrative and safety actions are recorded in a tamper-evident audit log, and invite-coded events are private by default. More detail: Security.
8. If you’re in a photo but never used Mosaikin
Event photos are uploaded by guests, so you may appear in content on Mosaikin without ever visiting it. Because galleries are private by default and we hold no identifying details about you, we cannot notify you individually — this notice, linked from every public surface, is how we make this information available (UK GDPR Article 14(5)).
Your rights are the same as everyone’s: use the Report control on the photo itself, ask the event’s host to remove it, or contact us directly at safety@mosaikin.app or hello@mosaikin.app with enough detail to find the content (the event, the approximate date, a description). We will action verified requests promptly — you do not need an account.
9. Your rights
You can ask us for access to your data, correction, erasure, restriction, portability, and to object to legitimate-interests processing; where processing rests on consent you can withdraw it at any time (this stops future processing — it does not make past processing unlawful).
- How: email hello@mosaikin.app from the address on your account, or — for guests and non-users — with enough detail to identify the content. We may ask for proportionate verification. We respond within one month.
- Erasure in practice: deleting an account removes that person’s data across our database, media storage and sign-in provider. One deliberate exception: the audit log keeps its tamper-evident chain with the identity tombstoned (a snapshot is retained under legal obligation for accountability), and billing records are kept for statutory periods.
- Withdrawing a guest contribution means deleting that contribution. A photo you uploaded you can remove yourself, from Your photos in the event, for 30 days from the device you uploaded with — the private download key that device holds is what proves the photo is yours — and the removal is for everyone and for good. After that, or from another device, ask the event’s host (who can remove it at any time) or email hello@mosaikin.app as above; a guestbook message is removed by the host or by us.
10. Cookies
Mosaikin uses strictly necessary cookies and storage (sessions, security). Any non-essential cookies are listed, and consented to, per the Cookie Policy.
11. Complaints
Contact us first — hello@mosaikin.app — and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
12. Changes
We will post changes here with a new effective date, and email hosts about material changes before they take effect.