Privacy Notice

The following Privacy Notice describes the practices of Mosaic Desktop, Inc. (the “Company” or “We”) with respect to personal information that is collected from or about you by the Company at the website www.mosaic.it and when you use our services and tools (collectively, the “Services”). By accessing and using the Services, you acknowledge that you have read and agree to the privacy practices as described in this Privacy Notice. If you do not agree, please do not access or use the Services. We will review and update this Privacy Notice as our products and services evolve, and we will keep you informed of the changes here.

Some key terms

While there are different definitions of personal information used by different jurisdictions, the term Personal Information as used herein means information about a specific individual, such as full name, address, mobile number, or email address, which is used to identify a particular individual.

The term Non-Personal Information means information that does not personally identify you and cannot presently be used to identify you, including de-identified information.

The term Information may include both Personal Information and Non-Personal Information.

User means all visitors and users of the Services.

This Privacy Notice applies to those who visit, access or use the Services. Collectively throughout this Notice, we may use the term “You” to reference Users.

Information Collected

Depending on how you use our Services, Information collected will include:

• Information you provide voluntarily, such as name, email, and feedback.
• Account login information such as email and password.
• Payment Information: When you purchase or receive funds from the Company’s products and services.
• Information about devices, connections and methods used to access and interact with us, or the location from which you are accessing the Services, as described further below.
• Non-Personal Information about the Services that you use, how often you use them, including the types of AI features you access, and your responses to the offerings or advertisements presented or made available by our Services.
• Any other information you choose to include in communications with us, for example, when sending a message to us.
• We may also receive or collect certain technical information when you use our Services (or ask for technical support). This may include your browser or operating system, connections and methods used to access and interact with us, and data relating to malfunctions or problems occurring when you use our Services.

Information Collected with Automated Tools

We may use automated tools to collect certain Information about Users’ experience with the Services including to run analytics and better understand user interaction with the Services. Most of those tools will collect Non-Personal Information.

We will keep Information about your use of the Services tied to your account information (i.e. email address) to track the number of file names you use, tied to your account and subscription level.

As noted above, we may receive or collect certain technical information when you use our Services. This may include your browser or operating system, your Internet protocol (IP) address, information about any devices, connections and methods used to access and interact with us, and data relating to malfunctions or problems occurring when you use our Services. We may assign a randomized identifier to replace your device ID or IP address which enables us to know if your browser or device has previously been to the site. Additionally, we may collect information about other software or apps on your device for the purpose of protecting your security or providing you the Services.

Cookies and Similar Technologies

We use the following categories of cookies, pixels and similar tracking technologies, including:

• Necessary Cookies: required for the Services to function (e.g., maintaining your session, security, load balancing). These cannot be switched off and do not require consent. The website cannot function properly without these cookies, and can only be disabled by changing your browser preferences.
• Functional Cookies: remember your preferences and settings to enhance your experience (e.g., language selection).
• Analytics/Performance Cookies: help us understand how the Services are used, including via aggregated or pseudonymized data, so we can improve performance and features.
• Advertisement Cookies: provide visitors with customized advertisements and analyze ad campaigns.

Please see our Cookie Policy for the full list of cookies we use and further details, and select Your Privacy Choices in the footer of any page to review or change your choices.

If You are located in the United States, we honor opt-out preference signals, such as the Global Privacy Control, as a request to opt out of the use of Analytics/Performance cookies where required by applicable law.

If You are located in the European Economic Area, the United Kingdom, or another jurisdiction that requires opt-in consent for non-essential cookies, we will request your consent through a cookie banner or preference center before placing any cookies other than Necessary Cookies on your device, and you may withdraw that consent at any time.

We retain cookie data only for as long as reasonably necessary for the purposes above, after which it is deleted or anonymized, except where a longer period is required by the cookie provider or applicable law.

How Information May Be Used

Information may be used for purposes that include:

• to operate and improve the Services;
• to fulfill your requests for tools, software, functionality, features and other products and services;
• to communicate with you and respond to your inquiries and to provide customer support and technical assistance;
• for administration of your account;
• to create de-identified analytical information;
• to provide and improve responses, and, using only information collected through our website and marketing activities, for contextual advertising services and campaign measurement.

Legal Basis

In accordance with applicable data protection laws, without limiting the above, we may process Personal Information where we have a lawful basis for doing so including:

• Contract Necessity — Where it is necessary to provide the Services under the performance of the contract we have with you or your organization that is our customer;
• Legal Necessity — Where we are required to do so in accordance with legal or regulatory obligations;
• Consent — Where you have given your consent;
• Legitimate Interests — Where it is in our (or a third party’s) legitimate interests to process your Personal Information and these interests do not prejudice your own interests or fundamental rights and freedoms.

Disclosure and Sharing of Non-Personal Information

We may use Non-Personal Information to learn and understand the use of the Services, to improve and revise the Services and to track product interest.

We may share Non-Personal Information about our Services with our business partners or the general public. For example, we may share information regarding the daily number of unique users to our Services with potential partners or others or to show trends about the general use of our websites and/or other products or services. We will maintain and use de-identified information in de-identified form and not attempt to reidentify the information, unless required by law.

We may use and share deidentified or anonymized information such that it cannot reasonably be used to infer information about You or otherwise be linked to You and we may use such deidentified information for any purpose. To the extent we possess or process any deidentified information, we will maintain and use such information in deidentified/anonymized form and not attempt to reidentify the information, except solely for the purpose of determining whether our deidentification/anonymization process satisfies legal requirements.

Disclosure and Sharing of Information that May Include Personal Information

We may also share Information (including Personal Information) we collect for the following purposes:

Information may be disclosed to anyone who is engaged in helping us make the Services available and functional, like technical agents, service providers, other subcontractors, and our affiliates and consultants. These functions include, for example, hosting, maintenance, data analysis, customer support, email delivery Services, infrastructure, technical agents, analytics and metrics. They will be engaged by contract to ensure that they only use the Information on our behalf and as permitted under this Privacy Notice. We may also share Information with our employees and contractors that need to know that information to process it on our behalf or to provide the Services. Some of those employees and contractors may be located outside of the United States and by using the Services you consent to the transfer of such information to them.

We may disclose Information during due diligence or in preparation for or after a sale, merger, consolidation, change in control, transfer of substantial assets, reorganization or liquidation. In the event that another company acquires all or substantially all of the assets related to the Services or other business of the Company, we reserve the right to include all Information among the assets transferred to the acquiring company.

We may share Information with our affiliates when it is reasonably necessary, such as to help analyze and improve the Services.

We may share your Personal Information with professional advisors such as auditors, law firms, or accounting firms working on our behalf.

We may disclose Information if required by law or where we believe such action is necessary in order to protect or defend our interests or the interests of our users or business partners. We may disclose Information to the extent required by law, or if we have a good-faith belief that we need to disclose it to comply with official investigations or legal proceedings (whether initiated by governmental/law enforcement officials, or private parties). If we have to disclose Information to governmental/law enforcement officials, we may not be able to ensure that those officials will maintain the privacy and security of any Information.

Push Notifications

We may occasionally send push notifications via mobile applications regarding application upgrades or notifications about our services. You can always edit such communication and notifications through the settings on your device and stop receiving such communications and notifications.

Artificial Intelligence Use

The Company leverages advanced language models from third-party providers. For the Services called Mosaic Desktop, we collect, on the user’s own device, data such as chat prompts, emails, calendar events, document files (text, Word, Excel, PowerPoint, PDF, for example), images, and video files that users choose to share with our applications and services in the course of their normal use (collectively, the Content). The Content processed by language model providers via the Services may contain Personal Information when you choose to share it.

The Company will store the Content locally on the user’s computer to provide application services to the user. Your documents, emails, and files are indexed locally on your device — that index never leaves. When you ask a question — and when Mosaic prepares a suggestion for you on its own schedule — Mosaic selects, locally, the content needed for the task, then transmits it, together with the earlier messages in that conversation, through our secure servers to cloud AI providers for inference. For a question, that is typically a few relevant excerpts. For a task that works on a particular email, attachment or file, or when you attach a file or image to a chat, it can be that whole item. The providers see only what the task needs, not your full personal data store, and Mosaic does not upload your whole mailbox or file library. Nothing from your Content is retained on Mosaic’s servers. While Mosaic has implemented guardrails to minimize the sharing of Personal Information, it is possible that Content processed may contain Personal Information.

We use several language model providers, all of which are based in the United States. We only contract with providers that agree not to train their models on the Content we share: we engage their services through commercial use contracts which stipulate generally that they will only store user data temporarily as needed to provide reliable services and will not use any user data passed to their models for the training of those models.

Google User Data

This section describes how Mosaic Desktop handles information it receives from Google APIs when you connect a Google account (“Google User Data”). If anything elsewhere in this Privacy Notice conflicts with this section, this section controls for Google User Data.

What we access and why

• Gmail: your email messages, so that Mosaic Desktop can search them, answer your questions about them, point out messages that need your attention, and draft replies. Mosaic Desktop sends an email on your behalf only after you have reviewed it, or when you explicitly ask it to.
• Google Calendar: your calendar events, so that Mosaic Desktop can show your schedule alongside related email and files and help you prepare for upcoming meetings. Mosaic Desktop creates or changes an event only when you approve it, or when you explicitly ask it to.
• Google Drive: only the files and folders you choose to share with Mosaic Desktop, so that it can search them, answer your questions about them, and connect them to related email and meetings.

Google User Data is stored on your own computer, not on Mosaic’s servers. When you ask a question, or when Mosaic prepares a suggestion for you, only the content needed for that task is sent through our servers to the AI model provider that handles it: typically a few relevant excerpts, or a specific email or file when the task works on one. Nothing from your Google User Data is retained on our servers. We use encryption to protect Google User Data in transit: that content is always sent over encrypted (HTTPS) connections, both to our servers and from our servers to the AI model provider. You can revoke Mosaic Desktop’s access to your Google account at any time from your Google Account permissions page.

No one at Mosaic reads your Google User Data. The only exceptions are data you choose to share with us yourself, for example in a support request, and cases where access is necessary for security purposes, such as investigating abuse, or to comply with applicable law.

What we never do with it

• We never sell Google User Data.
• We never use Google User Data for advertising, including retargeting and personalized or interest-based advertising, and we never transfer it to advertising platforms, data brokers, or other information resellers.
• We never use Google User Data, including data obtained through Google Workspace APIs, to develop, improve, or train non-personalized or generalized artificial intelligence or machine learning models.

When we transfer it

We transfer Google User Data only:

• to provide or improve the features of Mosaic Desktop that you use, with your consent;
• for security purposes, such as investigating abuse;
• to comply with applicable law; or
• as part of a merger, acquisition, or sale of assets of the Company, and only after obtaining your explicit prior consent.

Who processes it

The excerpts described above are processed by the third-party AI model providers we use as service providers, solely to provide the feature you are using. They may hold those excerpts temporarily as needed to provide their service, and they do not use them to train their models.

Mosaic Desktop’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Children

Our Services are not directed towards children under 13 years of age, and we do not knowingly collect any Personal Information from children under age 13 (or up to age 16 in certain jurisdictions) through the Services. The Services do not fall within the Child Online Privacy Protection Act (“COPPA”) and are not monitored as doing so. If we learn that we have collected Personal Information from a child without verified parental consent, we will take steps to delete that information. Parents or guardians who believe we may have collected such information may contact us at the address listed in the “Contact Information” section below.

Additional Notice — California and Other US States

This Privacy Notice for California Residents supplements the information contained in this Privacy Notice and applies to visitors and users of the Services who reside in the State of California. We adopt this notice to comply with the California privacy laws, including the California Consumer Privacy Act of 2018 (“CCPA”) and the California Privacy Rights Act of 2020 (“CPRA”). For purposes of this notice, we use the term “Personal Information” as it is defined and used under the CCPA.

Certain other US states have also enacted consumer privacy laws that grant their residents certain rights and require additional disclosures. If you are a resident of one of these states, this section applies to you:

Information We Collect: Personal Information we collect from You is what you voluntarily submit to us (i.e. your email address), your email address and password when you use the Services (all described more fully above). We use this Personal Information to respond to your requests and to enable you to use our Services.

Personal Information that we “Share,” “Sell,” or Use for “Targeted Advertising”

This section applies only to information collected through our website and marketing activities, such as cookies, pixels, your Internet protocol (IP) address, and device identifiers. It never applies to data we obtain through Google APIs, which is covered by the Google User Data section of this notice.

As noted above, we may collect certain technical information when you use our Services, such as your Internet protocol (IP) address or device ID. And we may participate in digital advertising networks and engage other advertising services to deliver advertising that is tailored to your interests. Some targeted advertising, such as participation in certain ad networks and advertising on social media platforms, can constitute sharing/using your personal information for digital advertising and a “sale” of personal information under state privacy laws. You may opt out of the “sale” of that personal information, and of the sharing of that personal information for targeted advertising, by selecting Your Privacy Choices in the footer of any page — or by using the button below.

Your Privacy Choices

This opt-out is limited to the device and web browser you are using; if you use another device or browser, you will need to opt out on each device and browser.

Alternatively, you can use certain preference signals to exercise your opt-out right automatically with all businesses that you interact with online when you enable a browser-based opt-out preference signal, such as Global Privacy Control (GPC), where upon receipt or detection, we will treat the signal as a valid request to opt out of the sale or sharing of personal information linked to that browser.

Your Privacy Rights

Your Rights and Choices: The CCPA provides consumers with specific rights (i.e. access, opt out and deletion) regarding their Personal Information. If at any time you wish to amend or delete the Personal Information we hold about you, you may contact us as set forth in the “Consumer Privacy Choices” section.

Non-discrimination

We will not discriminate against you if you choose to exercise your rights under the CCPA or any other rights you may have in respect of your Personal Information.

Appeals

You have the right to appeal a decision we may make about your privacy rights. If we deny your request, you may appeal our decision by contacting us at . If you have concerns about the results of an appeal, you may contact the attorney general in the state where you reside.

Other US State Privacy Rights

If you are a resident of Virginia, Colorado, Connecticut, Utah, or another state that has enacted a comprehensive consumer privacy law, you may have some or all of the following rights, subject to certain exceptions and limitations under applicable law: (i) the right to confirm whether we process your Personal Information and to access that Personal Information; (ii) the right to correct inaccuracies in your Personal Information; (iii) the right to request deletion of your Personal Information; (iv) the right to obtain a copy of your Personal Information in a portable format; (v) the right to opt out of the processing of your Personal Information for purposes of targeted advertising, the sale of Personal Information, or profiling in furtherance of decisions that produce legal or similarly significant effects; and (vi) the right to appeal our decision with respect to a privacy request. To exercise any of these rights, please contact us as set forth in the “Contact Information” section. We will not discriminate against you for exercising any of these rights.

Data Retention

We retain the information as long as we need in order to provide our Services to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations.

Additional Information for Users in the European Union, Switzerland and the UK

This section of the notice applies to Users that are located in the European Economic Area (EEA), Switzerland or the United Kingdom (UK). The Company processes your personal data in accordance with European laws and regulations, such as the General Data Protection Regulation (GDPR) and UK General Data Protection Regulation (UK GDPR).

Controller’s details

For the purposes of the GDPR and UK GDPR, Mosaic Desktop, Inc. is the controller of your personal data when you set up an account with us. When our Services access your data, we serve as a processor of your personal data, to the extent any personal data is contained in the Content.

Legal bases for processing

If you are located in the EEA, Switzerland or the UK, we need a lawful basis to collect, use and disclose your personal data as a controller. Our lawful basis will depend on the information concerned and the context in which it is processed.

Generally, the Company will collect and use your information as follows:

• Contractual necessity: We need it to provide the Services to you and fulfill our obligations to you. For example, this includes creating and maintaining your account, resolving issues you may experience with the Services, obtaining payment for our Services and providing you with access to your account.
• Legitimate interests: It is necessary for our legitimate interests, for example, providing a useful and customized Service, using information we collect about you (like your platform usage, occupation and employer) so that we can make more informed predictions, decisions and offers for our users, helping users connect with team members at the Company and enhancing our Services via research and development, data analytics, data labeling, machine learning and predictive analytics relating to your usage data. We do not rely on this lawful basis where our legitimate interests are overridden by your rights and interests.
• Consent: You consent to us using your information in a certain way — for example, to hear about new features or offers. Any predictive analysis of your Content is used solely to provide features to you, as described in Artificial Intelligence Use. We do not use your Content to develop, improve, or train non-personalized or generalized artificial intelligence or machine learning models, and Google User Data is handled as described in the Google User Data section of this notice.
• Legal obligations: It is necessary for compliance with our legal obligations — for example, to disclose your information in response to law enforcement requests and to retain your information for our record keeping purposes.

If you consented to our use of your information, you can withdraw that consent at any time by contacting us at .

Cross-border transfers of information

By signing up, you understand and agree that Mosaic Desktop, Inc. will receive and process your personal data. We may transfer your personal data to other countries where our affiliates and service providers are located. Please note that some of these countries may have data protection laws that are different from your country (and, in some cases, may not be as protective). For Users in the EEA, Switzerland or the UK, where we transfer your information to a third-party service provider that is not located in Europe, and is not in a country that benefits from an adequacy decision by the European Commission, UK or Swiss authorities, we will require those third-party providers to enter into an agreement that provides appropriate safeguards for your information.

Consumer Privacy Choices

You may have certain rights to access, review, update, or delete the personal information we hold about you under applicable law. Consumer privacy rights vary depending on where you reside, but we will make reasonable efforts to honor your request even if you are a resident of a country or state that does not require us to do so under applicable law. Consumer privacy choices may include:

• Right to Know: you may have the right to request information about the personal information we have collected about you and for what purpose.
• Right to Access: you may have the right to request information about how we process personal information and to obtain a copy of that personal information.
• Right to Portability: you may have the right to receive your personal information, in a commonly used and machine-readable format.
• Right to Deletion: you may have the right to request the deletion of your personal information that we have collected from you.
• Right to Be Free from Discrimination: We will not discriminate against you for exercising your consumer privacy rights.
• Right to Opt-out of Sharing: you may have the right to opt out of our sharing personal information with third parties for some purposes, including sharing that may be defined as a sale under certain laws.
• Right to Make Choices About Email Marketing: you may have the right to make choices about receiving email marketing.

Submitting Access or Deletion Requests

If you would like to access a copy of, or request deletion of the Personal Information we may maintain about you, or to exercise any other privacy right as set out above:

1. Send a written request via email to
2. Write and mail to us at:
   Mosaic Desktop, Inc.
   130 W. Union Street
   Pasadena, CA 91103
   Attn: Privacy

We require the following information to authenticate you no matter which method you use to make your request:

1. First name
2. Last name
3. Email address
4. Specify: request to access or delete
5. If you are an agent acting on behalf of someone else, in addition to the information noted above, we will require a copy of your Power of Attorney authorizing you to act on another’s behalf.

If you would like to discontinue receiving marketing emails from us, you may also make the request by email or mail as specified above.

For security purposes, we will seek to verify your identity before we can give you access to any personal data (in order to make sure we send information only to the identified person). For instance, you may need to authenticate your account information. Once we have verified your identity, we will respond to your request as appropriate.

Your request does not guarantee complete access or comprehensive removal as the law may not permit or require removal in certain circumstances. Please also keep in mind that we may not be able to honor all requests but in such case will respond and advise you so.

Third-Party Websites and Services

Our Services may utilize third party tools such as authentication or login tools and contain links to other third-party websites, apps and services of interest. If you access third-party services, such as social media sites or other sites linked through the Services, these third-party services will be able to collect personal data about you, including information about your activity on the Services. By interacting with these third parties, you are providing information directly to the third party and are subject to the third party’s privacy policy. This Privacy Notice does not apply to the privacy practices of third parties that appear on or through the Services. We are not responsible for the content or privacy practices of third-party providers, platforms or others.

Complaints

If you have any questions or complaints about how we process Personal Information, we encourage you to reach out at , and we will respond to you.

General

We reserve the right to change this Privacy Notice at any time and will do so by posting changes to this Privacy Notice.

The Services are hosted in the United States. If you are located outside of the United States, please be advised that we process and store information in the United States and your use of the Services constitute your consent to and understanding of this processing.

Account and website information that we collect is stored on servers that we manage, using reasonable administrative, technical and physical safeguards designed to protect against unauthorized access or disclosure of data. Please be aware that no data transmission over the Internet is guaranteed to be 100% secure.

Contact Information

If you have any questions about the Services, or this notice, or if you would like us to delete the Information, please contact us at .

Also see our Terms of Use.