Skip to content

Privacy policy

What personal data Mosaqo collects, why, and your choices, including cookies.

Last updated

This policy explains what personal data Mosaqo collects, why, and what you can do about it. It covers our website, the Mosaqo app, and the pages guests use.

Who is responsible

Mosaqo LLC, a Wyoming limited liability company, is responsible for the data described here as ours. Contact us about privacy at privacy@mosaqo.com. Mailing address: 2400 N Henderson Ave Ste B PMB 1391, Dallas, Texas 75206, United States.

If you are a guest or a service provider: the property team that invited you decides how your data is used for your stay or your jobs. They are the controller of that data, and Mosaqo processes it on their behalf, under our Terms of Service. Please contact them first with questions or requests about it; we will help them answer.

What we collect and why

  • Account data: name, email address, password (stored only as a hash) or Google sign-in, organization and role. We use it to provide your account and the service (contract).
  • Billing data: billing contact, company details and subscription history. Card details go directly to Stripe; we don't see or store them. We use it to bill you and keep records the law requires (contract, legal obligation).
  • Content you add: properties, services, providers, guest requests and messages. We process it for the property team as described above.
  • Contact and support: what you send us through the contact form or email, to answer you (legitimate interest).
  • Demo: the email, name and company you give to try the demo, to know who tried Mosaqo, to follow up about your demo (for example, to help you set it up) and to answer if you write to us (legitimate interest). We keep the email as soon as you give it, even if you don't open the demo. If you tick "Send me tips and new features, about once a month", we also send you news (consent); every one has a link to unsubscribe. The demo itself, with everything you add to it, is deleted after 7 days.
  • Your own menu: if you ask for a menu with your own services, your email and website, to make it and email you its link, plus one reminder if you don't open it (legitimate interest). If we write to your business first, we keep its email and the menu we made from its website the same way. A menu you don't save is deleted after 30 days.
  • How the demo is used: which steps of the demo you reach and when (for example, booking as a guest or answering as a provider), whether you used a phone or a computer, and any feedback you write in it, to see where the demo is unclear, improve it, and offer you help (legitimate interest). Our server records this as you use the demo, in our own database; nothing extra is stored in your browser for it. The same applies to your own menu.
  • Technical data: IP address, browser, device and sign-in records, and error reports, to keep Mosaqo secure and working (legitimate interest).
  • Analytics: which pages and features are used, only if you accept analytics cookies (consent). When you are signed in, analytics use your account ID, never your name or email.
  • Service messages: emails about your account, requests and security (contract). If we send product news, you can unsubscribe at any time.

We don't sell personal data, and we don't use it for advertising.

Who we share data with

We use these providers to run Mosaqo. They process data on our instructions, under data protection agreements:

  • Vercel (hosting in the EU, Frankfurt; worldwide page delivery): hosting and delivery of the website and app.
  • Neon (EU, Frankfurt): database hosting.
  • Cloudflare (United States; storage in the EU): storage of uploaded images, and Turnstile, which protects our sign-up, sign-in, contact and demo forms from bots by checking your browser and IP address. See Cloudflare's Turnstile Privacy Addendum.
  • Mailgun by Sinch (EU region): sending emails.
  • Stripe (United States): subscription billing and payments.
  • Sentry (EU region): error monitoring.
  • Google Analytics (United States) and Amplitude (EU region): usage analytics, only with your consent.
  • Sanity (United States): our website content.

Some providers act on their own responsibility when you use them: Google, when you sign in with Google or when we look up a property address, and Stripe for its own payment obligations. Their privacy policies apply to that use.

We may also disclose data when the law requires it, to protect our rights or users' safety, or as part of a merger or sale of our business. Within Mosaqo, guests' contact details are shown only to the property team, and providers see only what they need for their jobs.

International transfers

We host the platform and its database in the European Union. Some data leaves the EU: Stripe, Google and Sanity process it in the United States, Vercel delivers pages from locations near each visitor, and Mosaqo LLC is a US company whose team may access data from abroad. For these transfers we use the EU–US Data Privacy Framework or the EU Standard Contractual Clauses.

How long we keep data

  • Account and content data: while your organization uses Mosaqo, then 90 days so you can export it, then deleted.
  • Billing records: as long as tax and accounting law requires.
  • Contact inquiries: up to 12 months after we last hear from you.
  • Demo emails, names and companies: up to 12 months after you last opened the demo, with the record of how you used it.
  • Menu requests: 12 months after you asked, or longer while your menu exists, with the record of how its menu was used.
  • Error reports: up to 90 days.
  • Analytics: up to 14 months.

The property team decides how long guest data is kept, within these limits.

Your rights

Depending on where you live (for example under the EU or UK GDPR, Thailand's Personal Data Protection Act or Indonesia's Personal Data Protection Law), you can ask to access, correct, delete or export your data, to restrict or object to how we use it, and to withdraw consent at any time (for cookies, through "Cookie settings" at the bottom of every page). Write to privacy@mosaqo.com; we answer within one month. You can also complain to the data protection authority where you live or work.

Cookies

We use cookies and similar browser storage in two groups.

Necessary (always on): they keep you signed in, keep a guest's access to their stay, remember your theme and sidebar, and store your cookie choice (the cc_cookie cookie, 180 days). Without them Mosaqo doesn't work, so they need no consent.

Analytics (only if you accept): Google Analytics (_ga cookies, up to 13 months) and Amplitude (AMP_ cookies and browser storage, up to 12 months) count visits and show which pages and features are used. We send them page addresses without IDs or codes, and no names or email addresses. Advertising features are switched off.

You can change your choice at any time through "Cookie settings" at the bottom of every page, or in the app's user menu. Turning analytics off deletes their cookies.

Security

We protect data with encryption in transit, access controls and careful handling by our team and providers. If you find a security issue, please write to security@mosaqo.com.

Children

Mosaqo is for businesses and not directed at children. We don't knowingly collect data from anyone under 16.

Changes

We will update this policy when our practices change and show the date at the top. For material changes affecting account holders, we will tell them in advance by email or in the app.