Privacy Policy

1. Who We Are

Controller: Julian Witkowski, operating as “Mosai”.
Contact: https://calendar.app.google/mvukhCtpW4n82VNs7
This is a personal/freelance project, not yet incorporated. If/when a company is formed, this policy will be updated with new controller details.

2. What This Policy Covers

This policy explains how I collect, use, disclose, and protect personal information when you use the Mosai app, websites, and related services (“Services”).

3. Information I Collect

• You provide: name, email, password, organization info (if any), support messages, content you upload/enter (e.g., personas, project notes).
• Automatically: IP address, browser/OS, device, usage logs, crash logs, cookies (essential; optional analytics if enabled).
• From integrations you connect: Google Analytics 4 (read‑only metrics), Google Search Console (read‑only performance data), and OAuth tokens to access your properties on your behalf.

4. How I Use Information

• Provide, secure, and improve the Services
• Authenticate and manage sessions
• Generate data‑backed insights from your connected properties (GA4/GSC)
• Support and customer communications

Legal bases (where applicable): contract, legitimate interests, consent (for optional analytics), legal obligations.

5. Google API Services

Scopes used (read‑only): https://www.googleapis.com/auth/analytics.readonly and https://www.googleapis.com/auth/webmasters.readonly.
I only read aggregated property‑level data you authorize; I do not edit your GA/GSC settings.
Tokens are stored securely and deleted when you disconnect or delete your account.
Use of Google data follows Google API Services User Data Policy; you may revoke access at any time.

6. No Sale/Sharing for Ads

I do not sell personal information or share it for cross‑context behavioral advertising.

7. Sharing & Disclosures

Service providers (hosting, error monitoring, email, payments if applicable) under confidentiality and security obligations; legal compliance; and business change notice if I incorporate or transfer operations.

8. International Transfers

Your data may be processed or stored in other countries by my hosting providers. I use reputable providers and appropriate safeguards; contact me for details.

9. Retention

• Account & content: for your active use and up to [X months] after deletion/inactivity (or earlier upon request unless legally required otherwise)
• OAuth tokens: only while integration is connected
• Logs: [X–Y months], then deleted or anonymized
• Billing records (if applicable): for statutory periods

10. Cookies

Essential cookies for login/security; optional analytics cookies only with consent (if enabled). Manage via browser settings and any in‑app controls.

11. Your Rights

Depending on your location, you may have rights to access, rectify, delete, port, restrict, object, and withdraw consent. Contact: [your email]. I may verify your identity before acting.

12. Security

Encryption in transit/at rest (where supported by providers), access controls, least‑privilege, and incident handling. No method is 100% secure, but I work to protect your data.

13. Children

The Services are not directed to children under 16. If you believe a child provided data, contact me to remove it.

14. Your Responsibilities

You must have authority to connect third‑party accounts (e.g., GA4/GSC) and remain responsible for data you submit.

15. Third‑Party Links

I’m not responsible for third‑party privacy practices. Review their policies.

16. Changes

I’ll update this policy as laws or Services change; material updates will be communicated in‑app or via email where appropriate.