Privacy Policy

1. Overview

Mosaiic AI Ltd ("Mosaiic", "we", "us", or "our") provides a music intelligence and release strategy platform designed to empower independent artists, record labels, and managers. This Privacy Policy outlines how we collect, use, process, and protect your personal and analytical data across our website (wearemosaiic.com), mobile applications, and strategy services ("Makeda").

Age Requirement: Mosaiic is strictly for users 18 years of age and older. We do not knowingly collect or process data from individuals under 18.

2. Age Verification (18+ Only)

Mosaiic requires all users to be at least 18 years old. This requirement is in place due to:

• Music Distribution Agreements: Legal age required for binding contracts with digital service providers (DSPs).
• AI Service Provider Policies: Anthropic API Usage Policy requires users to be 18+ for AI services.
• Industry Standards: PRO registration, royalty collection, and payment processing require legal age.
• COPPA Compliance: We maintain a clear 18+ policy to avoid ambiguity about our target audience.

Age Verification Process: During account creation, users must provide their date of birth. We calculate age and verify users are 18+. Users under 18 are immediately blocked from account creation with a clear legal notice.

Data Collected: Date of birth, age verification status (is_adult: true/false), verification timestamp.

Retention: Date of birth is retained for the lifetime of the account and deleted upon account deletion.

3. Information We Collect

3.1 Account & Contact Data

• Name, email address, password hash (encrypted)
• Date of birth (for age verification)
• Artist name, stage name, record label
• Billing information (processed securely via Stripe)

3.2 Distribution & Royalty Telemetry

• Streaming metrics (daily streams, platform breakdown, country/city data)
• Revenue data (USD earnings per stream/platform/country)
• Release metadata (ISRC, track titles, artist names, genres)
• Payout statements and royalty data (via Too Lost API)

3.3 Social Platform & API Connections

• Spotify: Monthly listeners, follower count, total streams, top cities/countries
• Instagram: Follower count, media count, engagement rate, post captions
• TikTok: Follower count, video views, engagement metrics, video titles
• YouTube: Subscriber count, total views, video count
• Twitter: Follower count, tweet count
• Apple Music: Monthly listeners, follower count, total streams
• SoundCloud: Follower count, track plays

3.4 Campaign & Strategic Input

• Ad campaign spend logs (TikTok, Instagram, Spotify ad budgets)
• Promotional task completions (scheduled posts, verification status)
• AI prompts submitted to Makeda strategy engine
• Editorial pitch copy generated by AI
• Campaign task metadata (captions, keywords, target KPIs)

3.5 Analytics & Performance Data

• Daily streaming velocity (7-day, 30-day trends)
• Growth metrics (listener/follower changes)
• Geographic breakdown (top countries and cities)
• Platform performance comparison
• Cost-per-stream ROI calculations

4. How We Use Your Data

We use your information strictly to operate and enhance Mosaiic services:

4.1 Analytics & Insights

• Display real-time analytics dashboards (Pulse Metrics)
• Calculate ROI metrics (cost per stream, campaign efficiency)
• Track streaming velocity and growth trends
• Generate geographic performance breakdowns

4.2 AI Strategy Generation (Makeda)

• Correlate marketing campaigns with streaming spikes
• Generate data-driven release strategies
• Create editorial pitch copy for Spotify/Apple Music
• Provide actionable recommendations based on performance data

4.3 Campaign Management

• Schedule and track promotional tasks
• Verify social post completion via platform APIs
• Send push notifications for task reminders
• Calculate campaign performance and efficiency

4.4 Platform Operations

• Process monthly platform subscriptions via Stripe
• Verify distribution accounts and release submissions
• Communicate service updates and account notifications
• Provide customer support and troubleshooting

5. Third-Party Integrations & Data Sharing

We do not sell, rent, or trade your personal data. Data is shared exclusively with necessary service infrastructure providers bound by strict confidentiality.

5.1 Infrastructure & Storage

• Supabase: Database, authentication, and Row Level Security (RLS)
• Vercel: Web hosting and serverless functions
• Expo: Mobile app infrastructure and push notifications

5.2 Payment Processing

• Stripe: PCI-DSS compliant payment processing for subscriptions and royalty payouts

5.3 Platform APIs (Data Synchronization)

• Too Lost API: Streaming analytics, revenue data, distribution services
• Spotify API: Monthly listeners, follower counts, artist profile data
• Meta (Facebook/Instagram) API: Follower counts, post data, engagement metrics
• TikTok API: Follower counts, video views, engagement data
• YouTube API: Subscriber counts, video views, channel statistics
• Twitter API: Follower counts, public metrics

5.4 AI Strategy Engine

• Anthropic API (Claude): Anonymized performance context processed for Makeda AI strategy generation and editorial pitch copy. We comply with Anthropic's 18+ usage policy.

5.5 Data Shared with Third Parties

We share only the minimum necessary data:

• Anthropic: Artist genre, release metadata, streaming stats (NO personal identifiers, NO date of birth)
• Platform APIs: OAuth tokens for authorized data access (encrypted in Supabase)
• Too Lost: Release metadata, artist name, ISRC codes for distribution
• Stripe: Billing email, payment method for subscription processing

6. Data Security & Storage

We implement industry-standard encryption protocols to safeguard your profile and analytics data:

• Encryption in Transit: SSL/TLS for all API communications
• Encryption at Rest: AES-256 encryption for database storage
• API Credentials: Managed via isolated environment variables, never exposed to client-side bundles
• Row Level Security (RLS): Users can only access their own data in Supabase
• OAuth Tokens: Encrypted and stored securely in platform_connections table
• Password Security: Passwords are hashed using bcrypt (never stored in plaintext)

7. Data Retention

• Account Data: Retained for the lifetime of your account
• Analytics Data: Retained for historical performance tracking and trend analysis
• Campaign Data: Retained for ROI calculation and performance optimization
• Age Verification: Date of birth retained for ongoing compliance verification
• Deleted Accounts: All personal data deleted within 30 days of account deletion request

8. Your Rights & Data Erasure

You have the right to access, update, or request full deletion of your personal data at any time:

• Access: Request a copy of all data we hold about you
• Correction: Update inaccurate or incomplete information
• Deletion: Request complete account and data erasure
• Portability: Export your analytics data in CSV/JSON format
• Opt-Out: Disable specific data collection (e.g., social platform sync)

To exercise these rights, email us at privacy@wearemosaiic.com.

9. Cookies & Tracking

We use essential cookies for authentication and session management. We do not use third-party advertising cookies or tracking pixels.

• Authentication Cookies: Supabase session tokens (required for login)
• Analytics: Anonymized usage statistics for platform improvement
• Preferences: User settings and notification preferences

10. International Data Transfers

Your data may be processed in countries outside your country of residence. We ensure appropriate safeguards are in place:

• Supabase: Data stored in EU/US regions with GDPR compliance
• Vercel: Serverless functions deployed globally with encryption
• Anthropic: US-based AI processing with data anonymization

11. Children's Privacy (COPPA)

Mosaiic is NOT directed at children under 18. We do not knowingly collect data from individuals under 18 years of age.

If we discover that a user is under 18:

• Account access is immediately revoked
• All active releases are paused
• Personal information is deleted within 30 days
• Account is permanently closed
• No refunds for any paid services

Parental Consent Not Applicable: We do NOT offer parental consent options. The platform is exclusively for adults 18+.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated via:

• Email notification to registered users
• In-app notification banner
• Updated "Effective Date" at the top of this policy

Changes take effect 30 days after notification.

13. Legal Basis for Processing (GDPR)

For users in the EU/UK, we process your data under the following legal bases:

• Contractual Necessity: Required for music distribution agreements and platform services
• Legal Compliance: Age verification, COPPA, GDPR Article 8
• Legitimate Interest: Analytics, fraud prevention, platform security
• Consent: Optional features like social platform sync and push notifications

14. Contact Us

For privacy inquiries, legal requests, or data protection concerns:

By creating an account on Mosaiic, you acknowledge that you are 18 years of age or older, have provided accurate date of birth information, understand the legal requirements for music distribution, and agree to comply with all age-related terms and conditions outlined in this Privacy Policy.