Privacy & Security Policy

At Mosaic Studio (a product of Deyick Ventures Ltd), our purpose is to help you capture, preserve, and share life's most important moments through beautifully designed, large-format physical photo collages. We are equally committed to respecting your privacy. This Privacy and Security Policy ("Notice") explains how Mosaic Studio ("we," "our," or "us") collects, uses, and protects personal information. For the purposes of the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the UK Data Protection Act 2018, Deyick Ventures Ltd is the Data Controller responsible for your personal data.

1. Our Privacy-First Architecture

Unlike traditional photo services that require you to upload all your images to their servers before you can begin designing, Mosaic Studio is built on a privacy-first architecture. All image processing, layout computation, and artificial intelligence (machine learning for face and object detection) are performed locally on your device inside your web browser. While you are designing your collage, your original photos remain on your device and are not uploaded to our cloud servers until you actively proceed to checkout.

2. Lawful Basis for Processing

Under the UK and EU GDPR, we only process your personal data where we have a valid lawful basis to do so. Our primary bases for processing are:

• ·Performance of a Contract: Processing necessary to fulfil your order, including payment processing and shipping.
• ·Legitimate Interests: Processing necessary for the security of our application, fraud prevention, and the collection of anonymised, aggregated performance analytics to improve our service — provided these interests are not overridden by your fundamental rights.
• ·Legal Obligation: Retaining basic transactional records to comply with tax and accounting laws.

3. What Information Do We Collect and How Do We Use It?

We collect personal information when you use our website, place an order, or interact with our customer service.

4. Cookies, Local Storage, and Analytics (PECR/ePrivacy)

Because of our unique, browser-based editor, we rely on local storage technologies rather than traditional tracking cookies. In accordance with the UK Privacy and Electronic Communications Regulations (PECR) and the EU ePrivacy Directive, we distinguish between strictly necessary storage and performance analytics:

• ·__Host-mosaic_access (Strictly Necessary): A first-party security cookie set when you open the editor or submit a form. It protects our upload, ordering and contact endpoints from automated abuse. The cookie contains no personal data and expires after one year (or sooner if you clear your browser data). Your acceptance of our Terms of Service is recorded separately, in your browser and on your order, when you check out from your basket.
• ·IndexedDB (Strictly Necessary): We use your browser's IndexedDB to save your uploaded photos and your current layout progress locally on your machine. This is essential to provide the collage-building service you requested and ensures your work is not lost if you refresh the page.
• ·Local Storage (Strictly Necessary): We use Local Storage to maintain your shopping basket across browsing sessions, remember your display preferences (light/dark mode), and record that you have viewed the tutorial and agreed to our copyright terms.
• ·Performance Analytics (Legitimate Interests): We use Vercel Analytics and Speed Insights to collect anonymised, aggregated data on how our application performs — including page views, Web Vitals scores, and country-level geographic data. These tools are cookieless: they do not set cookies, store personal identifiers, or track individuals across sessions. We rely on Legitimate Interests as our lawful basis for this processing, as the data is aggregated and non-identifying.

5. How We Share Your Information With Third Parties

We do not share your personal information with third parties for their own marketing purposes. We only share information with trusted third-party service providers acting on our behalf to deliver our services to you.

• ·Shopify: Used as our e-commerce platform. When you proceed to checkout, your order details are securely transmitted to Shopify to process your payment and manage the transaction in full compliance with PCI-DSS standards.
• ·Gelato: Our global print-on-demand fulfilment partner. We share your shipping address with Gelato exclusively for the purpose of printing, packaging, and shipping your custom product to you. To ensure the secure handoff of your artwork, we do not use public links to transfer files. Instead, we generate secure, time-limited cryptographic "pre-signed URLs" that grant temporary access exclusively to our print partner for the purpose of fulfilling the order, after which the link becomes permanently invalid.
• ·Vercel: Our cloud hosting provider. Finalised artwork is securely stored in Vercel Blob storage (located in London, UK) to facilitate the secure routing to our printing partners.

6. Information Contained in Your Photos

When you upload photos into the Mosaic Studio editor, they may contain embedded metadata (such as the date, time, GPS coordinates, and location the photo was taken). Because our application processes images locally, this metadata is analysed by your own browser to help optimise layouts and face detection. We do not extract, store, or track this metadata on our servers. If you prefer, you may use third-party tools to strip this metadata from your photos prior to uploading them to our service.

7. Strict Data Retention

Deyick Ventures Ltd employs a strict, automated data lifecycle to ensure your files are never held longer than required to process your order.

• ·Print Artwork (PDFs): High-resolution final PDFs are automatically deleted from our servers within 30 days of upload.
• ·Previews and Thumbnails: Image thumbnails are automatically deleted within 48 hours of upload.
• ·Local Data: Because your design progress is stored locally on your device in your browser's IndexedDB, you have complete control over this data. You can delete your in-progress work at any time simply by clearing your browser's website data and cache.

8. Data Residency and International Transfers

• ·UK Data Storage: Deyick Ventures Ltd is based in the United Kingdom, and our primary file storage infrastructure (Vercel Blob) is located in London. Under current European Commission adequacy decisions (renewed through 2031), personal data can flow freely between the European Economic Area (EEA) and the UK without requiring additional transfer safeguards.
• ·Global Sub-Processors: Because we utilise global infrastructure partners (such as Shopify) and ship physical prints internationally via Gelato, your personal data may subsequently be transferred to, and processed in, countries outside the UK and the EEA, including the United States. Whenever we transfer your personal data to these third countries, we ensure a similar degree of protection is afforded to it by relying on recognized adequacy frameworks (such as the EU-US Data Privacy Framework) or implementing appropriate legal safeguards, such as the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum.

9. Security Controls

We implement robust technical and organisational measures designed to secure your personal information from accidental loss and from unauthorised access, use, alteration, and disclosure.

• ·Data in Transit: All web traffic and data transfers between your browser, our servers, and our third-party partners are secured using HTTPS / TLS 1.2+ encryption.
• ·Data at Rest: All user artwork temporarily stored on our cloud provider (Vercel) is protected using AES-256 encryption at rest.
• ·Payment Security: All payment processing is outsourced to a PCI-DSS Level 1 compliant provider.

10. Your Privacy Rights under UK & EU GDPR

As a data subject under the UK and EU GDPR, you have the following rights regarding your personal data:

• ·The right to be informed about how your data is being used (fulfilled by this Notice).
• ·The right of access to request a copy of the personal data we hold about you.
• ·The right to rectification to correct inaccurate or incomplete data.
• ·The right to erasure ("right to be forgotten") to request the deletion of your personal data.
• ·The right to restrict processing of your personal data under certain circumstances.
• ·The right to data portability to obtain and reuse your data for your own purposes across different services.
• ·The right to object to processing based on legitimate interests or direct marketing.

If you wish to exercise any of these rights, please contact us using the details below. Exercising your rights is generally free of charge. To protect your privacy, we may require you to verify your identity before we can fulfil your request. We will respond to all legitimate requests within one month.

11. Contact Us & Complaints

If you have any questions regarding this Privacy and Security Policy, wish to exercise your rights, or have a complaint, please contact our privacy team directly via email at: info@mosaicstudio.app.

You also have the right to lodge a complaint with a supervisory authority. If you reside in the UK, you may contact the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. If you reside within the European Economic Area, you may lodge a complaint with your local Member State Data Protection Authority.

12. Children's Data

Mosaic Studio is designed for adults capturing major life events and is not directed at children under the age of 16. We do not knowingly collect personal information from individuals under 16. If you are a parent or guardian and believe that your child has provided us with personal data, please contact our privacy team so that we may take steps to delete such information.