Privacy Notice

01. WHO WE ARE AND WHAT THIS NOTICE COVERS

MosaicVoice provides a call quality management platform for contact centers: call recording, transcription, redaction, AI summaries, scoring, coaching and reporting. We are MosaicVoice, Inc., 6030 Colby St, Oakland, CA 94618, USA.

We handle personal data in two roles:

• As a controller, for data we decide how to use: our website visitors, people who contact us, our customers' business contacts, and the account details of people who use the platform.
• As a processor, for the data our customers put through the platform, such as call recordings, transcripts and summaries. Our customer (usually your employer, or the organization you called) decides how that data is used, and we process it only on their instructions under a written contract and data processing agreement.

02. CALL DATA WE PROCESS FOR OUR CUSTOMERS

When an organization uses MosaicVoice, we process the calls it records on its behalf: call audio, transcripts, summaries, scores, caller phone numbers and call details, and anything said during the call, which can include health or other sensitive information. That organization is responsible for telling callers and agents about this processing and for its legal basis.

To access, correct or delete call data about you, contact the organization you dealt with. If you contact us, we will pass your request to them.

We do not use our customers' call data, or data derived from it, to train AI models or for any purpose other than providing the service to that customer.

03. INFORMATION WE COLLECT

• Account data: name, work email, role, and the organization you belong to, when you are given a MosaicVoice account.
• Sign-in and usage data: sign-in times, IP address, browser and device details, and actions taken in the platform, which we keep for security, audit and support.
• Contact and support data: what you send us when you contact sales or support, and our replies.
• Business contact data: names, roles and contact details of people at our customers, prospects and suppliers.
• Website data: pages visited and how you reached our website, collected through analytics cookies if you accept them (see Cookies).

04. WHY WE USE IT AND OUR LEGAL BASIS

Where the GDPR or UK GDPR applies, we rely on these legal bases:

• Providing accounts and the platform: performance of our contract with the customer, and our legitimate interest in providing the service they bought.
• Security, fraud prevention, audit logs and reliability: legitimate interests and legal obligations.
• Support and enquiries: legitimate interests and performance of a contract.
• Billing and account management: performance of a contract and legal obligations (tax and accounting).
• Service emails (password resets, report and voicemail notifications, alerts): performance of a contract.
• Marketing emails to business contacts: legitimate interests, or consent where the law requires it. You can opt out at any time.
• Website analytics cookies: your consent.

05. WHO WE SHARE IT WITH

We do not sell personal data. We share it only with:

• Service providers (sub-processors) that host and run the platform for us, under written contracts that require them to protect the data and use it only for us. For our EU deployment these are Microsoft (Azure in France, including Azure OpenAI in the EU Data Zone and email delivery), Deepgram (transcription through its EU endpoint) and Sentry (error monitoring, EU region). The current list for each deployment is available on request.
• The customer organization your account belongs to, which can see your account and activity within its MosaicVoice account.
• Professional advisers and authorities, where the law requires it or to protect our rights.
• A buyer or successor, if our business is reorganized or sold, under equivalent protections.

06. WHERE YOUR DATA IS PROCESSED

We run two separate deployments. Customers on our EU deployment have their platform data stored and processed in the European Union, on Microsoft Azure in France. Customers on our US deployment have their data stored and processed in the United States.

MosaicVoice, Inc. is based in the United States. Where personal data from the European Economic Area, the United Kingdom or Switzerland is accessed from or transferred to the United States, including when our support team needs to view data to resolve a support case, we use the European Commission's Standard Contractual Clauses, with the UK Addendum where relevant. You can ask us for a copy of these safeguards.

07. HOW LONG WE KEEP IT

• Call data: for as long as the customer's settings specify; customers can set automatic deletion per call flow. When a customer's contract ends, we delete or return its data within 30 days, and copies in backups expire within 35 days after that.
• Copies of AI prompts and responses kept for troubleshooting: 7 days.
• Account data: while the account is active, then deleted with the customer's data as above.
• Business contact and support records: for as long as the business relationship lasts, plus up to 3 years for legal and accounting purposes.
• Website analytics data: no longer than 14 months.

08. COOKIES

Our website and platform use cookies that are strictly necessary for sign-in, security and remembering your cookie choice. Our website also uses Google Analytics cookies to understand how visitors use it, but only after you click Accept in the cookie banner. If you click Reject, or make no choice, no analytics cookies are set. To change your choice, clear this site's data in your browser and the banner will ask again.

The MosaicVoice platform on our EU deployment does not use analytics or advertising cookies.

09. HOW WE PROTECT IT

We hold a SOC 2 report, encrypt data in transit and at rest, keep each customer's data isolated, support single sign-on, and limit our own staff's access to what their work requires. No system is perfectly secure; if a breach affects your data, we notify the affected customer and, where required, you and the authorities.

10. YOUR PRIVACY RIGHTS

Depending on where you live, including under the GDPR and UK GDPR, you have the right to:

• access the personal data we hold about you;
• have it corrected or deleted;
• restrict or object to how we use it, including objecting to direct marketing at any time;
• receive it in a portable format;
• withdraw consent where we rely on it, without affecting earlier processing;
• complain to a data protection supervisory authority, such as the one where you live or work. In Ireland that is the Data Protection Commission (dataprotection.ie).

To exercise these rights, email [email protected]. For call data, we will pass your request to the organization responsible for it (see section 02). We respond within one month.

California residents have similar rights under the CCPA/CPRA, including to know, delete and correct personal information. We do not sell or share personal information for cross-context behavioral advertising.

11. CHILDREN

Our services are for businesses and are not directed at children under 16. We do not knowingly collect their data as a controller.

12. CONTACT US

MosaicVoice, Inc., 6030 Colby St, Oakland, CA 94618, USA.

Privacy contact: Julian McCarty, [email protected]. General support: [email protected].