What we collect, why, and how long we keep it.

The data controller for Mosaic is:

• Service

  Mosaic (the product formerly known as fletushka) — a catalogue-template SaaS operated by Quad Tech.

• Operator

  Quad Tech — the operating entity that provisions Mosaic, signs contracts, and answers privacy requests.

• Contact

  For any privacy question, email privacy@quadtech.dev (see the Contact section at the bottom of this page).

• Where we run

  Application code runs on Cloudflare's global edge network. Persistent data lives in PostgreSQL (Neon) and object storage (Cloudflare R2) — see the Subprocessors section for the full list and where each type of data is stored.

Everything Mosaic actually stores, grouped by bucket. If a field isn't on this list, we don't store it.

• Account basics

  Email address, display name, hashed password (Argon2/bcrypt via Better-Auth) if you signed up with email and password, role, and the org you belong to. If you signed up with Google, see the Google services section.

• Session data

  Better-Auth session records (server-side, hashed token in an HttpOnly cookie), and a short-lived signed JWT (`session-jwt` cookie) that we mint for stateless authentication on oRPC requests.

• Organizations

  Org name, slug, members and their roles, subscription tier assignment. The "platform" org (`quad`) holds the global admin role; everything else is tenant-scoped.

• Catalog content

  Products (name, SKU, barcode, price, family), templates (canvas state, layers, bound fields), and assets (image metadata, byte storage in R2, SHA-256 checksums).

• Imports & renders

  CSV/XLSX files you upload (stored in the `catalog-imports` R2 bucket, deleted after import completes), rendered PNG outputs (stored in `catalog-renders` until you delete them or the export).

• Derived assets

  If background-removal is enabled (env-gated, opt-in by org), the cleaned-up variant image and a link back to the original. The provider only sees the bytes you send for that one operation.

• Messaging data (if used)

  If a member enables email/SMS/WhatsApp/Viber delivery for an export, the destination address or phone number, the message body, and delivery state — only for the chosen channel and only when triggered.

• Audit & observability

  Request logs (path, status, latency, hashed user id), structured trace events for the auth pipeline, and Worker analytics — kept for 30 days.

• No transfer to third parties

  We do not transfer Google user data to third parties except to the subprocessors named below, and only as far as needed to provide the feature you requested.

• No advertising or marketing use

  We do not use Google user data for serving advertisements, including retargeting, personalised or interest-based advertising, or marketing of any kind.

• No profiling or market research

  We do not use Google user data to profile users, train or improve a model, conduct market research, or build audience segments.

• No human reading without need and audit

  Mosaic employees do not read your account content, templates, assets, or Drive exports unless you have given us written permission to debug a specific support ticket, or the access is required for legal/security reasons and is logged.

• Deletion on disconnect and on request

  Disconnecting either Google integration deletes the related tokens immediately. Deleting your Mosaic account deletes all associated Google-derived data (Google sub, profile fields, encrypted Drive tokens) within 30 days, subject to the Retention section below.

• Application runtime

  Cloudflare Workers — runs at the edge closest to the request. No state.

• PostgreSQL (Neon)

  Configurable region per deployment. EU by default for our hosted instance; primary and read-replica in the same region.

• R2 object storage

  Region configured per bucket on the Cloudflare side. Assets bucket is configured EU for the hosted instance; we publish the current region in the admin footer of the dashboard.

• Backups

  Neon point-in-time recovery for Postgres (35 days). R2 versioning enabled for the assets and renders buckets — overwritten or deleted objects can be recovered by us within 30 days.

• Active account

  Kept while your account is active. You can export your data at any time from Settings → Export.

• Account deletion

  Soft-deletes your user record and org memberships on request, hard-deletes from Postgres within 30 days, and removes all associated binary data (assets, imports, renders) from R2 within the same window.

• Disconnecting a Google integration

  Tokens are deleted immediately. Derived data (your Google sub on the user record, profile picture cache) is deleted with the account.

• Logs & traces

  30 days, then automatically purged. Aggregated, non-personal counters may live longer (e.g. "total exports last month") but never contain user content.

• Backups

  Removed as the underlying backups rotate out, within 35 days for Postgres and 30 days for R2 versioning.

• Encryption in transit

  TLS 1.2+ everywhere. Cloudflare terminates TLS at the edge; oRPC and Better-Auth are HTTPS-only.

• Encryption at rest

  Neon Postgres encrypts at rest by default. R2 encrypts at rest by default. OAuth refresh tokens are additionally encrypted with AES-GCM (`TOKEN_ENCRYPTION_KEY`) before write.

• Access control

  Permix-based role checks on every oRPC endpoint (`admin`, `manager`, `member`, scoped to your org). The platform org (`quad`) is the only one that can hold the `admin` role.

• No human reads without need

  Employees access user data only to respond to a support ticket you've filed, to fix a reproducible bug you've reported, or to comply with law. Every such access is logged.

• Vulnerability reporting

  Email security@quadtech.dev with details. We acknowledge within 2 business days and aim to ship a fix or mitigation within 30 days for confirmed issues.

Regardless of where you live, you have at least these rights:

• Access

  Ask for a copy of the personal data we hold about you. Use Settings → Export, or email privacy@quadtech.dev.

• Correction

  Update your name, email, and most fields from Settings. For anything you can't change yourself, email us.

• Deletion

  Delete your account from Settings → Danger zone, or by emailing privacy@quadtech.dev. Hard-delete within 30 days.

• Portability

  Export bundles include your products, templates, assets, and audit log as JSON + CSV + ZIP of binaries.

• Withdraw consent

  Disconnect Google, disable messaging channels, or close your account at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

• Complain

  If you believe we've mishandled your data, email privacy@quadtech.dev. EU/UK residents may also complain to their local data-protection authority; we'll cooperate with any investigation.