Keystone — Privacy Policy

1. Introduction

This Privacy Policy explains how Mosaic AI Technology Labs Ltd, a company incorporated in the Dubai International Financial Centre with registered number 14517 and registered office at IH-00-01-03-OF-05, Level 3, Innovation One, Dubai International Financial Centre, Dubai, United Arab Emirates (“Mosaic”, “we”, “us” or “our”) collects, uses, stores, shares and otherwise processes personal data in connection with Keystone, an artificial-intelligence assistant (the “Service”). Mosaic is the data controller responsible for the personal data processed through the Service.

Users access the Service using a Google or Microsoft account and may connect the Service to the limited set of tools described in this Policy. By accessing the Service and connecting these tools, you acknowledge the practices described in this Policy.

Keystone connects only to a WhatsApp Business account that you authorise. The contacts saved on that number and its one-to-one conversations (described in Section 3), and the CRM built from them, belong to your business — including the personal data of the customers who message you. Mosaic processes that data only to provide the Service to you, as your processor. Mosaic is the controller only of the account, identity and usage data described in Section 3.

We process personal data in accordance with the Data Protection Law, DIFC Law No. 5 of 2020 (the “DP Law”), which applies to Mosaic as a company incorporated in the Dubai International Financial Centre. Where users or data subjects are located in the European Economic Area, the United Kingdom, Switzerland or the United States, the additional regional rights and disclosures in Section 15 also apply. We also comply with the requirements of the platforms we integrate with, including the Google API Services User Data Policy (Section 8), Microsoft’s API terms and the WhatsApp Business Solution Terms (Section 9).

2. Who we are and how to contact us

Controller: Mosaic AI Technology Labs Ltd (DIFC registered number 14517)

Privacy contact: info@mosaicsolutions.ai

3. Personal data we collect and process

The Service connects to a deliberately narrow set of sources. We collect and process the following categories of personal data:

• Account and identity data — your name, work email address, organisation, role, profile image and the authentication identifiers and tokens used to sign you in. Sign-in is handled through Google OAuth or Microsoft OAuth; we receive only the identity information those providers return for authentication.
• Calendar data — accessed through Google OAuth (Google Calendar) or Microsoft OAuth (Microsoft 365 / Outlook Calendar), and only after you grant permission: event titles, times, locations and attendees, used to give you meeting context and briefings. The Service reads your calendar for meeting context and briefings. It creates a calendar event only when you ask it to book a meeting or approve a meeting it proposes, and it updates an event only to add context from your CRM to the description of an upcoming meeting with one of your clients. It does not delete calendar events.
• WhatsApp Business data — accessed through the official WhatsApp Business API, and only for the business number you connect: the names and phone numbers of the contacts saved in the WhatsApp Business app on that number; up to 180 days of one-to-one conversation history, if you choose to share it when you connect; and the content and metadata of the messages sent and received on that number from then on. Group chats are not accessed. Your saved contacts are added to your CRM as clients automatically, and you can remove and block any of them. The Service reads these messages to create and keep current the records in your private CRM. Access is read-only: the Service does not send WhatsApp messages or reply on your behalf.
• CRM data — the clients, requirements, listings, proposals, notes and related records stored in your CRM, which come from your connected WhatsApp account and from what you enter through the Service’s chat, voice input and file uploads. This CRM is private to you: it is visible only to your account and is not shared with other users or organisations.
• Usage and technical data — the queries and instructions you submit, interaction logs, and device and connection information.
• Conversation history — your conversations with the assistant, stored so you can return to them.

We do not intentionally collect special categories of personal data through the Service. Please do not submit such data unless it is necessary and lawful to do so.

4. How we use personal data and our legal bases

We use personal data to provide the Service’s features (reading and organising your connected WhatsApp Business conversations; creating and maintaining the clients, requirements, listings, proposals and notes in your private CRM; calendar context and meeting preparation; storing your conversations with the assistant so you can return to them; and account authentication); to personalise the Service to you; to operate, secure, maintain and improve the Service; and to comply with our legal and regulatory obligations.

Legal bases. We rely on the following legal bases, each of which is a lawful basis under Article 10 of the DP Law and, for data subjects to whom the GDPR or UK GDPR applies, under those laws:

The Service builds your CRM from your connected WhatsApp account and from what you enter through the Service’s chat, voice input and file uploads. These records are yours: you can review, edit and delete them at any time, and they remain private to your account.

5. Our role: controller and processor

For the account, identity, usage and conversation history data described in Section 3, Mosaic is the data controller.

For the WhatsApp conversations on your connected Business number, and the CRM records built from them — including the personal data of the customers who message you — your business is the controller and Mosaic acts as your processor. We process that data only on your instructions and only to provide the Service, under a data processing agreement covering security, confidentiality, sub-processors (Section 7), assistance with data-subject requests, and deletion when you ask us to or close your account.

6. Cookies and analytics

The Service uses cookies and similar technologies that are strictly necessary to authenticate you and maintain your session. We do not use cookies for third-party advertising.

7. How we share personal data — sub-processors

We share personal data with the service providers and sub-processors that host and operate the Service and provide its integrated functionality. Our current sub-processors are:

An up-to-date list of sub-processors is maintained at https://www.mosaicsolutions.ai/keystone/privacy#subprocessors. We also share personal data with professional advisers, regulators and authorities where required or permitted by law, and with a successor entity in connection with a merger, acquisition or sale of assets. We do not sell personal data, and we do not share personal data for cross-context behavioural advertising.

8. Google API Services — Limited Use

Keystone’s access to, and use, storage and sharing of, information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we use Google user data only to provide and improve the user-facing features of the Service that are prominent in the Service’s user interface, namely Google sign-in and calendar context;
• we do not transfer Google user data except as necessary to provide or improve those features (and then only with your consent), for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets;
• we do not use Google user data for serving advertising, and we do not sell Google user data;
• we do not use Google user data to develop, improve or train generalised or non-personalised artificial-intelligence or machine-learning models; and
• we do not allow humans to read your Google user data unless: (i) we have first obtained your affirmative agreement to view specific data; (ii) it is necessary for security purposes or to comply with applicable law; or (iii) the data has been aggregated and anonymised.

9. Microsoft and WhatsApp Business data

Microsoft. Where you sign in with Microsoft and connect your calendar, we access your Microsoft identity and calendar data through Microsoft OAuth and the Microsoft Graph API, solely to authenticate you, to provide calendar context and meeting preparation, and to create and update calendar events as described in Section 3. We handle this data in accordance with Microsoft’s API terms. We do not use it for advertising, we do not sell it, and we do not use it to train generalised or non-personalised artificial-intelligence or machine-learning models.

WhatsApp Business (Meta). We access the conversations on the business number you connect through the official WhatsApp Business API, in accordance with the WhatsApp Business Solution Terms and Meta’s platform policies. We use this data only to create and maintain the records in your private CRM and to provide the related features of the Service. Access is read-only. We do not use WhatsApp data for advertising, we do not sell it, and we do not use it to train generalised or non-personalised artificial-intelligence or machine-learning models. We do not allow humans to read your WhatsApp data unless you have agreed to it, it is necessary for security or to comply with law, or the data has been aggregated and anonymised.

10. Artificial-intelligence processing and our no-training commitment

The Service relies on a third-party artificial-intelligence provider, Anthropic (Claude), for the language processing that generates the Service’s responses. When you submit a query, or the Service prepares an output, relevant content is transmitted to this provider solely to generate the response or feature you have requested.

We do not use your content — including your Google and Microsoft calendar data, your WhatsApp conversations and your CRM data — to develop, train or improve generalised or non-personalised artificial-intelligence or machine-learning models, we do not train our own models on your content (including on de-identified content), and we contractually prohibit our artificial-intelligence provider from using your content to train or improve its own models.

Voice input is transcribed by OpenAI solely to turn your speech into text, under the same no-training terms. The recording itself is stored with your conversation so that you can play it back.

11. International data transfers

The Service and certain of our sub-processors operate outside the Dubai International Financial Centre, including in the United States. Where we transfer personal data outside the Dubai International Financial Centre, we do so in accordance with Articles 26 and 27 of the DP Law, relying on an adequate level of protection in the receiving jurisdiction or on the appropriate safeguards or other mechanisms that those Articles permit, together with contractual and organisational safeguards.

Where we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards, principally the European Commission’s Standard Contractual Clauses (together with the UK International Data Transfer Addendum and the Swiss addendum, as applicable), supported by additional measures where required.

12. Data retention

We retain personal data only for as long as necessary for the purposes described in this Policy or as required by law. Indicative retention periods:

You may disconnect any integration or revoke the Service’s access at any time — through your Google or Microsoft account settings, through the WhatsApp Business controls, or through the Service’s connection settings. On revocation, the Service will cease further access to the relevant data.

13. How to delete your data

You can delete your data in Keystone yourself:

• WhatsApp — in Settings → WhatsApp, disconnect your number. The Service stops adding contacts and messages from it; what has already synced stays until you delete your profile or ask us to delete it. To stop WhatsApp sharing data with the Service altogether, also end the connection in the WhatsApp Business app.
• Calendar — in Settings → Assistant, disconnect your calendar. This deletes the Service’s stored access to it.
• Individual clients — on a client’s page, choose Remove and block to take a client added from your WhatsApp contacts off your clients and block their number, so that the sync never adds it again. A client who has a requirement, or who was in your CRM before the sync, stays; their number is unlinked and blocked.
• Conversations — delete any conversation from the chat list with Delete chat.
• Clear all my data — in Settings → Account, under Danger zone, deletes your CRM records (clients, requirements, private listings, proposals and notes), your conversation history, notifications, matches and follow-up state. Your login stays, and usage records are kept in anonymised form.
• Delete profile — in Settings → Account, under Danger zone, does everything Clear all my data does and also deletes your login, your calendar access, and your connected WhatsApp numbers with the contacts and messages synced from them.

You can also email info@mosaicsolutions.ai from your account’s email address with the subject “Data deletion request”. We will delete your account’s data, including data received from Meta, Google and Microsoft, within 30 days and confirm by email.

14. Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration and loss, including access controls, encryption of data in transit and at rest, and the isolation of each user’s private CRM. We maintain procedures to address personal-data breaches and will notify affected parties and regulators where required by law. No system can be guaranteed to be completely secure.

15. Your rights

15.1 All users (DIFC DP Law)

Subject to the DP Law, you have the right to: withdraw consent at any time (Article 32); access, rectify and request erasure of your personal data (Article 33); object to processing, including direct marketing (Article 34); request restriction of processing (Article 35); receive your personal data in a structured, machine-readable format (Article 37); and object to decisions based solely on automated processing, including profiling (Article 38). To exercise these rights, contact us at info@mosaicsolutions.ai. You may also lodge a complaint with the DIFC Commissioner of Data Protection (Article 60).

15.2 EEA, UK and Switzerland (GDPR / UK GDPR / FADP)

If you are in the EEA, the UK or Switzerland, you have the rights to access; rectification; erasure; restriction of processing; data portability; to object to processing based on our legitimate interests and to direct marketing; and not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Where we rely on consent, you may withdraw it at any time without affecting prior processing. We aim to respond within one month. You also have the right to lodge a complaint with your local supervisory authority. The legal bases for our processing are set out in Section 4 and our transfer safeguards in Section 11.

15.3 United States (California and other states)

We do not “sell” your personal information, and we do not “share” it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act (as amended) and comparable state laws. The categories of personal information we process are described in Section 3 (identifiers, professional or employment-related information, commercial information, internet or electronic activity, and inferences). Subject to applicable law, you have the rights to know/access, delete, and correct your personal information; to opt out of sale, sharing and targeted advertising; to non-discrimination for exercising your rights; and to appeal a decision. You may use an authorised agent. To exercise these rights, contact us at info@mosaicsolutions.ai.

16. Children

The Service is intended for use by authorised business users and is not directed to children.

17. Changes to this Policy

We may update this Policy from time to time. If we change the way we use Google user data, we will notify affected users and obtain their consent to the updated Policy before using Google user data in the new way. The same applies to any material change in how we use your Microsoft or WhatsApp Business data.

18. Governing law

This Policy, and any matter arising out of or in connection with it, is governed by the laws of the Dubai International Financial Centre. The regional provisions in Section 15 grant additional statutory rights to data subjects in the relevant jurisdictions and do not change the governing law of this Policy.