Privacy statement

In short

• Your mosaic is made in your own browser.
• Your photos only reach us when you order, save your mosaic in your account, share a link to your mosaic, take part in a group mosaic yourself or send them from your phone to the maker.
• After that they are deleted automatically: after 90 days for an order, after 14 days if you save them, after 90 days if they are in a mosaic you share a link to (counted from sharing or from the last order through the link), 3 months after closing for a group mosaic, and within 24 hours if you send them from your phone.
• We only use your photos to make your mosaic: never for anything else, and never to train AI.
• No advertising or tracking cookies; our servers are in the EU (Frankfurt).

What data and why

We only use your data for the purposes in this statement and never sell it.

Newsletter: we only email you tips and offers if you have asked for them yourself, by ticking the box when you order or by using the sign-up form on the site (in that case you first confirm your sign-up via a link we email you). You get at most 2 emails a month. You can unsubscribe at any time, free of charge: with one click on the unsubscribe link at the bottom of every email, or by emailing us. We keep a record of when and how you signed up or unsubscribed, as proof of your consent.

In our emails we only measure whether they arrive and which links you click, so that we know what readers find interesting. We do not store anything on your device for this. We do not measure whether you open an email.

Have you ordered from us before without signing up for our newsletter? Then we will send you no more than one email asking whether you would like to keep receiving emails from us. If you do not say yes, we will not send you any more newsletters after that.

• Your photos: your mosaic is made in your own browser; your main photo and small photos stay on your own device until you order something. Only when you order do we receive them, to make and deliver your order.
• Photos from your phone: if you choose 'Photos on your phone? Send them here' in the maker on your computer, your phone sends copies of the photos you choose there (not the originals, and without location data) via our server to the maker on your computer. They are only used in your own maker.
• Sharing a link to your mosaic: if you choose 'Share' and create a link, we receive your main photo and small photos, together with an image of your mosaic. Anyone with the link can see your mosaic, zoom in on the small photos and also order it, if you leave that option switched on. Search engines will not find the page.
• Group mosaics: if you take part in an organiser's mosaic, you yourself use the 'Send' button to send a smaller copy of the photos you choose (without location data), optionally with your name and a short message. These are only for that mosaic; the organiser decides what happens to them. For a club, school or company, the organiser arranges consent and we process the photos on their behalf. We do not email participants, except for one email, sent when the mosaic is ready, to anyone who asks for it on the page. We use that email address only for this and delete it straight afterwards (or, if none is sent, together with the photos).
• Other people in your photos: if others appear in them, we only process their image to make and deliver your order, and for no longer than stated below. So only use photos you are allowed to use for this.
• Your ordered mosaic: before it is printed, it is checked automatically and, if needed, we look at it ourselves, so that the print turns out well.
• Your email address: for the confirmation and the status of your order and, if you log in, for your login code.
• Your name and address: only for a print, to deliver it.
• The texts you put in a video: to make your video.
• Order details (what, when, amount): for delivery, customer service and our accounts.
• Your emails to our customer service: to answer your question.

On what legal basis

Your email address is needed to confirm and deliver your order, and for a print also your name and address. Without this data we cannot carry out your order.

• Making and delivering your order, and answering your questions about it: the performance of the contract with you.
• Our accounts: a legal obligation (the statutory obligation to keep tax records).
• Preventing misuse of codes and gift cards and securing the site: our legitimate interest in a secure web shop.
• The newsletter and 'Save to my account': your consent, which you can always withdraw. The one-off email to previous customers asking whether they still want emails from us: our legitimate interest.

How long we keep data

• Photos you do not order: they stay on your own device only. Unless you choose 'Save to my account' yourself: then we keep them with your account for 14 days, so you can continue where you were, and delete them automatically afterwards (or sooner, if you delete the mosaic yourself). Or if you send them from your phone to the maker: then we delete them as soon as they are in the maker on your computer, and otherwise automatically within 24 hours. Or if you share a link to your mosaic: then we keep the link's page and what an order through the link needs (the mosaic, the main photo and the small photos in it) for 90 days from sharing, and delete them automatically afterwards. If someone orders the mosaic through the link, those 90 days start again, and we keep it for 90 days for that order. If you stop sharing earlier, the link stops working straight away and we delete those files, except what is needed for an order placed through the link. Photos that are not in the mosaic are deleted after 14 days, as always.
• Photos for a group mosaic (with names and messages): until 3 months after collecting closes, then deleted automatically (or sooner, if a participant removes their own photo while collecting is still open; a photo that is already in a shared or ordered mosaic stays in it). If the organiser deletes the mosaic, we keep the photos for up to 7 days after deleting, so an accidental deletion can be undone; after that they are gone. We keep an ordered mosaic for 90 days for that order.
• The photos of an order: 90 days (14 days for a free video or an order that is not paid). After that they are deleted automatically.
• Your digital file: 3 months, as long as your download link works.
• Your video: a paid video for a year, the free video for 3 months.
• Your name and address: until 60 days after shipping, for delivery and any questions about it. After that they are deleted; only the country stays with the order, for VAT.
• Orders (what, when, amount, country and email address): 7 years, because the law requires this for our accounts.
• Emails to our customer service: 2 years.
• Your newsletter sign-up: as long as you are signed up; the record of when you signed up and unsubscribed: 2 more years after that. Delivery data for each email (delivered, clicked): 25 months. After you unsubscribe, we only keep an encrypted code of your email address, so that we never email you again by mistake.

Who we share data with

Only with parties we need to carry out your order, with agreements on security and confidentiality:

• Amazon Web Services (storage and processing, and sending confirmations, login codes and our newsletter, in the EU – Frankfurt);
• Adyen (payments; to prevent fraud, Adyen also receives your email address and the IP address you pay from);
• Print API and the carrier (printing and delivering your print);
• Vimeo, an American company (the videos of our previous website, until 3 April 2027 inclusive): if you watch such a video, your browser loads Vimeo's video player and Vimeo receives your IP address. We ask Vimeo not to set tracking cookies when you do;
• Anthropic (Claude, an AI assistant that helps us answer your emails; the assistant can answer simple questions itself, for example about how it works, but Bram reads along and can stop any reply; Bram always answers questions about money, complaints and privacy himself). Anthropic processes the text of your email in the United States, under the European Commission's standard contractual clauses; you can request a copy of these safeguards from us. Anthropic does not use this data to train its AI, and we do not share attachments such as photos.

Cookies

We only use functional cookies: one to link your orders to your browser and, if you log in, one to keep you logged in. If you're signed up for our tips and offers, your browser remembers this, so we don't keep asking you to sign up; if you come to the site through a link in one of our emails (or confirm your sign-up), it does so with a 180-day cookie that only contains a secure code, not your email address. We use this for nothing else, and we do not use advertising or tracking cookies.

To improve the site we count anonymously how often the site is visited and how often the steps in the maker are used. For this we use the cookie that links your orders to your browser only in encrypted form (as a code that cannot be traced back to you). We keep numbers per day and which page a visitor is on right now, whether they use a phone or a computer and which site they came from (only the latest), and which steps a visitor takes today, with an anonymous code that changes every day; we delete those steps automatically after 48 hours. No IP address and nothing that tells us who you are. We do not use Google Analytics.

If you arrive via a link in one of our posts or ads, we count how many visits that link brings each day, and your browser remembers the campaign name from that link for up to 7 days (in the browser itself, not in a cookie); if you order within that time, we save that name with your order, so we can see which post or ad led to it.

If you arrive via an AI assistant such as ChatGPT or Perplexity, your browser remembers only that assistant's name for up to 7 days (in the browser itself, not in a cookie); if you order within that time, we save that name with your order for our statistics. The name tells us nothing about who you are.

Security

Your photos are stored securely and can only be seen through temporary, personal links. All connections are encrypted. We do not store IP addresses with your photos.

To prevent guessing of codes and gift cards, we count how often a wrong code is entered from an internet address. We only keep that address encrypted and for no more than 2 days.

Like every website, our hosting (Amazon CloudFront) keeps a log of the requests to the site, so we can investigate faults and misuse: the time, the page requested, whether it worked, the type of browser, and the country and internet provider the request came from. Your IP address is not in it, nor is what comes after the question mark in a link (such as the personal code of your order). This log is deleted automatically after 7 days. In addition, our firewall (AWS WAF) keeps a small sample of the requests for about 3 hours, including the IP address, so that attacks can be recognised; after that it is deleted automatically.

A video has its own viewing page with a link that is hard to guess. Anyone who has that link can watch the video, so only share it with people you want to.

Your rights

You may view your data, have incorrect data corrected, have your data deleted or its processing restricted, and request a copy in a common file format. You may object to processing based on our legitimate interest, and to emails about our products at any time. You can always withdraw your consent.

Email info@easymoza.com for this. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the data protection authority in your country.

If you are logged in, you can download all your data and delete your account yourself in your account. When you delete it, we erase your account, your saved mosaics with their photos, your emails to our customer service from that email address, your sign-up for our emails, and your name, address and email address on orders that were not paid. If a payment dispute is ongoing, or a complaint or refund request has not yet been dealt with, we keep the related conversations with our customer service until the matter has been settled. Links you used to share a mosaic or video stop working. We keep paid orders for 7 years, because the law requires this for our accounts; their photos and files are deleted after the periods above. So that we never email you again by mistake, we then keep only a hash of your email address (an unreadable code).

We do not make decisions about you that are made solely by a computer. Bram always decides on money, complaints and privacy himself. The AI assistant can answer simple questions itself; Bram reads along and can stop any reply.