Privacy Policy

1. Introduction

This Privacy Policy explains how Mosaic (“Mosaic,” “we,” “us,” or “our”) collects, uses, stores, discloses, and protects information when you:

• Visit the Mosaic website;
• Register for early access;
• Use Mosaic products or services;
• Connect a wallet or exchange account; or
• Communicate with us.

In this Privacy Policy, the website and all Mosaic products and services are collectively referred to as the “Services.”

2. Information We Collect

Information you provide

We may collect information that you provide directly to us, including:

• Your email address;
• The Mosaic products or features you are interested in;
• Information submitted through early access forms or free-text fields;
• Product preferences, account settings, and risk settings;
• Feedback, support requests, and other communications; and
• Any other information you choose to provide.

Connected-account information

When you connect a wallet, exchange account, or other supported trading account to Mosaic, we may collect or process:

• Wallet addresses;
• Exchange account identifiers;
• API keys, authentication tokens, or similar connection credentials;
• Account balances and available margin;
• Portfolio positions;
• Orders, fills, cancellations, and trading history;
• Execution, reconciliation, and account-status information; and
• Other data made available through the connected exchange, protocol, wallet, or trading venue.

Mosaic does not request or store withdrawal permissions for connected wallets or exchange accounts.

You should never provide Mosaic with a wallet seed phrase or private key.

Information collected automatically

When you access or use the Services, we may automatically collect certain technical and usage information, including:

• IP address;
• Browser type and version;
• Operating system and device information;
• Access times and session information;
• Pages and product features viewed or used;
• Referring pages or URLs;
• Authentication and security events;
• Error reports, performance data, and diagnostic logs; and
• Approximate location derived from your IP address, such as country or region.

3. How We Use Information

We may use information to:

• Process and manage early access registrations;
• Notify you when relevant Mosaic products or features become available;
• Provide, operate, maintain, and improve the Services;
• Authenticate users and maintain connected-account sessions;
• Retrieve balances, positions, orders, fills, and other account information;
• Operate paper-trading and simulated-execution functionality;
• Submit, modify, or cancel live orders when enabled and instructed by you;
• Reconcile trading activity between Mosaic and connected trading venues;
• Apply account limits, execution safeguards, and risk controls;
• Monitor performance, availability, capacity, and reliability;
• Diagnose and resolve technical or operational issues;
• Detect and prevent fraud, unauthorized access, abuse, and security incidents;
• Respond to questions, feedback, and support requests;
• Send product announcements, research notes, access invitations, and service communications;
• Analyze how users interact with the Services;
• Enforce our terms and other agreements; and
• Comply with applicable legal and regulatory obligations.

Where required by law, we process personal information on one or more of the following grounds:

• To perform a contract with you or take steps at your request;
• For our legitimate interests in operating, securing, and improving the Services;
• With your consent;
• To comply with a legal obligation; or
• To protect the rights and safety of Mosaic, our users, or others.

4. Data Storage and Security

We use administrative, technical, and organizational safeguards designed to protect information from unauthorized access, loss, misuse, alteration, or disclosure.

These safeguards may include:

• Encryption of connection credentials in transit and at rest;
• Access controls and authentication measures;
• Restrictions on access to sensitive information;
• Security monitoring and operational logging;
• Separation of production systems and access permissions; and
• Procedures for identifying and responding to security incidents.

API keys and similar connection credentials are accessible only to the systems and personnel that require them to operate the relevant Services.

No system, network, or storage method is completely secure. We therefore cannot guarantee the absolute security of information processed through the Services.

You are responsible for protecting access to your devices, email account, wallets, exchange accounts, and other credentials used in connection with Mosaic.

5. How We Disclose Information

We do not sell your personal information.

We may disclose information in the following circumstances.

Service providers

We may provide information to vendors and service providers that help us operate the Services, including providers of:

• Cloud hosting and infrastructure;
• Databases and data storage;
• Authentication and security;
• Monitoring and error reporting;
• Analytics;
• Email and communications; and
• Customer support.

These providers may process information only for the purposes of providing services to Mosaic and subject to applicable contractual obligations.

Exchanges and trading venues

When you connect an account or use connected-account functionality, we may transmit information and instructions to supported exchanges, protocols, wallets, and trading venues, including Hyperliquid, Lighter, and other venues supported by Mosaic.

This may be necessary to:

• Authenticate a connection;
• Retrieve account and trading information;
• Submit, modify, or cancel orders;
• Reconcile orders and executions; or
• Provide other functionality requested by you.

Legal requirements

We may disclose information when we reasonably believe that disclosure is necessary to:

• Comply with applicable law, regulation, court order, subpoena, or legal process;
• Respond to a lawful request from a public authority;
• Establish, exercise, or defend legal claims;
• Investigate suspected fraud, abuse, or unlawful conduct; or
• Protect the rights, property, privacy, or safety of Mosaic, our users, or the public.

Business transfers

Information may be disclosed or transferred as part of a merger, financing, acquisition, reorganization, sale of assets, insolvency proceeding, or similar business transaction.

With your direction or consent

We may disclose information when you direct us to do so or otherwise provide your consent.

6. Cookies and Similar Technologies

Mosaic may use cookies, local storage, and similar technologies that are necessary to:

• Keep the website and Services functioning;
• Maintain sessions and authentication;
• Remember preferences;
• Protect against fraud and unauthorized access;
• Understand website and product usage; and
• Diagnose errors and improve performance.

You may be able to control cookies through your browser settings. Blocking certain cookies or storage technologies may prevent parts of the Services from functioning correctly.

Where required by law, Mosaic will request consent before using non-essential cookies or similar technologies.

The landing website uses PostHog for cookieless analytics, including page views and limited product-access funnel events. The landing website does not send email addresses or form values to PostHog.

7. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy.

The relevant retention period may depend on:

• Whether your registration or account remains active;
• Whether a wallet or exchange account remains connected;
• The type and sensitivity of the information;
• Operational, security, fraud-prevention, and dispute-resolution requirements;
• Applicable legal, accounting, or regulatory obligations; and
• The need to establish, exercise, or defend legal claims.

Connection credentials may be retained while the relevant account remains connected or while they are otherwise required to provide the Services.

Trading, execution, reconciliation, and security records may be retained after an account is disconnected where reasonably necessary for operational, analytical, security, compliance, or dispute-resolution purposes.

When information is no longer required, we may delete, aggregate, or anonymize it. Information may remain temporarily in backups until those backups are overwritten or securely deleted.

8. Your Rights and Choices

Depending on where you live, you may have the right to:

• Request access to personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Request deletion of personal information;
• Request a portable copy of certain information;
• Request restriction of certain processing;
• Object to certain processing;
• Withdraw consent where processing is based on consent;
• Unsubscribe from non-essential marketing communications; and
• Lodge a complaint with an applicable data-protection authority.

You may disconnect a wallet or exchange account through the relevant Mosaic product interface where that functionality is available.

Disconnecting an account prevents new information from being retrieved through that connection, but it does not necessarily delete information already processed or retained by Mosaic.

To exercise a privacy right, contact us at hello@mosaictrading.xyz.

We may ask you to verify your identity before completing a request. Certain rights may be limited where an exception applies or where retaining information is required for security, fraud prevention, legal compliance, recordkeeping, or the establishment or defense of legal claims.

9. Marketing Communications

You may unsubscribe from marketing and promotional emails by following the unsubscribe instructions included in those messages or by contacting us.

Even if you opt out of marketing communications, we may continue to send important operational messages, such as security notices, account notifications, execution alerts, or changes to the Services or applicable terms.

10. International Data Transfers

Mosaic and its service providers may process information in countries other than the country where you live.

Those countries may have data-protection laws that differ from the laws in your jurisdiction. Where required, we use appropriate safeguards for international transfers of personal information.

11. Third-Party Services

The Services may connect to or contain links to third-party exchanges, protocols, wallets, websites, and other services.

Those third parties operate independently from Mosaic and maintain their own terms, privacy policies, and security practices. Mosaic is not responsible for how third parties collect, use, disclose, or protect information.

We use PostHog, hosted in the European Union, to measure website usage and improve the landing experience. PostHog receives cookieless analytics events configured by Mosaic and does not receive email addresses or submitted form values from the landing website.

You should review the terms and privacy policies of any third-party service before connecting an account or using that service through Mosaic.

12. Children's Privacy

The Services are intended only for users who are at least 18 years old or the minimum legal age required to use the Services in their jurisdiction, whichever is higher.

We do not knowingly collect personal information from children. If we learn that personal information has been collected from a person who is not legally permitted to use the Services, we will take reasonable steps to delete it.

13. Additional Rights in Certain Jurisdictions

European Economic Area and United Kingdom

Where applicable, users in the European Economic Area or United Kingdom may have rights under local data-protection law, including rights of access, correction, deletion, restriction, portability, objection, and the right to lodge a complaint with a supervisory authority.

Where processing is based on legitimate interests, you may request further information about how those interests are balanced against your rights.

California

Where applicable, California residents may have rights to:

• Know what categories of personal information are collected, used, or disclosed;
• Request access to specific pieces of personal information;
• Request correction or deletion;
• Opt out of the sale or sharing of personal information; and
• Exercise privacy rights without unlawful discrimination.

Mosaic does not sell personal information.

14. Changes to This Privacy Policy

We may update this Privacy Policy as Mosaic, its products, or applicable legal requirements evolve.

When changes are made, we will update the date at the top of this page. Where required or appropriate, we may also provide notice through the website, within the Services, or by email.

We encourage you to review this Privacy Policy periodically.

15. Contact Us

For questions, requests, or concerns regarding this Privacy Policy or Mosaic's handling of personal information, contact:

Email: hello@mosaictrading.xyz