Privacy Policy
On this page
1. Scope and responsibility
Mosaic AI Labs, Inc. operates Motion. This policy covers Motion's web and mobile apps, Library backup, agents, APIs, integrations, Community, and related Mosaic services that link to it. Contact [email protected] or Mosaic AI Labs, Inc., 660 York Street, San Francisco, CA 94110, United States.
We act as controller where we determine why and how account, billing, security, and service-operation information is processed. Customer content processed solely on an organization's instructions may instead be governed by its data-processing agreement. Contact your workspace administrator for processing it controls; we can help direct requests.
2. Information and sources
Account and contact information includes names, emails, account identifiers, sign-in information, membership, preferences, support requests, and communications supplied by you, an organization, or a sign-in provider.
Content includes prompts, messages, uploaded photos, videos and audio, projects, outputs, editing history, feedback, captions, thumbnails, embeddings, search indexes, and memories used by requested features. Media may contain faces, voices, location, or information about other people. Metadata includes filenames, sizes, duration, dimensions, capture dates, device information, and backup deduplication identifiers.
Transaction information includes plans, invoices, billing and tax details, purchases, balances, usage, payment status, and limited payment-method details from billing providers. Payment providers process full payment credentials under their own notices; never send those credentials to support.
Technical information includes IP addresses, browser and app versions, device and network information, timestamps, feature activity, errors, operational logs, and diagnostics. Optional analytics and referral attribution collect activity and referral identifiers according to your choices. Connected-service information includes access tokens, permissions, identifiers, and files or publishing information made available through an authorized integration. The feature and permissions determine the scope.
We receive information directly from you and from the operation of requested features. Other sources include a sign-in provider, a connected account you authorize, a payment or billing provider, a workspace administrator, a person sharing content with you, and a referral or support interaction. What we receive depends on the feature and the permissions involved.
Project context and derived information can include generated descriptions, transcripts, tags, vector representations, and saved preferences used to retrieve content or continue work. Derived information may be inaccurate and may still identify you. You can contact us about an incorrect inference or an item that is being retained or used unexpectedly.
3. Uses and legal bases
We use information to create and secure accounts, provide and bill for Motion, store and retrieve content, execute requested AI operations, manage integrations, deliver support, and communicate about purchases or service changes. Where GDPR applies, processing necessary to perform our contract or take requested pre-contract steps relies on that basis.
We may use usage information, feedback, and relevant prompts, media, outputs, and project context to understand performance, investigate problems, assess output quality, and improve Motion's features, reliability, and safety. This can include automated checks and review by authorized personnel or providers working on our behalf. We limit information and access to what is appropriate for the purpose and respect applicable agreements and privacy choices. These uses do not include training or fine-tuning AI models with your personal information or customer content.
Service reliability, troubleshooting, product improvement and evaluation, security, abuse prevention, and protecting legal rights may rely on legitimate interests, balanced against your rights, where permitted. Product improvement is not automatically necessary to perform every customer contract. Required accounting, tax, regulatory, and lawful-request processing relies on legal obligations. Uses requiring consent, including certain tracking, marketing, sensitive-data processing, or permissions, require a separate choice that can be withdrawn. Withdrawal does not change the lawfulness of prior processing.
Required account and transaction information is needed to supply the Service. Optional tracking or marketing is not a condition of unrelated core functionality. Accepting the Terms, signing in, or granting device access is not consent to every analytics or marketing use.
4. Photos, voices, sensitive information, and biometric uses
Photos, videos, audio, and project text can reveal sensitive matters even when you did not intend them to. Faces and voices can be processed for generation, transcription, editing, or search. A photograph or voice recording is not automatically a biometric identifier in every jurisdiction, but some derived measurements or uses can be specially regulated.
Do not submit government identification numbers, complete financial credentials, medical records, biometric identification templates, or similarly sensitive material unless you have authority and an appropriate supported feature or agreement. Do not use Motion to identify or authenticate people from biometric characteristics or build a surveillance database. For features involving another person's likeness or voice, obtain their required permission and provide any legally required notice.
Required biometric or sensitive-data consent must be specific to the processing and obtained separately where law requires. General Terms acceptance or permission to access a photo library does not authorize every face, voice, or identification use. The relevant feature must provide any required notice, retention information, and choice before processing. Contact [email protected] about such processing, withdrawal of consent, or deletion.
Retention of original media, derived information, and provider copies can differ. We do not promise that all face or voice processing is transient or that all derived information is immediately destroyed. The retention and deletion provisions below apply together with any more specific feature notice and stricter legal requirement. Declining an optional sensitive-data feature does not prevent use of unrelated features.
5. Providers, AI, and sharing
Motion uses Google Cloud Storage to store uploaded media, project assets, previews, and generated outputs. Supabase handles authentication and account, project, and application records. Railway hosts the web application, APIs, and background services; Modal runs compute-intensive media processing and video rendering; and Cloudflare supports domain management and access infrastructure.
Payment and subscription providers process payments and manage subscriptions, usage, credits, and entitlements. Analytics providers support usage measurement and troubleshooting, subject to the privacy choices described below. Email providers deliver transactional messages, such as invitations and service notices. Support information can also be handled in email and collaboration systems.
AI and media features send relevant prompts, media, project content, or derived data to the providers needed for the selected feature. Google Vertex AI provides Gemini processing for supported text, image, audio, and video inputs. OpenAI and Anthropic provide models for supported content creation and editing; fal.ai generates images and video; Deepgram supports voice input and transcription; and ElevenLabs generates voiceovers and audio. Exa searches the web and retrieves information for research and creative context, while Firecrawl retrieves website content and screenshots for reference.
We use providers to perform requested processing and the limited product-quality, troubleshooting, and safety activities described in this policy. We do not use your personal information or customer content to train or fine-tune AI models, and we do not permit AI providers processing that information on our behalf to do so. Processing locations and retention periods can vary by provider and feature; no-training does not mean no processing or zero retention.
Eligible Motion Enterprise configurations can support a zero data retention option through applicable Vertex AI processing and agreed handling of temporary content. The enterprise agreement defines the covered content, enabled features, processing providers, and any required operational records. Enterprise terms can also define permitted AI providers, access permissions, data location, retention and deletion, and data return or export where supported. Applicable third-party no-training terms are documented for the agreed configuration. Contact us before submitting data that requires specific contractual restrictions, or to request a data-processing agreement and available security documentation. Applicable signed agreements control.
Sharing links, collaboration, integrations, publishing, and Community disclose information according to your instructions and selected audience. Community submissions remain private from the feed pending moderation. Recipients can retain copies outside our systems. We may also disclose information to comply with law, protect safety and legal rights, investigate abuse, or carry out a corporate transaction with applicable safeguards.
We do not sell personal information for money. Some privacy laws also treat disclosures in exchange for other valuable consideration as a sale. California's defined term 'sharing' concerns cross-context behavioral advertising; it does not mean every disclosure to a service provider. Optional browser affiliate tracking is subject to your choice, and Global Privacy Control disables optional browser tracking on the sites with these controls. Contact us to exercise broader applicable opt-out rights.
A provider may act on our instructions for one activity and independently for another, such as your payment provider's fraud prevention or a platform you connect. Its own notice explains independent processing. We share information relevant to the activity, rather than giving every listed vendor every category of information. A provider example in this notice is not a representation that it handled your particular project.
6. Product improvement and no model training
We do not use your personal information or customer content to train or fine-tune AI models. Customer content includes your prompts, messages, uploaded photos, videos and audio, projects, and generated outputs. This commitment also covers copies and derived material used as training data; removing names or account identifiers does not create an exception.
We improve Motion through activities such as fixing bugs, measuring speed and reliability, investigating failed operations, assessing the quality of results, and improving interface and workflow behavior. Relevant content may be processed for those limited purposes as described above, but is not used as model-training material. Access is limited to authorized personnel and providers with a need to perform the activity, subject to applicable agreements, privacy choices, and law.
Using an existing model to generate a response, transcribe media, create an embedding, or retrieve project context is processing needed for a feature; it is different from training or fine-tuning a model on that information. The no-training commitment does not prevent that requested processing or mean that all content is immediately deleted. The retention and deletion provisions below continue to apply.
No model-training opt-out is needed because we do not use this information for model training. Optional browser tracking remains subject to Cookie settings. You may also exercise applicable rights to object to processing, withdraw consent for consent-based uses, or request deletion by contacting [email protected].
7. Public content, organizations, and external destinations
Public posts and profile details can be seen and copied by other users and visitors, and may be indexed where the feature permits public access. Private sharing can also disclose information to recipients you select. Review the audience, accompanying account information, and destination before publishing. We cannot control independent recipients' copies, but will assess requests about information within our control and applicable obligations to notify recipients.
For a supported organizational workspace, administrators and members can access information according to their roles. The organization may be responsible for its own processing of employee or customer information. Direct requests concerning that organization's decisions to it; contact us if you need help identifying the appropriate route.
Third-party websites, payment pages, embedded resources, and connected platforms have their own practices. Following a link or instructing an agent to use a destination may disclose information to it. Our notice does not govern an independent third party. Disconnecting access does not automatically delete information already delivered there.
9. Communications and information that no longer identifies you
We use account contact information for requested support, service changes, billing, security, and rights-request responses. Optional marketing follows the permissions and opt-out requirements that apply to it. Unsubscribe using the message's available control or contact [email protected]. Opting out of marketing does not stop a necessary receipt, security notice, or reply to your request.
We may combine or summarize information to understand Motion's reliability and use. Removing a name does not necessarily make information anonymous: account hashes, device identifiers, and linkable usage histories can still be personal information. Where we treat information as legally de-identified or anonymous, we take reasonable measures against identification, maintain it in that form, do not attempt to re-identify it except for legally permitted testing of those measures, and require recipients to follow applicable restrictions on re-identification. Otherwise this policy continues to apply. Creating a summary does not override the no-training commitment above.
10. Retention and deletion
Retention depends on the purpose, account or asset status, feature, accounting and tax requirements, security or fraud risks, disputes, and provider or backup constraints. We retain information only as long as needed for those purposes. Contact us for the period or criteria applicable to your data; there is no universal retention period for all systems.
Delete Library assets or request account deletion in Motion settings or by contacting us. Library deletion starts removal of the cloud copy, analysis, and indexes. Account deletion disables the shared Mosaic identity and access across Motion, Canvas, and other Mosaic products, cancels active Motion subscriptions, and starts deletion of private Motion projects and Library assets. Processing runs asynchronously across storage, databases, analytics, memory, and connected providers, with retries after failures. Sign-out or acceptance of a deletion request does not mean every downstream copy has been erased.
Financial, security, deletion-request, and dispute records may be retained for legal obligations or legal claims. Limited identifiers may be retained to prevent account or billing recreation and promotion abuse, subject to an appropriate basis and retention limit. Hashed or pseudonymous identifiers can still be personal information. These exceptions do not permit indefinite retention of all content.
Backups and storage recovery versions can persist until their retention period expires. Where erasure applies, backups must be restricted from ordinary use and deletion reapplied after restoration. Other Mosaic products, team workspaces, published posts, and other people's authorized copies may require separate assessment; sharing is not an automatic exemption from privacy rights. We explain relevant scope and exceptions in responding.
11. Your rights
Depending on law, rights may include access, a copy, correction, deletion, restriction, portability, objection, consent withdrawal, or opting out of sale, sharing, targeted advertising, or certain profiling. Rights concerning sensitive information and automated decisions may also apply. Contact [email protected]; no statutory citation or special wording is needed. Identity and authorized-agent checks must be proportionate and avoid unnecessary data collection.
For GDPR requests we respond without undue delay and generally within one calendar month. Where legally permitted for complex or numerous requests, we explain an extension within that month and may take up to two additional months. Covered California access, correction, and deletion requests usually have a 45-day response period, with a permitted extension and notice where applicable. Other requests may have shorter deadlines; the applicable deadline controls.
We do not discriminate or retaliate for exercising rights. We explain any lawful exception to a request. You may complain to your local data-protection authority, including an EEA supervisory authority or the UK Information Commissioner's Office. Reply asking for review or appeal if you disagree; statutory appeal rights remain available. Deletion does not require abandoning a refund claim, and billing disputes do not suspend privacy rights.
12. California and other US state privacy rights
If a state privacy law covers our processing of your information, its rights and exceptions apply in addition to this notice. Depending on the law, you may request access to categories or specific information, correction, deletion, a portable copy, information about recipients, or an opt-out from sale, sharing, targeted advertising, or certain significant profiling. Additional limits or consent requirements can apply to sensitive personal information.
The information categories described above include identifiers and contact details; customer-account records; commercial and transaction information; internet, device, and service activity; uploaded audio, visual, and other electronic content; work or organizational details supplied to us; and derived information such as tags or preferences. Sensitive information can occur in credentials, private communications, or material you choose to supply. This is a description of categories, not a statement that every category is collected about every person.
Sources, purposes, recipients, and retention criteria are described in the corresponding sections. You may request the disclosures and applicable historical lookback required by your law, including relevant categories of information collected or disclosed. A generic reference to providers does not replace a legally required response concerning your information.
We do not sell personal information for money. Broader legal definitions can include disclosures for other valuable consideration and certain disclosures through affiliate or advertising technologies. Use Cookie settings or Global Privacy Control for the covered browser tracking, and contact [email protected] for an applicable sale, sharing, or targeted-advertising opt-out beyond that browser. We assess the actual processing and applicable law; an ordinary Terms agreement is not permission to disregard an opt-out.
Submit access, correction, deletion, portability, sensitive-information, or appeal requests to [email protected]. You may use an authorized representative where permitted. We may verify identity and authority proportionately for requests that disclose or change personal information, without requiring an account solely to make a request or unnecessary identification for an opt-out.
For covered California access, correction, and deletion requests, we generally respond within 45 days and notify you if a lawful extension of up to 45 additional days is needed. Other request types and states can have different or shorter deadlines. We explain a denial and any available appeal; reply to request an appeal and you may also contact the appropriate state regulator. We do not discriminate for exercising protected rights.
California residents may also request information required by the Shine the Light law about certain disclosures to third parties for those parties' own direct marketing. Send the request to [email protected]. This right is distinct from access to your account or a browser cookie choice.
13. EEA, UK, Switzerland, and other regions
Where European data-protection law applies, personal information in this notice includes personal data. Mosaic is responsible as controller for the purposes it determines; processing on a business customer's instructions may instead be governed by that customer's arrangement with us. Contract necessity, legal obligation, legitimate interests, and specific consent are distinct grounds described in this notice and are used only where applicable.
For legitimate-interest processing, you may object based on your circumstances. You may object to direct marketing where that right applies and withdraw a consent-based permission without changing the lawfulness of earlier processing. Access, correction, erasure, restriction, and portability rights have legal conditions and exceptions; an exception to one request does not remove all your other rights.
If GDPR applies, the general response period is one calendar month, with a notified extension only where legally permitted. You can complain to the supervisory authority in your habitual residence, workplace, or place of the alleged infringement, as applicable, or to the UK Information Commissioner's Office. You do not have to obtain our permission to contact a regulator.
Swiss and other regional laws may provide similar or additional rights. Contact [email protected] with the request and enough information to identify the relevant processing. We apply the law that governs the request, including local response and appeal requirements, rather than assuming that rights are limited to the regions named here.
14. Transfers, security, and children
We and providers may process information in the United States and other countries with different laws. Where transfer safeguards are required, an appropriate lawful mechanism is needed, such as an adequacy decision or contractual safeguards. Contact us for information applicable to your data. We do not claim that every provider or data flow is covered by a particular certification.
We use technical and organizational safeguards, but no internet service guarantees absolute security. Report suspected incidents to [email protected]. We assess incidents and give notices required by law. Motion is intended for adults. Contact us if a child has provided information without lawful authorization so we can investigate and act appropriately.
15. Automated processing and review
Motion uses automated systems to generate content, retrieve relevant material, apply usage controls, and help detect security or policy issues. These systems can make mistakes. Generated text about a person is not necessarily accurate personal information, and a model output is not a verified factual determination.
If you believe an automated restriction, billing result, or inference about you is wrong, contact [email protected] and identify the decision or affected feature. We review the request under the applicable process. Where law provides rights concerning a solely automated decision with legal or similarly significant effects, you may request the required information, contest the result, and seek human involvement. This notice does not assert that every algorithm is such a decision or waive any protection that applies.
16. Updates
We identify the version date and notify users of material changes, obtaining consent where required. Updating this policy does not itself authorize an incompatible new use of previously collected information. Contact us at [email protected] or the address in section 1.
Questions or requests: [email protected].