Last modified: October 11, 2026
mosaic.ai is a service of Windgate Consulting, Inc., a Washington corporation ("mosaic.ai," "we," "us," or "our"). This Privacy Policy describes how we collect, use, and disclose information in connection with the mosaic.ai service (the "Service"), accessed through our website, applications, or APIs. By using the Service, you consent to the collection, transfer, processing, storage, and disclosure practices described in this Privacy Policy.
mosaic.ai is a business-to-business service. Our customers (typically employers and recruiting organizations, "Customers") send us applicant and candidate information — such as resumes — from their applicant tracking systems (ATS) or other sources ("Candidate Data"). For Candidate Data, our Customer is the data controller (or "business" under California law) and mosaic.ai acts solely as a data processor (or "service provider"), processing Candidate Data only on the Customer's instructions and under our agreements with that Customer.
If you are a job applicant or candidate and have questions about how your information is used, or wish to access, correct, or delete your information, please contact the employer or organization to which you applied. We will assist our Customers in responding to such requests as required by applicable law.
Account Information. When a Customer registers an account, we collect information such as name, email address, and organization details for the individuals who use the Service.
Candidate Data. We receive and store resumes and related applicant information that Customers submit to the Service. As part of providing the Service, we generate and store data derived from Candidate Data, including vector embeddings, extracted entities, scores, and summaries produced by artificial intelligence systems (see "Automated Processing and Artificial Intelligence" below).
HR Document Q&A. Where a Customer enables it, employees of that Customer may ask questions about the Customer's HR documents through the Service. We process those questions and the relevant documents to generate answers, and may retain logs of these interactions to provide and improve the Service for that Customer.
Log Data. When you use the Service, we automatically record information from your device, its software, and your activity using the Service. This may include the device's Internet Protocol ("IP") address, browser type, the web page visited before you came to our website, locale preferences, date and time stamps associated with transactions, system configuration information, and other interactions with the Service.
Cookies. We use "cookies" to operate and improve the Service. A cookie is a small data file that we transfer to your device. We may use "persistent cookies" to remember sign-in preferences and "session ID cookies" to enable certain features of the Service, to better understand how you interact with the Service, and to monitor aggregate usage and web traffic routing on the Service. You can instruct your browser, by changing its options, to stop accepting cookies or to prompt you before accepting a cookie; however, some features of the Service may not function without cookies.
The Service uses artificial intelligence, including large language models and vector embeddings, to analyze, score, and extract information from Candidate Data and to answer questions about Customer HR documents. Please note:
We use information to: (i) provide, operate, and improve the Service; (ii) administer Customer accounts and use of the Service; (iii) provide support; (iv) monitor and analyze usage and performance; (v) secure the Service and verify that users are authorized; and (vi) comply with legal obligations. We use Candidate Data only to provide the Service to the Customer that supplied it.
Analytics. We also collect some information (ourselves or using third-party services) using logging and cookies, such as IP address, which can sometimes be correlated with Personal Information. We use this information for the purposes above and for the Service's technical administration. As of the date this policy went into effect, we use Google Analytics.
We do not sell or rent personal information. We disclose information only as follows:
If you are a registered Customer user, you may review, update, correct, or delete the Personal Information provided in your registration or account profile through your account settings or by contacting us at hello@mosaic.ai. We will respond to your inquiry within 30 days. In some cases we may retain copies of your information if required by law. If you are a job applicant or candidate, please direct requests regarding Candidate Data to the employer to which you applied; we will assist that Customer as required by law and our agreements.
We retain Customer account information for as long as the account is active or as needed to provide the Service. We retain Candidate Data, including derived embeddings and extracted entities, for the period specified in our agreement with the relevant Customer or until the Customer instructs us to delete it. We may retain and use information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. Please note that there might be latency in deleting information from our servers and backed-up versions might exist for a limited time after deletion.
The security of your information is important to us. We follow generally accepted standards to protect the information submitted to us, both during transmission and once we receive it. No method of electronic transmission or storage is 100% secure, however. Therefore, we cannot guarantee its absolute security. If you have any questions about security on our website, you can contact us at hello@mosaic.ai.
Our Services are not directed to persons under 13. We do not knowingly collect personally identifiable information from children under 13. If a parent or guardian becomes aware that his or her child has provided us with Personal Information without their consent, he or she should contact us at hello@mosaic.ai. If we become aware that a child under 13 has provided us with Personal Information, we will take steps to delete such information from our files.
For California residents, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, "CCPA"), provides specific rights regarding personal information. We act as a "service provider" under the CCPA with respect to Candidate Data, processing it solely for the business purposes specified in our agreements with Customers. We do not sell or share personal information as those terms are defined under the CCPA, and we do not use Candidate Data for cross-context behavioral advertising.
Your Rights: California residents have the right to: (i) know what personal information is collected, used, and disclosed; (ii) request deletion of personal information; (iii) correct inaccurate personal information; (iv) opt out of the sale or sharing of personal information; (v) limit the use of sensitive personal information; and (vi) not be discriminated against for exercising these rights.
If you are a California job applicant or candidate, please direct requests to the employer to which you applied, as that business is the controller of your Candidate Data. If you are a Customer user, you may exercise these rights by contacting us at hello@mosaic.ai. We will respond to verifiable requests within the timeframes required by law.
For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws. For Candidate Data, our Customer is the data controller and mosaic.ai is a data processor under Article 28 of the GDPR, processing personal data only on documented instructions from the Customer.
Legal Basis for Processing: Where we act as a controller (for example, for Customer account information), we process your personal data based on the following legal grounds: (i) your consent; (ii) performance of a contract with you; (iii) our legitimate interests in providing and improving our Service; or (iv) compliance with legal obligations.
Your Rights: Under GDPR, you have the following rights regarding your personal data:
If you are a job applicant or candidate, please direct requests to the employer to which you applied. Otherwise, to exercise these rights, please contact us at hello@mosaic.ai. We will respond to your request within 30 days. You also have the right to lodge a complaint with a supervisory authority in your jurisdiction.
International Data Transfers: Your personal data may be transferred to and processed in the United States. We use Standard Contractual Clauses approved by the European Commission and implement appropriate safeguards to protect your personal data in accordance with GDPR requirements.
Data Protection Officer: For questions about our GDPR compliance or data protection practices, you may contact us at hello@mosaic.ai.
mosaic.ai complies with The Personal Information Protection and Electronic Documents Act (PIPEDA) set forth by the Office of the Privacy Commissioner of Canada, which details the rules for the collection, use, and disclosure of personal information in the course of commercial activity as defined by the Act. To learn more about PIPEDA, please visit the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on this page and updating the "Last modified" date above. Your continued use of the Service after any changes constitutes your acceptance of the revised Privacy Policy.
If you have any questions about this Privacy Policy, please contact us at hello@mosaic.ai. mosaic.ai is a registered trade name (DBA) of Windgate Consulting, Inc., a Washington state corporation.