Mosa Get demo

Privacy Policy

Last updated: 14 July 2026

1. Who We Are

This Privacy Policy explains how Armlab BV ("Armlab", "we", "us", "our") collects, uses, and protects personal data in connection with our marketing website at usemosa.com and our digital asset management product, Mosa, available at app.usemosa.com (together, the "Service").

For the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Belgian data protection law, the data controller is:

Armlab BV
Sint-Hubertusstraat 67, 3730 Bilzen-Hoeselt, Belgium
Enterprise number: BE 0899.277.201
Email: hello@usemosa.com

2. What Personal Data We Collect

2.1 Visitors to Our Marketing Website

  • Contact form data: if you fill in a contact or "get in touch" form on usemosa.com, we collect your name, email address, and the content of your message, plus any other information you choose to include.
  • Analytics data: we use a self-hosted, cookieless analytics tool (Umami) to understand aggregate website usage, such as page views and referral sources. Umami does not use cookies and does not collect personal data such as names, email addresses, or precise identifiers — see Section 6 for details.

2.2 Users of the Mosa Product

  • Account data: when your organization signs up for Mosa, we collect account information such as name, work email address, organization name, and login credentials (or single sign-on identifiers) for individual users.
  • Content you upload: the digital assets and associated metadata that your organization uploads to Mosa. This may incidentally include personal data if such data is contained within the files or metadata you choose to upload; in that context, Armlab typically acts as a data processor on behalf of your organization (the controller) — see Section 8 and the Data Processing Agreement referenced in our Terms & Conditions.
  • Usage and technical data: information generated by your use of the product, such as log data, device/browser information, and IP address, collected for security, troubleshooting, and service-improvement purposes.

3. Why We Process Your Data (Legal Bases)

Under Article 6 of the GDPR, we rely on the following legal bases depending on the purpose of processing:

  • Consent (Art. 6(1)(a)): where you have given clear consent, for example when voluntarily submitting information through a contact form or opting in to marketing communications. You may withdraw consent at any time (see Section 9).
  • Performance of a contract (Art. 6(1)(b)): to create and administer your Mosa account, provide the Service, and respond to support requests under our Terms & Conditions or your order form.
  • Legitimate interests (Art. 6(1)(f)): for purposes such as aggregate, cookieless website analytics, maintaining the security and integrity of our systems, preventing fraud and abuse, and improving our Service. We consider these interests to be balanced against your rights and freedoms.
  • Legal obligation (Art. 6(1)(c)): where processing is necessary to comply with applicable law, such as accounting, tax, or regulatory record-keeping obligations.

4. The Contact Form

When you submit a contact form on usemosa.com, the name, email address, and message you provide are processed in order to respond to your inquiry (legal basis: consent and/or our legitimate interest in responding to inquiries directed to us). To send these communications, we use Brevo (Sendinblue), an email service provider, which processes this data as our processor, strictly on our instructions and for the purpose of enabling us to send and manage this correspondence. Brevo is contractually bound to protect this data and may not use it for its own purposes.

5. Analytics: Self-Hosted, Cookieless Umami

Our marketing website uses Umami, a privacy-first analytics tool that we self-host on our own infrastructure. Umami:

  • does not use cookies;
  • does not collect personal data such as names, email addresses, or persistent identifiers;
  • does not track individuals across websites; and
  • only reports aggregate, anonymized statistics such as page views, referrers, and general browsing patterns.

Because Umami does not process personal data or place cookies or similar tracking technologies, it does not require a cookie consent banner under the ePrivacy Directive or GDPR.

6. Processors & Third Parties

We share personal data with a limited number of trusted third-party service providers, each acting as a processor under our instructions and bound by a data processing agreement:

  • Brevo (Sendinblue): used as our email service provider to send communications related to contact form submissions and, where you have opted in, marketing emails.
  • Cloudflare: used for hosting, content delivery (CDN), and network security services.
  • Self-hosted infrastructure: Mosa's application and database infrastructure, and our Umami analytics instance, are self-hosted on infrastructure we control, rather than being processed by third-party SaaS analytics or hosting vendors, except as noted above.

We do not sell personal data to third parties.

7. International Data Transfers

We aim to process personal data within the European Union wherever possible. Where a processor or sub-processor is located outside the European Economic Area (EEA), or otherwise transfers personal data outside the EEA, we ensure an appropriate legal safeguard is in place, such as the European Commission's Standard Contractual Clauses (SCCs), an adequacy decision, or another mechanism recognized under Chapter V of the GDPR, before such a transfer takes place.

8. Data Processing for Mosa Customers

When your organization uses Mosa to store and manage digital assets, your organization is typically the data controller for any personal data contained within uploaded Content, and Armlab acts as a data processor, processing that Content only on your organization's documented instructions and for the purpose of providing the Service. The terms of this processing are set out in our Data Processing Agreement (DPA), available to customers on request at hello@usemosa.com, as referenced in our Terms & Conditions.

9. Retention Periods

We retain personal data only for as long as necessary for the purposes described in this Policy, including to satisfy any legal, accounting, or reporting requirements. As a general guide:

  • Contact form submissions: retained for up to 24 months from the date of your inquiry, unless a longer period is needed to resolve an ongoing matter or required by law.
  • Mosa account data: retained for the duration of your organization's subscription, and for a limited period thereafter (as described in our Terms & Conditions) to allow for data export, followed by deletion in accordance with our standard data deletion practices.
  • Analytics data: aggregate, anonymized statistics collected via Umami are retained for internal reporting purposes; because this data is not personal data, standard personal-data retention limits do not apply.

Where a specific retention period is not stated above, we retain personal data for no longer than is necessary for the purpose for which it was collected.

10. Your Rights

Under the GDPR, you have the right to:

  • Access the personal data we hold about you;
  • Rectification of inaccurate or incomplete personal data;
  • Erasure of your personal data, in certain circumstances ("right to be forgotten");
  • Restriction of processing, in certain circumstances;
  • Data portability, i.e. to receive your personal data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller, where technically feasible;
  • Object to processing based on legitimate interests, including profiling, and to direct marketing at any time; and
  • Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at hello@usemosa.com. We will respond within the timeframes required by the GDPR (generally within one month of receiving your request).

11. Right to Lodge a Complaint

If you believe your data protection rights have been infringed, you have the right to lodge a complaint with a supervisory authority. In Belgium, the competent authority is:

Belgian Data Protection Authority
(Gegevensbeschermingsautoriteit / Autorité de protection des données)
Rue de la Presse 35, 1000 Brussels, Belgium

You may also lodge a complaint with the supervisory authority of your own EU member state of residence or place of alleged infringement.

12. Cookies

Our marketing website (usemosa.com) does not use tracking or advertising cookies. Our website analytics tool, Umami, is entirely cookieless and does not place any cookies or similar tracking technologies on your device. As a result, no cookie consent banner is required for the marketing website's analytics.

If this changes in the future — for example, if we introduce cookies for functional or marketing purposes — we will update this Policy and implement an appropriate consent mechanism in accordance with the ePrivacy Directive and GDPR.

13. Security

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration, taking into account the state of the art, the costs of implementation, and the nature, scope, and risk of the processing concerned. These measures include access controls, encryption in transit, and the use of self-hosted infrastructure that we directly manage and secure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

14. Children's Privacy

The Service is a business-to-business product and is not directed at, marketed to, or intended for use by children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at hello@usemosa.com so we can take appropriate action.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. If we make material changes, we will provide reasonable notice, such as by posting the updated Policy on our website with a revised "Last updated" date, or by direct notice to customers where appropriate. We encourage you to review this Policy periodically.

16. Contact Us

If you have any questions about this Privacy Policy or how we handle personal data, please contact:

Armlab BV
Sint-Hubertusstraat 67, 3730 Bilzen-Hoeselt, Belgium
Enterprise number: BE 0899.277.201
Email: hello@usemosa.com