Last updated: October 9, 2026 — Clarifications on retention periods, processors (Google Fonts, Stripe) and anti-abuse logs.
This policy explains what data Mosalea collects, why, and how to exercise your rights. The data controller is Loïc Ruyssen, sole trader operating Mosalea (see the legal notice), contact: contact@mosalea.com.
| Data | Why |
|---|---|
| E-mail entered during a purchase without an account | Sending the download link and automatically creating a free account tied to this address (passwordless sign-in via an e-mail link); the Terms and age confirmation box ticked before payment is time-stamped |
| Email and password | Account creation and security (authentication) |
| Display name, handle, bio, profile picture | Displaying your public profile on the platform |
| Content of briefs, quotes, messages and deliveries | Running an order smoothly between buyer and artist |
| Published artwork (portfolio) | Showcasing artists' work in the feed and search |
| Reviews and replies | Artists' reputation on the platform |
| Payment data | Processed directly by Stripe; Mosalea never stores card numbers |
| Push notification token (device identifier, encryption keys) | Sending browser notifications, only if you explicitly enable them in your settings; deleted if you disable them |
| Two-factor authentication (2FA) recovery codes, stored hashed | Securing your account, only if you enable two-factor authentication |
| Mosalea commission invoices and invoices uploaded by artists | Accounting and tax obligations related to paid orders |
| Proof of acceptance of the Terms (version accepted, date and time) | Being able to show that you accepted the terms in case of a dispute |
| Pro subscription (status, dates, Stripe identifiers) | Subscription management and billing; Mosalea never stores card numbers |
| Identity and bank information requested from artists to receive payments | Collected and verified directly by Stripe (Stripe Connect) under payment regulations; Mosalea only receives the account verification status |
| Content reports and copyright notices (name, e-mail, capacity, organisation and address of the notifier if provided) | Handling reports and meeting the platform's legal obligations |
| Support requests | Answering your requests sent to support |
| Anti-abuse log for purchases without an account (IP address and e-mail in hashed, non-reversible form) | Limiting automated attempts and fraud; automatically deleted within 24 hours |
| Language preference (stored in your browser) | Displaying the site in the chosen language |
| Aggregated browsing data | Anonymous site audience measurement (see "Cookies and audience measurement") |
Your data is processed by Mosalea and by the following technical providers, only to the extent necessary for their role:
| Provider | Role |
|---|---|
| Supabase Inc. | Database hosting, authentication, file storage |
| Netlify, Inc. | Site hosting |
| Stripe | Payment processing and payouts to artists |
| Resend | Sending transactional emails (email notifications) |
| Cloudflare, Inc. | Anonymous site audience measurement (Web Analytics, no cookie) |
| Google (Google Fonts) | Delivery of the site's fonts: your browser downloads the fonts from Google's servers, which sends your IP address to Google |
| Groq | AI-assisted text generation for internal use (community challenge translation, monthly growth report); no account data is shared, only aggregated statistics and, for the internal report, the display name of the month's top-performing artists |
These providers may host data outside the European Union (United States, Singapore depending on the case); they contractually commit to a level of protection compliant with the GDPR (standard contractual clauses or equivalent).
| Data | Period |
|---|---|
| Account, profile, artworks, messages | For the life of the account; when the account is deleted, the profile is anonymised immediately and purely personal data is deleted |
| Orders, quotes, order exchanges, reviews tied to an order | Kept in anonymised form after account deletion, for the other party, accounting and possible disputes |
| Invoices and accounting records | 10 years (Article L.123-22 of the French Commercial Code) |
| Proof of acceptance of the Terms | For the duration of the contractual relationship, then the applicable limitation period |
| Anti-abuse log for purchases without an account | 24 hours maximum |
| Push notification token | Until notifications are disabled or the account is deleted |
| Content reports and copyright notices | For the time needed to process them, then the applicable limitation period if contested |
Data whose retention is required by law (accounting, tax) may be kept longer than the periods above, solely for that purpose.
Mosalea uses Cloudflare Web Analytics to measure site traffic. This tool sets no cookie, does not link visits across sites and performs no advertising profiling. The site's fonts are loaded from Google Fonts (see "Recipients and processors"). Authentication uses a token stored locally in your browser, strictly necessary for the service to work (no consent banner is required for this strictly functional use).
In accordance with the GDPR, you have the right to access, rectify, erase, restrict, object to, and port your data. From your Mosalea profile settings, you can edit your information, download all of your personal data in JSON format ("Download my data"), and permanently delete your account ("Delete my account"). Deletion immediately anonymizes your profile (name, handle, photo); if you have already placed or received orders, those exchanges remain visible to the other party without your name, in accordance with our legal obligation to retain commercial and accounting records, and your account is permanently blocked. For any other request, write to contact@mosalea.com. You may also file a complaint with the CNIL, the French data protection authority (cnil.fr).
Mosalea is restricted to adults. No data is knowingly collected from minors.
Access to data is protected by an authentication system and strict access rules at the database level (each user can only view their own data, except for public profile and portfolio information). You can also optionally enable two-factor authentication (2FA) from your account settings to strengthen the security of your login.
Browser push notifications are disabled by default: they are only enabled after your explicit authorization request, and you can disable them at any time from Mosalea's notification settings or from your browser's settings.
This English page is a translation of the French privacy policy provided for convenience. The French version is the legally binding one.