Privacy policy

1. Who we are. MosenAI is a product of Leanicon. The controller of the data in sections 3 to 7 is MosenAI Solutions SL. Contact: [email protected].

2. Two roles. When you visit this website, request a demo, apply to the partner programme or hold an account, we are the controller. When an organisation uses MosenAI to process data about its own clients, staff or prospects, that organisation is the controller and we process the data on its behalf under a data processing agreement. Section 8 covers that role

3. What we collect as controller.

• Demo enquiries: name, work email, company or practice, kind of business and what takes the most time.
• Partner applications: the same, plus which clients you would deploy for. Please don't send us your clients' personal data.
• Account and billing data: name, email, role, organisation and billing details, handled with [payment provider].
• Usage and security data: sign-in events and technical logs [confirm what is logged].
• Cookies and similar technologies: section 9.

4. Why we use it. Each purpose has its own legal basis:

• Replying to an enquiry and arranging a demo rests on steps taken at your request before a contract.
• Assessing a partner application rests on steps taken at your request before a contract.
• Providing and securing the service rests on the contract, and on our legitimate interest in security.
• Billing and tax records rest on the contract and on a legal obligation.
• Marketing email, [only if you send it], rests on your consent.
• Non-essential cookies rest on your consent.

5. Who we share it with. Providers that process data for us, by category: cloud hosting, AI model providers, email delivery, payments [add names, or link to a sub-processor list].

6. International transfers. Customer content is kept in the EU. [State whether any other personal data leaves the EU, and the safeguard used.]

7. How long we keep it. Demo enquiries: [period]. Account data: while the account is active and [period] afterwards. Billing records: as tax law requires. Terminal run records and their ledgers: ninety days by default.

8. Customer content (where we are the processor). We process it only on the customer's documented instructions. Specifically:

• Data stays in the EU, enforced in our infrastructure.
• Each customer has a dedicated encryption key, and credentials and meeting transcripts are encrypted under it.
• Customers' records and search indexes are isolated from each other.
• AI providers are configured so customer content is never used as training data.
• Every interaction, tool call and escalation is logged and exportable, and every upload is scanned before it is accepted.
• Export and erasure for individuals are available for the customer to switch on.
• The customer is responsible for having a lawful basis, including consent where it records meetings. The platform stores the recorder's consent attestation with the transcript.
• [Decide: whether special-category data, such as health data, may be processed, and under what conditions.]
• Details are in the [Data processing agreement] and on the Trust page.

9. Cookies

What they are. Cookies and similar technologies, such as local storage, save small pieces of information in your browser.

What we use. We don't use cookies to sell data or to follow you across other sites.

What we use. We don't use cookies to sell data or to follow you across other sites. Each cookie or similar item is described below by name, purpose, type and duration.

• Language preference: remembers your language. It is strictly necessary or a preference item.
• Theme preference: remembers light or dark mode. It is a preference item.
• Session and sign-in: keeps you signed in to the platform. It is strictly necessary.
• Consent record: remembers your cookie choice. It is strictly necessary.

Strictly necessary cookies don't need consent. Anything else is used only if you accept.

Your choices. Change or withdraw consent at any time at cookie settings, or delete cookies in your browser settings.

10. Your rights. You can ask for access, correction, erasure, restriction, portability, and object to processing, and withdraw consent at any time, by writing to [privacy email]. If we process your data on behalf of a business (for example, you are that business's client), contact that business first and we will help it respond. You can complain to the Spanish data protection authority, the AEPD (aepd.es).

11. Security. Dedicated keys, strict separation, scanned uploads, signed short-lived links, configurable roles and a record of every action, described on the Trust page.

12. Children. The service is for businesses, not children, and we don't knowingly collect their data.

13. Changes. We update this page when our practices change and show the date at the top.