Data controller
Enigmatic SA
Rue de la Gare 13, 2074 Marin-Epagnier, Switzerland
Email: hello@enigmatic.swiss
This policy covers two distinct scopes: the marketing website about.mosaique.co, described in the sections below, and the Mosaique platform (mosaique.co), described in the “Mosaique Platform” section.
For the marketing website, Enigmatic SA (“we”) is the data controller within the meaning of the Swiss Federal Act on Data Protection (nFADP).
For the platform, the roles are split. Enigmatic SA is the controller for the data it needs to run the service: user accounts, teams, billing, security and operation logs. It is the processor, acting on the instructions of the customer that subscribed, for the content the customer stores and for the data obtained from the third-party platforms the customer connects; the customer is the controller for those. The data processing agreement annexed to the terms of service governs that processing.
Collected data (marketing website)
We collect as little personal data as possible. When you visit our marketing website about.mosaique.co, the following data may be processed:
IP address (anonymized)
Visited pages, date and time of access
Referrer URL
Browser and operating system
This data is collected for statistical purposes to improve our website. It does not allow us to identify you personally.
Data processed in the Mosaique platform is subject to a separate regime, described further down.
Web analytics
We use Matomo, a self-hosted web analytics solution. Matomo is hosted on our own servers in Switzerland. No analytics data is transferred to third parties or outside Switzerland.
IP addresses are anonymized before being stored. Matomo may use a cookie to distinguish unique visitors. You can refuse tracking by enabling your browser’s “Do Not Track” setting, which Matomo respects by default.
Fonts
The fonts used on this website (Figtree) are hosted on our own servers. No requests are made to external font providers. No data is transferred to third parties for font loading.
No transfer of data to third parties (marketing website)
The marketing website does not use any third-party service that would transfer your personal data outside Switzerland. We do not use third-party advertising, social media tracking pixels, or external CDNs.
The only external links on this website lead to our own products, our social media profiles, and our partners’ websites. The use of these links is subject to the respective services’ privacy policies.
This guarantee applies to the marketing website only. Transfers made from the Mosaique platform when publishing content are described in the “Mosaique Platform” section.
Cookies
This website may use a single internal cookie for web analytics (Matomo). This cookie is set by our own servers in Switzerland and is not shared with any third party.
No third-party cookies are used. Under Swiss law, no consent banner is required for this type of analytics cookie, as it serves a legitimate interest and data is anonymized.
Mosaique Platform
This section covers the Mosaique application available at mosaique.co.
Account data: we process the user accounts and teams (name, email address, role and account settings) required to access the service, as controller.
Content data and platform data: we process the editorial content and media that our customers store in the platform, and the data obtained from the social platforms they connect, as processor, on the customer’s instructions and solely to provide the agreed service. The customer decides what is stored, what is published and to whom; the data processing agreement annexed to the terms of service sets out our obligations.
Hosting: the platform and the media it stores run on infrastructure operated by Enigmatic SA in Switzerland. Where a customer attaches a storage of its own as a shelf, the media placed there is held by the customer or by its own provider. The sub-processors involved are listed in the data processing agreement.
Connected social accounts
When a user connects a social platform account to Mosaique through OAuth, we store the access token and, where the platform issues one, the refresh token. Both are encrypted at rest and are not written to application logs.
We also store the account’s identifier on the platform, its display name, the token’s expiry date, the member of the team who connected it, and platform-specific metadata detailed in the sections below. What a platform says about an account and its channels is asked for again every night and written again.
Purpose: publishing the content the user has prepared in Mosaique to that platform, on their instruction.
A team may connect several accounts on the same platform; each delivery channel names the one it publishes through.
Tokens are never sold, shared with third parties, or used for any purpose other than the one described above.
Data transfer when publishing
When content is published, the content concerned and the authentication data required are transmitted to the operator of the target platform. This transfer may involve processing outside Switzerland. Media to be published on Facebook or Instagram is handed to Meta as a link valid for at most ninety minutes.
The identifier of the post created on the platform is returned to us and stored with the content concerned when the team has mapped it to a content field, so that its distribution can be tracked; otherwise it is discarded.
The processing carried out by the platform operator is governed by its own privacy policy and is beyond our control.
Retention of platform data
When a user disconnects an account, or the platform reports that the user withdrew the authorization, the access and refresh tokens are erased immediately, the platform is asked to revoke the authorization where it offers a way to, and the profile picture and any e-mail address are erased. Nothing can be published through the account any more.
The account record — platform identifier, name and the identifiers of its channels — is kept for seven days so that the account can be reconnected without recreating its channels, then deleted together with the delivery channels that depend on it. The team can delete it at once. An account whose authorization has expired without being renewed is deleted in the same way thirty days after the expiry.
The description a platform gives of an account and of its channels is refreshed every night and deleted with the account when it can no longer be refreshed.
The identifiers of posts already published stay attached to the content concerned in Mosaique.
Data obtained from third-party platforms is deleted within ten days of the end of the contract, and at any time on the team’s request. Account and content data is deleted in accordance with the contract when a customer ends their subscription.
LinkedIn
Mosaique accesses LinkedIn data exclusively through the official LinkedIn APIs, as a Community Management API application.
Permissions requested: r_basicprofile to identify the member, w_member_social to publish on their behalf, w_organization_social and rw_organization_admin to list the organization pages they administer and publish to them. No e-mail address is requested or stored.
Data accessed and stored: the access token and, where the application is entitled to one, the refresh token; the member’s identifier, name, vanity name and profile picture address; for each administered organization page, its URN, name, vanity name and logo address. This data is collected when the account is connected or reconnected and refreshed every night; it is shown only to the members of the team that connected the account.
Use: publishing, on the user’s instruction, the posts prepared in Mosaique, under the member’s identity or that of one of their pages.
The current version publishes text carrying at most one image or one video.
Data transmitted to LinkedIn is governed by LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy
Users can revoke Mosaique’s access at any time in their LinkedIn settings, under “Data privacy → Other applications / Permitted services”. Disconnecting the account in Mosaique revokes the authorization with LinkedIn at once.
YouTube
Mosaique accesses YouTube data exclusively through the YouTube API Services, YouTube’s official interfaces, by means of a Google login.
Permissions requested: openid and profile to identify the Google account, youtube.readonly to list the channels, youtube.upload to upload videos to them. No e-mail address is requested or stored.
Data accessed and stored: the access token and the refresh token; the Google account’s identifier, name and profile picture address; for each YouTube channel owned or administered, its identifier, title, custom address and thumbnail address. This data is refreshed every night and deleted with the account when it can no longer be refreshed, at the latest thirty days after.
Use: uploading to those channels, on the user’s instruction, the videos prepared in Mosaique, and, where the team maps it, storing the identifier of the video created.
The current version uploads one video at a time. Unless the team maps a visibility, it is uploaded as private; until the application has completed Google’s API compliance audit, every upload is private.
By using this integration, the user agrees to be bound by the YouTube Terms of Service: https://www.youtube.com/t/terms
Mosaique’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy
Data transmitted to Google is governed by the Google Privacy Policy: http://www.google.com/policies/privacy
Users can revoke Mosaique’s access at any time from their Google account security settings page: https://security.google.com/settings/security/permissions. Disconnecting the account in Mosaique revokes the authorization with Google at once; the data is deleted within seven days of a disconnection or of a revocation reported by Google.
Facebook
Mosaique accesses Facebook data exclusively through the official Meta APIs.
Permissions requested: pages_show_list to list the user’s Pages, pages_read_engagement to read them, and pages_manage_posts to publish to them. Together they cover every Page post format; the current version puts only some of them to use, see below.
Data accessed and stored: the long-lived access token, valid for about sixty days, which Mosaique renews a week before it expires by exchanging it with Meta, Facebook issuing no refresh token; the Facebook user’s identifier, name and profile picture address; for each administered Page, its identifier, name and picture address, refreshed every night.
Page-specific tokens are not stored: the one a publication needs is obtained at delivery time, then discarded.
Use: publishing, on the user’s instruction, to the Pages they administer. Publishing to a personal profile is not open to applications under Meta’s rules.
The current version publishes text, text with a link, a photo, or a video. Reels and Stories belong to later versions, using the same permissions: no additional Meta permission will be requested from the user.
Data transmitted to Meta is governed by Meta’s privacy policy: https://www.facebook.com/privacy/policy/
Users can revoke Mosaique’s access at any time in their Facebook settings, under “Settings & privacy → Settings → Apps and websites”. Removing the application there is reported to us by Meta and disconnects the account at once; a deletion request made there deletes the account and its channels, and Meta hands the user a confirmation code and a page stating what was deleted and when. Disconnecting the account in Mosaique removes the application from the user’s Facebook settings.
Instagram
Mosaique accesses Instagram data exclusively through the Instagram API with Instagram Login, Meta’s professional interface. The connection is made on instagram.com: it requires neither a Facebook account nor a Facebook Page.
Only professional accounts, Business or Creator, can grant these permissions; a personal account cannot be connected.
Permissions requested: instagram_business_basic to read the account and instagram_business_content_publish to publish to it. Together they cover every post format; the current version puts only some of them to use, see below.
Data accessed and stored: the long-lived access token, valid for about sixty days, which Mosaique renews a week before it expires by presenting it to Instagram, Instagram issuing no refresh token; the professional account’s identifier, username, display name, profile picture address and account type, refreshed every night.
Use: publishing to that account, on the user’s instruction, the content prepared in Mosaique, and, where the team maps it, storing the identifier of the media created.
The current version publishes one image or one Reel. Carousels and Stories belong to later versions, using the same permissions: no additional Meta permission will be requested from the user.
Data transmitted to Meta is governed by Meta’s privacy policy: https://www.facebook.com/privacy/policy/
Users can revoke Mosaique’s access at any time in their Instagram settings, under “Settings → Website permissions → Apps and websites”. Removing the application there is reported to us by Meta and disconnects the account at once; a deletion request made there deletes the account and its channels, and Meta hands the user a confirmation code and a page stating what was deleted and when. Instagram offers an application no way to revoke its own access: a disconnection in Mosaique erases the tokens, and the account is deleted seven days later.
Your rights
Under the Swiss Federal Act on Data Protection (nFADP), you have the following rights:
Right of access: you can request information about the personal data we hold about you.
Right to rectification: you can request correction of inaccurate data.
Right to erasure: you can request deletion of your personal data.
Right to data portability: you can request a copy of your data in a structured format.
These rights apply both to the marketing website and to the Mosaique platform.
For data held in a customer’s workspace on the platform — content, and the connected accounts and what the platforms describe with them — the customer is the controller: address your request to the customer, or to us and we will forward it without delay and assist the customer in answering it.
To exercise any of these rights, please contact us at hello@enigmatic.swiss. We will respond within 30 days.
Changes to this policy
We may update this privacy policy from time to time. The current version is always available at this address. We recommend checking this page regularly.
Last updated: 16 September 2026.
Supervisory authority
If you believe your data protection rights have been violated, you can file a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC):
Swiss Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Bern
www.edoeb.admin.ch
