Privacy
What we hold, and what we never do with it.
This site collects nothing until you choose to tell us something. It sets no cookies, runs no analytics, carries no advertising pixels and loads nothing from anyone else’s servers — so until you fill in one of the three forms, the only record of your visit is the server log that delivering a web page unavoidably creates. What follows is the whole of it, in the order it happens.
Who we are
Mosaek FZE LLC is the controller of the personal data described here. We are registered in the United Arab Emirates and we operate this site at mosaek.ae.
For anything in this notice — a question, a correction, a copy of what we hold, or a deletion — write to harnaik@mosaek.ae. That address reaches the founder directly, not a queue.
What we collect, and only when you send it
There are three forms on this site and they are the only way it takes anything from you. Nothing is collected by watching you read.
The enquiry form asks for your full name, your company or entity name, your email address, your phone number with its country dialling code, which capacity you are enquiring in, what the enquiry concerns, and your message. The quick form in the contact drawer asks for the same things in a shorter frame. The callback request asks for a phone number and its dialling code, and nothing else.
Every field except the message is there so that we can reply to you properly. If you would rather not type a phone number, leave it out and use the email field; if you would rather send us nothing at all through this site, the WhatsApp number and the email address in the footer reach us just as well.
Each form also carries a hidden field that is left empty by design. Automated submission tools fill it in; people do not. It exists to catch spam and it holds nothing about you.
Why we hold it
To answer you, and to carry on the conversation you started. That is the entire purpose.
Under the UAE Personal Data Protection Law our basis is that you asked us to contact you and the data is necessary to do it. If you are in the United Kingdom or the European Economic Area, the equivalent bases are Article 6(1)(b) — steps taken at your request before entering a contract — and Article 6(1)(f), our legitimate interest in replying to a business enquiry addressed to us.
We do not use it for marketing. We do not add you to a mailing list, because there is no mailing list. If that ever changes you will be asked first and separately, and a notice that changed quietly would be worth nothing.
Who else sees it
Inside Mosaek: the people working on your enquiry, and no one else.
Outside Mosaek: nobody, except the two providers that make the delivery possible and any disclosure the law actually compels. We do not sell your data. We do not rent, share or trade it, and we do not pass it to advertisers, data brokers or analytics companies, because we do not use any.
The two providers are Netlify, which hosts this site and receives and stores what the form sends, and Google Workspace, which Netlify passes each submission on to and where we read it and reply to you. Both act on our instructions under their own data processing agreements, and neither uses your data for its own purposes. Google Workspace is the business product rather than a consumer mailbox: its terms do not permit your message to be used for advertising.
If a court, a regulator or a law we are subject to requires a disclosure, we will make it. Where we are permitted to tell you that it happened, we will.
Where it goes
Netlify and Google are both United States companies running global infrastructure, so a form submission leaves the United Arab Emirates the moment you send it, and it is in a mailbox outside the country when we read it. There is no way to run a site and a business mailbox on providers of this kind and claim otherwise.
Both transfers are covered by those providers’ data processing agreements, which incorporate the European Commission’s Standard Contractual Clauses for transfers out of the EEA and the United Kingdom. If this matters to you for a particular reason, say so and we will take the conversation to phone or WhatsApp instead of through the form.
How long we keep it
An enquiry that does not become an engagement is deleted after twenty-four months. Two years is roughly how long a reputation problem takes to come back around, and people do return to us long after the first message; keeping it indefinitely would be hoarding.
An enquiry that becomes an engagement is kept for as long as we work together and then for as long as our commercial and tax obligations in the UAE require, after which it goes too.
You do not have to wait for either. Ask and it is deleted.
Cookies, and why there is no banner
This site sets no cookies at all. Not analytics cookies, not advertising cookies, not preference cookies, and nothing stored in your browser by any other name either — no local storage, no session storage, no device fingerprinting.
You are not asked to consent to cookies because there is nothing to consent to. A banner here would be decoration, and we would rather show you the policy than a pop-up about one.
The same goes for everything the page loads. The typefaces are served from this domain rather than from a font network, every image and logo is local, and there are no embeds, no tag manager, no session recording, no heatmaps and no social widgets. Nothing on this page reports your visit to a third party, because nothing on this page comes from one.
If that ever stops being true, this clause changes before the thing is added, not after.
The one thing collected automatically
Serving a web page means receiving a request, and a request carries your IP address, the page you asked for, the time, and your browser’s user-agent string. Netlify records these to deliver the site, to keep it available and to defend it against attack. This is ordinary and unavoidable rather than a choice we made, and we are telling you because a privacy notice that claims a site collects nothing automatically is not being straight with you.
We do not build profiles from these logs, we do not combine them with form submissions, and we do not read them except when something has gone wrong with the site.
Your rights
You can ask us to show you what we hold about you, to correct it if it is wrong, to delete it, to stop using it, to object to our using it, or to send it to you in a portable form. Where we rely on your consent for anything, you can withdraw it.
One email to harnaik@mosaek.ae does any of these. We will reply within thirty days and in practice much sooner, we will not charge you, and we will not ask you why.
If you are not satisfied with how we have handled it, you can complain to the UAE Data Office. If you are in the UK or the EEA you may instead complain to your own supervisory authority — the Information Commissioner’s Office in the UK, or your national data protection authority in the EEA.
No automated decisions
Nothing on this site makes a decision about you automatically, and nothing here profiles you. A person reads every enquiry and a person answers it.
We work with search engines and AI answer engines as part of what we do for clients. We do not feed your enquiry to any of them.
Children
This is a service for businesses, organisations and adults acting in a professional capacity. It is not directed at anyone under eighteen and we do not knowingly collect their data. If you believe a child has sent us something, tell us and we will delete it.
How it is protected
The site is served only over HTTPS and declares HSTS, so a browser that has seen it once will refuse to load it insecurely afterwards. A content security policy restricts the page to its own resources, which means an injected script from somewhere else cannot run even if it reaches the page. There are no third-party scripts to be compromised in the first place, and the site has no login, no database and no server-side code — so there is very little here to attack.
A vulnerability reporting contact is published at /.well-known/security.txt.
None of this is a guarantee, and anyone who offers you one is selling something. What we can tell you is that your message is held by two providers rather than twenty, and that is a deliberate choice.
Changes to this notice
The date at the top is the date this version took effect. If we change anything that affects what we do with your data, we will change that date and the clause together. We will not announce a change to the privacy notice while quietly rewriting the practice, and we will not backdate one.
And the part that is not law
Everything above is what we owe you under data protection law. Confidentiality is a separate promise and a stricter one: we are bound by strict NDAs with every part of our work, we name no client without written permission, and the fact that you contacted us at all is itself confidential.
People come to us because something about them is visible that should not be. Being careless with the enquiry would be a strange way to start.