Privacy Policy

1. Who we are

MOSA is operated by NOAH & MILO INVESTMENTS LTD, a company registered in England and Wales under company number 16786971.

Email: hello@withsoomi.com

NOAH & MILO INVESTMENTS LTD is responsible for the personal information processed when operating the MOSA app and related services.

2. What MOSA does

MOSA allows an event host to create a private photo event. Guests can join the event using a share code, QR code or invitation link and contribute photographs. Photographs are revealed and made available according to the settings chosen for that event.

This policy applies to the MOSA Android app, the MOSA website and related support services.

An event host may separately be responsible for how photographs from their event are used outside MOSA. This policy covers MOSA’s processing and does not give a host permission to use photographs for advertising or promotional purposes. Any promotional use requires separate permission from the people concerned.

3. Information we collect

Depending on how you use MOSA, we may process:

Host account information

• Email address
• Authentication and account identifiers
• Sign-in and session information
• Events created or managed through the account

Event information

• Event name and settings
• Event dates and reveal settings
• Share codes and invitation details
• Information about participation in an event

Guest information

Guests do not need to create a full account. We may process:

• The display name chosen by the guest
• The event the guest joins
• A guest session or recovery identifier
• The date and time the guest joined or contributed
• A record of the guest’s agreement to contribute photographs to the private event

Photographs and associated information

When a photograph is captured or selected for upload, we may process:

• The photograph
• A smaller thumbnail or display version
• File type, file size and image dimensions
• Upload and capture timestamps
• File integrity information
• Processing or moderation status
• Metadata embedded in the file, which could include device, capture-time or location information if the device added it to the photograph

MOSA does not use facial recognition or biometric identification.

Technical and security information

We and our service providers may process limited technical information needed to operate and protect MOSA, including:

• IP address and network request information
• Device, operating-system and app-version information
• Sign-in and upload timestamps
• Error, security and diagnostic logs

Support communications

If you contact us, we process your contact details and the information included in your message so that we can respond.

4. Camera and device access

MOSA asks for camera access only when you choose to take a photograph. It does not use the camera in the background.

You may also choose an existing JPEG photograph using Android’s system file or photo picker.

MOSA does not request access to your microphone, contacts or precise device location. It does not request general access to all files stored on your device.

Photographs waiting to upload and some event or session information may be stored in the app’s private area on your device. Sensitive session credentials are protected using Android security facilities. Removing the app or clearing its data removes this local app data but does not automatically remove copies already uploaded to an event.

5. How we use information

We use personal information to:

• Create and authenticate host accounts
• Create and manage private events
• Allow guests to join events
• Capture, upload, process, store and display event photographs
• Apply event reveal and access settings
• Recover interrupted guest sessions or uploads
• Provide support and respond to requests
• Detect misuse and protect the service
• Diagnose technical problems
• Meet legal and regulatory obligations

We do not sell personal information.

MOSA does not currently contain third-party advertising, use advertising identifiers or use personal information for targeted advertising.

We do not make decisions that have legal or similarly significant effects using solely automated processing.

6. Our lawful bases

Under UK data-protection law, we rely on one or more of the following lawful bases:

• Contract: where processing is needed to provide the service requested by a host or participant.
• Legitimate interests: to operate, secure, improve and support MOSA, provided those interests are not overridden by an individual’s rights.
• Consent: where we specifically ask for consent, including agreement to contribute photographs or any separate optional use.
• Legal obligation: where processing is necessary to comply with the law.

Where processing is based on consent, consent may be withdrawn. Withdrawal does not affect processing that was lawful before it was withdrawn.

7. Who can see photographs

Uploaded photographs are associated with a private event. They may be accessible to:

• The event host
• Guests or participants authorised to view the event
• MOSA personnel or service providers when reasonably necessary to operate, secure or support the service

Visibility is controlled by the event’s settings and reveal rules. Private originals are not intended to be published openly on the internet.

People contributing photographs should only upload material they are entitled to share and should respect the privacy of people shown in those photographs.

8. Service providers and sharing

We may share information with organisations that help us provide MOSA, including:

• Supabase, which provides authentication, database, private file-storage and server-function services
• Authentication and transactional-email providers
• Technical support, hosting and security providers
• Professional advisers, regulators or law-enforcement authorities where disclosure is legally required

Google may process information separately when you download or use MOSA through Google Play or Android, subject to Google’s own privacy terms.

Service providers are permitted to process information only as necessary to provide their services or meet applicable legal requirements.

We may also disclose information if necessary to protect users, investigate fraud or misuse, enforce our terms, or complete a legitimate corporate transaction with appropriate safeguards.

9. International transfers

Some service providers may process information outside the United Kingdom. Where personal information is transferred internationally, we use an appropriate legal mechanism and safeguards required by applicable data-protection law.

10. How long we keep information

We retain account, event and photograph information only for as long as reasonably necessary to provide MOSA, maintain security, resolve disputes and meet legal obligations.

Retention depends on factors such as:

• Whether an account or event remains active
• Whether photographs are still required for the event
• Whether a deletion request has been received
• Security, fraud-prevention or legal requirements

Following a valid deletion request, information will be deleted or de-identified within a reasonable operational period unless it must be retained for legal, security or dispute-resolution reasons. Residual copies in protected backups may remain until those backups are overwritten through their normal cycle.

Local copies on a participant’s device remain under that person’s control. Copies downloaded or separately saved by an event host or another participant cannot always be deleted by MOSA.

11. Account and photograph deletion

A host can request deletion of their MOSA account and its associated personal information by emailing hello@withsoomi.com with the subject “Delete my MOSA account”.

A guest can request removal of their guest information or contributed photographs by contacting the event host or emailing hello@withsoomi.com. Please provide enough information to identify the relevant event and contribution without sending unnecessary personal information.

Deleting a host account is intended to delete the account and associated personal information, not merely disable access. We may retain information where required by law or where necessary for security, fraud prevention or legal claims.

Read the dedicated account and data deletion instructions.

12. Security

We use technical and organisational measures designed to protect personal information. These include private storage, access controls, encrypted network connections, short-lived access links and protected device credentials.

No online service can guarantee absolute security. If you believe an account, invitation or photograph has been accessed improperly, contact us promptly.

13. Children

MOSA is not directed at children under 18.

Event hosts are responsible for ensuring that they have appropriate permission when an event involves children or photographs of children. A parent or guardian may contact the event host or hello@withsoomi.com to request removal of relevant content.

14. Your rights

Depending on the circumstances, UK data-protection law may give you the right to:

• Receive information about how your data is used
• Access your personal information
• Correct inaccurate information
• Request deletion
• Restrict or object to processing
• Receive certain information in a portable format
• Withdraw consent where consent is relied upon
• Complain to the Information Commissioner’s Office

We may need to verify your identity before completing a request.

You can contact the UK Information Commissioner’s Office at ico.org.uk.

15. Changes to this policy

We may update this policy when MOSA changes or when legal requirements change. The latest version will be published on the MOSA website with its updated date. We will provide an appropriate notice if a change materially affects how personal information is used.

16. Contact us

For privacy questions, requests or complaints, contact:

Email: hello@withsoomi.com