LoadMosaic

LoadMosaic · Legal documents

Privacy policy

Data processing in LoadMosaic for Windows and Android, the website, licensing, purchases and support.

Effective date: 10 October 2026Version 1.3

1. Controller

  • Controller: Rafael Guerrero Chueca.
  • NIF: 25179706L.
  • Address: Av. de Logroño, 78, Zaragoza - 50620, España (ES).
  • Privacy contact: support@loadmosaic.com.

2. Local data on Windows and Android

LoadMosaic calculates load arrangements on the device. Optimizations, boxes, labels, packs, pallets, containers, manual variants and personal resources are not automatically uploaded to the licensing service. They may leave the device when you choose to export, share or attach them to a support request.

On Windows, persistent files are stored alongside the executable. Android uses private storage and an authorized shared-storage folder, normally Documents/LoadMosaic-Files, with storage separated by edition. Import, export and sharing destinations are chosen independently and may use other providers.

Shared or exported documents and saved copies remain under your control and may survive uninstallation. Reversible deletion and LoadMosaic history do not permanently destroy every version of a file.

3. Website and language preference

Google, through Firebase Hosting, may process the IP address, date and time, requested URL, HTTP headers, approximate browser or operating-system information, and security or network diagnostics needed to deliver and protect the website, the promotional video and the downloadable ZIP file.

The website stores only the selected language code under loadmosaic-lang in browser localStorage. It currently contains no first-party advertising, behavioural tracking or analytics.

4. Trials and licensing

Editions offering trials or activation process a contextual SHA-256 fingerprint derived from the Android identifier or a Windows computer identifier. The original identifier is not sent in plain text. The fingerprint distinguishes devices and is not anonymous. The trial service hashes it again before storing the fingerprint and dates in Cloud Firestore.

For activation, validation and deactivation, the system processes the licence key transiently, a non-descriptive technical installation alias, the instance identifier supplied by Lemon Squeezy, product or variant identifiers, timestamps, status and result. Cloud Firestore audit records contain hashes of the key and installation or instance identifiers, operation type, result and UTC date—not the key in clear text. Validly signed Lemon Squeezy webhooks store their event identifier, type and receipt date.

Network infrastructure may additionally process the source IP and technical request metadata. Hashes and aliases are treated as pseudonymous data because they can distinguish licences or installations.

Local state may contain the credential, installation alias, instance, product, status and dates, and the buyer’s email when returned by Lemon Squeezy. It is protected using DPAPI for the Windows user or MAUI SecureStorage on Android. This protection does not, by itself, encrypt projects, exports or reports.

A shared license code can link activations on different devices and recognize the corresponding entitlements. Deactivating a device releases its activation; it does not cancel a subscription or delete all remote history.

If you apply to test Android, support uses your Google Play account email to manage the invitation. When you activate your individual code, the app sends it over HTTPS with its installation identifier. The server retains the code fingerprint, an admission reference, up to two installation fingerprints and the original start and end dates of the six free months. The period starts at the first activation and does not restart after reinstallation or when Android reaches production. Expiry of access does not automatically delete these records. You may ask support to review or delete them; this request is handled separately from purchases and subscriptions, under the procedure and retention criteria in this policy.

5. Google Play purchases

For editions distributed through Google Play, Google Play presents the payment transaction. LoadMosaic does not request or receive your full card number through its license form.

To check or restore entitlements, the client sends the purchase token, package, product, environment and installation fingerprint to the LoadMosaic service. The service queries Google to verify status, validity, cancellations or refunds. It may receive Google notifications and reverify a purchase even when the application is closed.

The service retains entitlements, statuses, pseudonymized identifiers and instances. Tokens and recoverable credentials are protected with Cloud KMS; encryption does not mean deletion. Internal test profiles have separate identities and storage. Expiry of a local authorization is not a server-data deletion period.

6. Web purchases and voluntary support

Lemon Squeezy, as Merchant of Record, may process name, email, billing and tax information, country, order, licence, amount, currency, tax, payment status, refund and fraud-prevention data. The LoadMosaic owner may access the order and customer information needed to administer the licence and support, but does not receive the full payment-card number.

Messages to support@loadmosaic.com are handled through Gmail and may contain the sender’s address, message, technical information and attachments voluntarily supplied. Do not send full card details, passwords, identity documents or unrelated confidential data.

You may voluntarily prepare a support ZIP containing the active optimization, visual settings, the last 50 session actions, technical information, a screenshot of the interface and, where applicable, a manual draft. It does not automatically include other optimizations, the full personal resource catalogue or protected license files.

Documents and screenshots may contain references, descriptions and personal or business data entered by you. Diagnostic filters reduce certain sensitive data, but the ZIP is not anonymous. Review it before sending and do not include passwords, credentials, card details or identity documents.

The application asks for confirmation and hands the attachment to an email client addressed to support@loadmosaic.com. It does not send the message automatically or confirm dispatch or receipt. You can also save the ZIP without sending it. Error recovery does not send reports without your decision.

The last 50 actions are held in memory during the session. A saved ZIP, the copy handed to the email client and the message received by support have different retention cycles. An attachment handed over without copy confirmation may remain in application storage; closing a screen does not delete the recipient’s copies.

7. Purposes and legal bases

  • Provide the website, demo, licence and support; perform the contract or pre-contractual steps.
  • Activate and validate licences, prevent repeated Trials, fraud and abuse, and secure the service; performance of the contract and legitimate interests in protecting the product and users.
  • Process billing, tax, consumer and accounting obligations; compliance with legal obligations.
  • Answer privacy requests and legal claims; legal obligations and establishment, exercise or defence of claims.
  • Consent, where a specific optional processing operation requires it. Consent can be withdrawn prospectively.

8. Providers and international processing

Data may be processed by Lemon Squeezy and its payment providers for sales, and by Google through Firebase Hosting for the website, video and download; Cloud Functions for Firebase (2nd gen., running on Cloud Run) for the licensing API and webhooks; Cloud Firestore for Trial, audit and webhook records; Cloud Logging for technical logs; Secret Manager for the webhook signing secret; and Gmail for support email. Cloudflare acts temporarily only as the domain registrar and authoritative DNS provider until the domain can be transferred; it does not host the website, media, downloads or licensing service. Public authorities may receive data when legally required. These providers may process data outside the European Economic Area under their applicable safeguards, such as an adequacy decision or standard contractual clauses. Their current notices provide the applicable details.

The Google Play flow uses Google Play Billing and Android Publisher for payments and verification; Pub/Sub for notifications; Firestore for entitlements and instances; Cloud KMS to protect tokens and sign grants; and Cloud Run for APIs. Google Cloud also generates infrastructure and audit logs. Support email uses Gmail and the email client you choose.

Google Play, Google Play Billing and Lemon Squeezy process data for their own services under their terms and privacy notices. Infrastructure services contracted by LoadMosaic have the processing relationship established by their contracts; not all providers act in the same role. No single region or retention period applies to all these services. You may request information about transfer safeguards and the relevant providers at support@loadmosaic.com.

9. Retention

  • Local logistics documents remain under the user’s control until the user deletes them.
  • The language preference remains until the user clears site data or replaces the preference.
  • Trial identifiers and dates are kept for as long as needed to enforce the one-Trial rule and protect against abuse. No fixed automatic deletion deadline is promised for the current Cloud Firestore Trial collection.
  • Licence audit and webhook metadata are kept while needed to operate the licence, investigate security or fraud, meet legal duties and deal with claims. They are not kept for advertising.
  • Data needed to recognize a perpetual license or subscription is retained while necessary to provide those entitlements, handle requests, prevent fraud and meet legal obligations. Expiry of a local authorization does not delete this data.
  • Support attachments are kept for no more than 30 days from closure of the issue, and the conversation for no more than 12 months from closure. They are deleted manually by those deadlines, unless a justified exception or legally necessary retention applies and is recorded. support@loadmosaic.com manually reviews expiry dates to meet deletion deadlines and records exceptions. This is not automatic erasure or a TTL for all server collections.
  • Purchase, diagnostic and infrastructure records and providers’ copies have their own criteria. Google determines retention for data processed by Play Billing under its terms and notices; LoadMosaic does not set a remote retention period for that data here. Records subject to a legal obligation or needed for a claim may be retained for the applicable period.

10. Rights and deletion requests

You may request access, rectification, erasure, restriction, portability where applicable, or object to processing by writing to support@loadmosaic.com. Identity may be verified proportionately. You may also complain to the Spanish Data Protection Agency (AEPD) or the competent supervisory authority in your country. These rights are subject to lawful exceptions and retention duties.

State whether your request concerns support, trials or activation, or a purchase. Do not include passwords, license keys, purchase tokens or identity documents in the first message. Support will review the scope and, where necessary, proportionately verify identity and ownership before explaining the outcome and retention exceptions.

Deleting a support conversation or attachments does not deactivate a license or cancel a subscription. If you ask to delete data needed to recognize your purchase, we will explain the consequences and request specific confirmation before changing those entitlements. Cancellation of future Google Play charges is handled separately in Google Play.

The application’s privacy entry and the web deletion-request page let you view the policy or prepare an email. Preparing it does not send the request, confirm receipt or erase data. Requests are received and reviewed manually at support@loadmosaic.com; this page has no automatic erasure executor. Local data, exported copies and copies held by other providers require separate handling.

11. Google Play Billing diagnostics

Google Play Billing 9.1.0 and its transport libraries may send Google technical data to improve performance and support billing: a random client identifier, application package and application and SDK versions, Android version, memory, brand, model, manufacturer and system information, network and carrier, language and time zone.

LoadMosaic does not use this data for advertising, does not access the advertising ID and does not include advertising, Crashlytics or its own application usage analytics. This does not remove Play Billing’s technical diagnostics or providers’ network logs.

12. Security and changes

The client’s own requests to LoadMosaic APIs use HTTPS. Access controls, contextual hashes and local and remote protection of license state and credentials are used. The application does not add end-to-end encryption to support ZIP files or, by itself, encrypt all projects or external destinations. No system is completely risk-free.

This policy may be updated when processing, providers or the law change. The effective date and version identify the applicable text.