Demo Apps Privacy Policy

This Privacy Policy describes how Mostrum Srl processes the personal data of users who sign in with Google or Meta (Facebook) to the demo and staging applications that Mostrum develops for its clients (the "Demo Apps"). Demo Apps are used to present, test and validate software and to release new features early, before they go live, and they use Mostrum's OAuth credentials until the client has its own permanent account. This policy does not cover the mostrum.com website, which is covered by the website Privacy Policy.

1. Data controller

Mostrum Srl, Via Generale Antonio Chinotto 24, 36100 Vicenza (VI), Italy. VAT number IT04448080244. For any privacy request: [email protected].

2. Data we collect

When you choose to sign in with Google or Facebook, we receive from the provider only the information you authorize on the consent screen. This usually means:

• your name;
• your email address;
• your profile picture;
• the unique identifier of your account with the provider.

We request basic scopes only: openid, email and profile for Google; public_profile and email for Meta. If a specific Demo App needs additional permissions, they are shown explicitly on the provider's consent screen and used only for the stated feature. In addition, a Demo App may store the content you enter while using it and the technical logs needed for operation and security (IP address, date and time of access).

3. How we use your data

Your data is used only to:

• authenticate you and create your profile in the Demo App;
• let you use the Demo App's features during the demonstration and testing phase;
• keep the service secure and troubleshoot technical issues.

The legal basis is the performance of the service you requested (Art. 6(1)(b) GDPR) and our legitimate interest in keeping our systems secure (Art. 6(1)(f) GDPR). Your data is not used for advertising, profiling or marketing, is not sold, and is not used to train artificial intelligence models.

4. Data received from Google APIs

Mostrum's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Sharing

Your data may be accessed by Mostrum staff and by the client the Demo App is built for, only for the purposes above. It may also be processed by hosting and cloud infrastructure providers acting as data processors. Any transfer outside the European Economic Area is covered by the safeguards required by the GDPR, such as Standard Contractual Clauses. We do not share your data with third parties for any other purpose.

6. Retention

Your data is kept for as long as the Demo App's demo or staging environment remains active, unless you delete your profile or ask us to delete it sooner. When the environment is decommissioned, the data is deleted.

7. Security

We apply appropriate technical and organizational measures to protect your data, including encrypted connections (HTTPS), access restricted to authorized staff, and storage on protected infrastructure.

8. Your rights

Under Articles 15-22 of the GDPR you can ask to access, correct, delete, restrict or port your data, and object to its processing, by writing to [email protected]. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with your local supervisory authority.

To delete your data, follow the data deletion instructions. You can also revoke the Demo App's access at any time from your Google or Facebook account settings.

9. Children

Demo Apps are intended for business clients and their staff and are not directed to children under 16.

10. Changes

We may update this policy. The current version is always published on this page, together with the date of the last update.