Privacy policy

Last updated: 25 September 2026

This policy explains what personal data Mosaiq processes when you use the Mosaiq website, request access, use the app, or use the API. It explains why Mosaiq processes that data, who receives it, how long Mosaiq keeps it, and what rights you have.

1. Who is responsible for your data

  • The controller of your personal data is 0D Labs, a company incorporated in the Cayman Islands. In this policy, "Mosaiq", "we" and "us" mean that company.
  • You can contact Mosaiq about privacy at hello@mosaiq.broker.

2. What this policy covers

This policy covers:

"Account", "Wallet", "Venue" and other capitalized words have the meaning given in the terms of service at https://mosaiq.broker/terms.

3. Personal data Mosaiq processes

3.1 Website

  • The Website sets no cookies. It runs no analytics and loads no third-party scripts.
  • Vercel hosts the Website, including the documentation. Vercel records each request, including your IP address, browser user agent, the page requested and the time.
  • To show live order book depth, your browser connects directly to the public APIs of Hyperliquid at https://api.hyperliquid.xyz and Lighter at https://mainnet.zklighter.elliot.ai. Your browser also fetches fee rates from Mosaiq's API at https://production.mosaiq.0d.finance/v1/fees. Each of these services receives your IP address and browser user agent. Hyperliquid and Lighter handle that data under their own privacy policies.
  • Your browser keeps a copy of public order book data in its session storage for up to 30 minutes, to load the page faster. This copy contains no personal data and never leaves your browser.

3.2 Access requests

  • The access request form on the Website does not send anything to Mosaiq. When you submit it, it opens a draft email in your own email app, addressed to access@mosaiq.broker.
  • The draft contains your email address and, if you fill them in, your Telegram or X handle, where you trade today, and your monthly trading volume band.
  • Mosaiq receives this data only if you send the email. Mosaiq then also receives anything else you add, and the metadata your email provider attaches, such as your name and the time you sent it.
  • Mosaiq's email is hosted by Google Workspace.

3.3 App

When you use the App, Mosaiq processes:

  • your Wallet address, which identifies your Account;
  • the invitation code you redeem, if any;
  • sign-in data. You sign in through Para, a third-party authentication service, by connecting your wallet software and signing a message. Para issues a session token that the App sends to Mosaiq. Para processes your Wallet address, your signature, your IP address and information about your device and browser;
  • API Key records: the key identifier, its prefix, and when it was created, expires and was revoked. Mosaiq does not store the API Key itself.
  • deposit and withdrawal records: amounts, sending and receiving addresses, transaction hashes, block numbers, status, review reasons and times;
  • your trading records: balances, positions, orders including the client order IDs you choose, Fills, fees, funding, margin, account-tier limits and liquidation events; and
  • technical data: your IP address, browser user agent and request times.

The App also sends blockchain requests through a public Arbitrum One RPC endpoint at https://arb1.arbitrum.io/rpc. That endpoint receives your IP address, your Wallet address and the transactions you ask your wallet to send.

When you connect a wallet, such as MetaMask, Rabby, Coinbase Wallet or Safe, your wallet provider handles your data under its own privacy policy.

The App stores two items in your browser: your selected Wallet address in local storage, and your invitation code in session storage until you close the tab. Para's software also stores sign-in session data in your browser. Para may also collect usage data under its own privacy policy.

3.4 API

When you use the API, Mosaiq processes:

  • your Wallet address and API Key;
  • your orders, cancellations, deposit and withdrawal requests, and the responses Mosaiq sends;
  • your IP address, which Mosaiq uses to apply rate limits and protect the API; and
  • connection data such as request times and WebSocket sessions.

3.5 Public data about your Account

  • Your Wallet address and your USDC transfers on Arbitrum One are public on that blockchain. Anyone can see them.
  • Mosaiq's API lets anyone who knows a Wallet address read that Account's balances, positions, open orders, Fills and funding. Mosaiq does not require sign-in for these read endpoints.
  • Mosaiq places orders at Venues through its own pooled Venue accounts. Activity in those accounts is public on the Venues. Mosaiq does not send your name or contact details to Venues.

A Wallet address is personal data when it can be linked to you. Use a Wallet that you are comfortable having linked to your trading.

3.6 Messages and support

When you email Mosaiq, for example at hello@mosaiq.broker, or message Mosaiq on X, Mosaiq processes your message, your contact details and any information you choose to share.

3.7 Eligibility and compliance checks

Mosaiq may check Wallet addresses, IP addresses and transactions against sanctions lists and the restrictions in its terms of service. It may ask you for information to confirm your eligibility.

4. Why Mosaiq processes your data and on what legal basis

Where the EU or UK General Data Protection Regulation applies, Mosaiq processes your data for the purposes below, on the legal basis given for each.

  • Serving and securing the Website, App and API. This includes request logs and rate limits. Mosaiq relies on its legitimate interest in running secure and reliable services.
  • Reviewing access requests and replying to them. Mosaiq relies on the steps you ask it to take before entering a contract, and on its legitimate interest in choosing beta participants.
  • Providing your Account. This includes sign-in, API Keys, deposits, withdrawals, orders, margin, liquidation, fees and funding. Mosaiq relies on the performance of its contract with you under the terms of service.
  • Checking eligibility and sanctions status, and preventing fraud, market abuse and money laundering. Mosaiq relies on its legal obligations under the laws of the Cayman Islands and other laws that apply to it, and on its legitimate interest in keeping restricted persons off the platform and meeting the requirements of the Venues.
  • Keeping financial, trading and tax records. Mosaiq relies on its legal obligations, and on its legitimate interest in keeping accurate records.
  • Sending service messages. These include notices of changes, Halts or security issues. Mosaiq relies on the performance of its contract with you, and on its legitimate interest in keeping users informed.
  • Establishing, exercising or defending legal claims. Mosaiq relies on its legitimate interest.
  • Product news and announcements by email. Mosaiq sends these only with your consent, which you can withdraw at any time.

Where Mosaiq relies on legitimate interests, it has weighed those interests against your rights. You can ask for details of that assessment.

Mosaiq does not sell your personal data. Mosaiq does not use it for advertising.

5. Automated decisions

Mosaiq's risk engine makes automated decisions about your Account. It decides whether to accept an order, whether you can withdraw, and when to liquidate your positions. These decisions can have a significant effect on you. They are necessary to perform the contract in the terms of service. The rules behind them are set out in the terms of service and the documentation. You can contact Mosaiq to ask a person to review a decision, to give your point of view, or to contest it.

6. Who receives your data

Mosaiq shares personal data only with the recipients below, and only as needed for the purposes in section 4.

  • Vercel hosts the Website and the App. It receives your IP address, user agent, the page requested and the time. Role: processor.
  • Amazon Web Services hosts the API and Mosaiq's databases. It receives all App and API data in sections 3.3 and 3.4. Role: processor.
  • Para provides sign-in and wallet connection in the App. It receives your Wallet address, signatures, IP address, device and browser data, and session data. Role: independent controller, under Para's own terms.
  • Google Workspace hosts Mosaiq's email. It receives the emails you send, including access requests. Role: processor.
  • Hyperliquid and Lighter serve public market data directly to your browser on the Website. They receive your IP address and user agent. Role: independent controllers.
  • The public Arbitrum One RPC endpoint relays the App's blockchain requests. It receives your IP address, Wallet address and transactions. Role: independent controller.
  • Your wallet provider signs and sends the transactions you approve. It receives the data you share with your wallet. Role: independent controller, chosen by you.

Mosaiq may also share personal data:

  • with professional advisers, auditors and insurers, under confidentiality duties;
  • with courts, regulators, law enforcement or other authorities, when the law requires it or to protect Mosaiq's legal rights;
  • with a Venue, when needed to investigate market abuse or a problem with an order; and
  • with a buyer or successor, if Mosaiq sells, merges or restructures its business, under this policy.

7. International transfers

Mosaiq is based in the Cayman Islands. Mosaiq and its service providers process personal data in that jurisdiction and in other countries, including the United States. Mosaiq's API and databases are hosted in Japan.

When Mosaiq transfers personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, it uses safeguards the law recognizes, such as the European Commission's standard contractual clauses. You can ask Mosaiq for a copy of the safeguards.

8. How long Mosaiq keeps your data

  • Website request logs: no longer than 30 days.
  • Access requests that do not lead to an Account: 12 months after the request.
  • Account records, including sign-in, deposit, withdrawal and trading records: while your Account is open, then for 5 years after it closes, or longer where the law requires.
  • API Key records: as long as the Account records above.
  • API and security logs, including IP addresses: 12 months.
  • Messages and support emails: 3 years after the last message.
  • Eligibility and sanctions check records: 5 years after your Account closes.
  • Browser storage: the Website's order book copy expires after 30 minutes. The App's session storage clears when you close the tab. You can clear local storage at any time in your browser.

Data recorded on a public blockchain is permanent. Mosaiq cannot change or delete it.

9. Security

Mosaiq protects personal data with technical and organizational measures. These include encrypted connections, strict browser security headers on the App, API Keys that are shown only once and expire after 30 days, withdrawals only to the Wallet that owns the Account, and access controls on Mosaiq's systems.

No system is fully secure. Protect your Wallet and your API Keys. If you think your Account has been compromised, contact Mosaiq at once.

10. Your rights

Where the EU or UK GDPR applies, you have the right to:

  • access your personal data and get a copy of it;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict how Mosaiq processes your data;
  • receive data you gave Mosaiq in a portable format;
  • object to processing based on legitimate interests;
  • withdraw consent at any time, where Mosaiq relies on consent; and
  • ask a person to review an automated decision, as section 5 explains.

These rights have limits. For example, Mosaiq may need to keep trading and compliance records that the law requires, and it cannot erase data from a public blockchain.

To exercise a right, contact Mosaiq using the details in section 1. Mosaiq may ask you to sign a message with your Wallet to confirm that the Account is yours. Mosaiq will reply within one month. For complex or numerous requests, it may extend this by up to two more months and will tell you why.

You also have the right to complain to a data protection authority, in particular in the country where you live or work, or where you think a breach occurred. In the Cayman Islands, the data protection authority is the Office of the Ombudsman.

People in other places may have similar rights under their local law. Mosaiq will handle those requests in the same way.

11. Children

The Services are not for anyone under 18. Mosaiq does not knowingly collect data from children. If you think a child has given Mosaiq personal data, contact Mosaiq and it will delete the data.

12. Cookies and browser storage

The Website sets no cookies. The App uses the browser storage described in section 3.3 only to make sign-in and the App work. Mosaiq does not use browser storage for analytics or advertising.

13. Changes to this policy

Mosaiq may update this policy. It will publish the new version on the Website and update the date at the top. If a change is significant, Mosaiq will also tell you through the App, the Website, or by email if Mosaiq has your email address.

14. Contact