1. Data Controller
The data controller responsible for the processing described in this Privacy Policy is:
The Human Mosaic
Founder / Project Owner:
Giuseppe Ardizzone
Contact email:
info@thehumanmosaic.art
2. Personal Data We Collect
Depending on how you use the website, immersive museum, Museum Account, and participation services, we may collect and process:
- First name and last name
- Email address
- Nickname
- Country
- Date of birth
- Account and authentication identifiers
- Selected room, wall, section, spot, and slot code
- Uploaded image and related file information
- Optional notes submitted with participation
- Submission, moderation, and participation status
- Likes, comments, views, and related social activity
- Payment-related identifiers and status information
- Technical, security, and session information
- Communications sent to us by email
The Human Mosaic does not intentionally request unnecessary special categories of personal data. Participants should avoid providing sensitive personal information unless it is clearly relevant to the artistic purpose of their submission.
3. Purposes of Processing
We process personal data to:
- Create and manage Museum Accounts
- Authenticate users and recover account access
- Manage participation in The Human Mosaic
- Reserve and assign positions within the artwork
- Verify payment status and complete participation flows
- Receive, store, review, moderate, and manage uploads
- Display approved submissions within the project
- Operate likes, comments, views, and community features
- Issue confirmations and official digital certificates
- Provide support and answer legal or collaboration inquiries
- Prevent fraud, abuse, unauthorized access, and security risks
- Maintain backups and protect project integrity
- Comply with applicable legal obligations
4. Legal Bases for Processing
We process personal data on one or more of the following bases:
- Consent — when you voluntarily provide information, upload content, or confirm required permissions.
- Performance of a contract — when processing is necessary to manage paid participation and related services.
- Legitimate interests — when necessary to operate, secure, improve, and protect the platform and project.
- Legal obligations — when processing is required by applicable law.
5. Museum Accounts and Social Activity
A Museum Account may contain profile information, participation history, uploaded memories, submission status, comments, likes, and statistics connected to the user’s activity.
Nicknames and countries may be displayed with public comments. We do not publicly expose private authentication details through community features.
View information may be recorded using technical visitor and session identifiers to prevent duplicate counting and maintain accurate statistics.
6. Payments
Payments are processed through third-party providers, including Stripe. The Human Mosaic does not store complete payment-card details on its own servers.
Payment information available to the project may include transaction status, checkout-session identifiers, payment references, and metadata required to verify participation.
7. Service Providers
The Human Mosaic uses specialist providers to operate the platform, including:
- Supabase — authentication, database, application storage, and infrastructure
- Stripe — payment processing
- Resend — transactional email delivery
- Vercel — website and application hosting and deployment
These providers may process personal data on our behalf or act as independent controllers, depending on the service involved.
8. Public Display of Approved Content
Approved images and limited participation information may be displayed publicly within The Human Mosaic, including its website, gallery, immersive museum, promotional features, and future digital or physical exhibitions connected to the project.
Do not submit content unless you understand that an approved contribution may become publicly visible as part of a permanent global artwork.
9. Minors and Third-Party Images
If uploaded content contains identifiable individuals, the participant must hold all permissions required to submit and publicly display that content.
If an image contains a minor, the participant must have valid consent from the minor’s parent or legal guardian.
The participant remains responsible for obtaining all necessary permissions, consents, releases, and authorizations.
10. Data Retention
Personal data is retained only for as long as reasonably necessary for the purposes described in this policy, including account management, participation, moderation, public display, certificate issuance, support, legal compliance, disputes, and recordkeeping.
Approved submissions may be retained for the duration of the project and its archival, museum, or exhibition development, subject to applicable law and valid individual rights.
Limited records may be retained where necessary to satisfy legal obligations, protect project integrity, resolve disputes, prevent fraud, or enforce the applicable terms.
11. Backups and Data Integrity
Technical and organizational backups may be created to protect the project, preserve approved contributions, and prevent accidental loss or corruption.
Backup copies may remain for a limited period after data has been removed from active systems, subject to security, legal, and restoration requirements.
12. International Data Transfers
Some service providers may process or store personal data outside the European Economic Area.
Where international transfers occur, we aim to rely on safeguards required under applicable data-protection law, including contractual, organizational, and technical measures where relevant.
13. Security Measures
The Human Mosaic applies reasonable technical and organizational safeguards designed to protect personal data against unauthorized access, loss, alteration, misuse, or disclosure.
No internet-based service can guarantee absolute security. Users should understand that online systems always involve some level of risk.
14. Your Rights
Subject to applicable law, you may have the right to:
- Request access to your personal data
- Request correction of inaccurate or incomplete data
- Request deletion of personal data
- Request restriction of processing
- Object to certain processing activities
- Request data portability where applicable
- Withdraw consent where processing relies on consent
- Lodge a complaint with a competent data-protection authority
To exercise these rights, contact: info@thehumanmosaic.art
15. Deletion Requests
Requests concerning deletion of an account, submission, image, comment, or related personal data may be sent to: info@thehumanmosaic.art
Each request will be assessed in light of applicable legal obligations, participation status, project integrity, public display, and any lawful grounds for retention.
16. Cookies and Similar Technologies
The Human Mosaic may use essential cookies, local storage, session storage, or similar technologies necessary for authentication, navigation, security, social counters, and platform performance.
If non-essential analytics, advertising, or tracking technologies are introduced, this policy and any required consent mechanisms will be updated accordingly.
17. Charitable Initiatives
The Human Mosaic may communicate charitable initiatives supported by the project. Such communications will not disclose participant personal data unless a lawful basis and any required permission exist.
18. Changes to This Policy
This Privacy Policy may be updated as the project evolves, legal requirements change, or new services and features are introduced.
The latest version published on the official website will apply.