Mostra Privacy Policy

This Privacy Policy applies to information Mostra processes through the Service, including information from account holders, creators, submitters, viewers, reviewers, and people identified in creator-submitted records.

It does not govern third-party websites, social platforms, tools, streaming services, or other services linked from Mostra. Those services have their own privacy practices.

A. Account and profile information

When you create or update an account, we may collect:

• email address;
• display name, username, biography, avatar, role, and profile details;
• website and social-profile URLs;
• authentication identifiers, login status, and account settings; and
• information you provide when contacting support or requesting verification.

Authentication is provided using Supabase. Mostra does not receive or store your email-account password.

B. Creator submissions and catalogue information

When you create a draft, submit a record, request a correction, or participate in review, we may collect:

• project titles, descriptions, loglines, genres, dates, countries, runtime, formats, and status;
• posters, thumbnails, stills, source links, trailers, and related media;
• names, roles, biographies, credits, social handles, and team information;
• production tools, models, prompts, workflows, production methods, budget or efficiency information, and AI disclosures;
• ownership attestations, verification sources, verification status, and supporting information;
• submission history, administrative feedback, approval status, and moderation records; and
• any other information you choose to include in a submission.

Approved catalogue records and creator profiles may be made public. Do not submit confidential information, sensitive personal information, or information about another person unless you are authorized to provide it for the intended use.

C. Instagram connection and import information

Connecting Instagram is optional. If you connect an Instagram professional account, Mostra may receive and store:

• your Instagram app-scoped account identifier and username;
• an access token, the token's expiration time, and connection timestamps;
• identifiers and basic metadata for media available to the connected account, such as media type, permalink, caption, timestamp, username, and thumbnail or media URL; and
• the caption and thumbnail for a Reel or post that you affirmatively select for import.

Mostra uses the access token to display media available to your connected professional account and to import only the media you choose. Mostra may analyze a selected caption to suggest a title, synopsis, logline, genres, dates, or tagged team members. These suggestions are draft fields for your review; you decide whether to edit and submit them.

When you select a thumbnail for import, Mostra may copy it to Mostra-controlled storage so it can appear in your draft or Approved Record. Mostra does not use your Instagram access token to publish to Instagram, read private messages, manage comments, or access content beyond the permissions shown during authorization unless we separately request permission and update this Privacy Policy.

D. X connection and Article import information

Connecting X is optional. If you connect an X account, Mostra may receive and store:

• your X account identifier, username, display name, and profile image;
• a read-only access token, refresh token where provided, authorized scopes, token expiration, and connection timestamps; and
• identifiers, text, Article content, timestamps, language, public engagement metrics, and associated media for Posts and X Articles available through the permissions you approve.

Mostra uses this connection to let you choose a Post or X Article and copy it into an editable Mostra Article draft. Nothing is imported or published to Mostra until you select the source content and affirmatively save or publish the Mostra Article. Mostra does not use this connection to post to X, delete or edit content on X, read direct messages, follow accounts, or access information outside the permissions displayed during authorization.

E. Articles and creator writing

When you write, import, save, or publish an Article, Mostra may collect its title, subtitle, body, cover image URL, topics, source link, source identifier, draft or publication status, author attribution, and timestamps. Published Articles and their author attribution are public. Draft Articles are available only to their author and authorized Mostra administrators.

F. Community and activity information

When you interact with the Service, we may collect your:

• ratings, reviews, comments, watchlist entries, favorites, and follows;
• tool and workflow ratings;
• submission, verification, and team-request activity;
• notification preferences and related activity; and
• catalogue views, clicks, saves, and other interaction metrics.

Some community activity, such as reviews, ratings, comments, or public follows, may be visible to other users as indicated in the Service.

G. Technical and usage information

We and our hosting, database, authentication, and security providers may automatically receive technical information such as:

• IP address;
• browser, device, operating-system, and language information;
• referring and requested URLs;
• approximate request time, diagnostic logs, error information, and security events;
• authentication-session and OAuth-state cookies; and
• interactions with pages and Service features.

Mostra currently uses cookies and similar storage primarily for authentication, session continuity, security, OAuth state, and user preferences. Mostra does not currently use third-party behavioral-advertising cookies.

H. Information from other people and public sources

Creators may submit information about collaborators, contributors, studios, or rights holders. Mostra may also review public sources to verify a submission or propose catalogue information. Mostra will not knowingly publish substantive creator information obtained from a public source without creator approval, except where reasonably necessary to address fraud, safety, legal compliance, or a rights dispute.

If you are identified in a Mostra record and want to review, correct, or remove information about you, contact us as described below.

We may use personal information to:

• create, authenticate, secure, and administer accounts;
• provide, maintain, troubleshoot, and improve the Service;
• connect an Instagram account and import creator-selected media;
• connect an X account and import creator-selected Posts or X Articles into editable drafts;
• save and publish creator-authored Articles;
• generate draft suggestions from creator-selected captions;
• receive, review, verify, moderate, approve, publish, organize, and remove catalogue records;
• display creator-approved profiles, credits, submissions, ratings, and community activity;
• provide watchlists, favorites, follows, notifications, feedback, and other requested features;
• communicate about accounts, submissions, support, security, policy updates, and review decisions;
• detect, investigate, and prevent abuse, fraud, spam, security incidents, infringement, and violations of our Terms;
• comply with law, enforce agreements, protect users and third parties, and respond to valid legal requests;
• measure aggregate Service usage and performance; and
• support a financing, reorganization, acquisition, asset transfer, or change of control, subject to applicable safeguards.

Mostra does not currently use Instagram or X connection data to train a general-purpose artificial-intelligence model, build advertising profiles, or sell targeted advertising.

Where applicable law requires a legal basis, Mostra processes personal information based on one or more of the following:

• Contract: to provide the Service you request and administer your account or submissions;
• Consent: when you choose to connect Instagram or X, submit optional information, or consent to a specific use;
• Legitimate interests: to operate, secure, improve, moderate, and protect Mostra, provided those interests are not overridden by your rights;
• Legal obligation: to comply with applicable law, legal process, and valid government requests; and
• Protection of rights: to establish, exercise, or defend legal claims and protect users, Mostra, or third parties.

You may withdraw consent where processing is based on consent, but withdrawal does not affect processing that was lawful before withdrawal or processing supported by another legal basis.

We may disclose information in the following circumstances:

Public catalogue and community features

Approved Records, creator profiles, credits, images, descriptions, source links, ratings, reviews, comments, and certain community activity may be publicly visible. Public information can be viewed, copied, shared, indexed by search engines, or archived by third parties outside Mostra's control.

Service providers

We use service providers to operate the Service, including:

• Supabase for authentication, database, and file storage services; and
• Vercel for website hosting, delivery, and operational infrastructure.

These providers process information on Mostra's behalf under their applicable terms and privacy commitments. We may add or replace providers as the Service evolves.

Third-party integrations

When you connect Instagram, information is exchanged with Meta and Instagram as necessary to authenticate the account, request the permissions displayed to you, and access the features you choose. Meta and Instagram process information under their own terms and privacy policies.

When you connect X, information is exchanged with X as necessary to authenticate the account, request the permissions displayed to you, refresh the connection, and retrieve the Posts or X Articles you choose to review for import. X processes information under its own terms and privacy policy.

Legal, safety, and integrity disclosures

We may disclose information when we reasonably believe it is necessary to comply with law or valid legal process; enforce our Terms or agreements; investigate fraud, infringement, abuse, or security incidents; protect the rights, safety, and property of Mostra, users, or third parties; or report suspected illegal content.

Business transfers

Information may be disclosed or transferred in connection with a financing, merger, acquisition, reorganization, bankruptcy, asset sale, or change of control. A successor must assume applicable privacy obligations or provide notice as required by law.

With your direction

We may disclose information when you direct us to do so or give consent.

Mostra does not currently sell personal information for money or share personal information for cross-context behavioral advertising. If this changes, we will update this Privacy Policy and provide any choices required by law before beginning that activity.

We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Service, maintaining catalogue integrity, complying with law, resolving disputes, enforcing agreements, and protecting security.

Retention depends on the type of information:

• Account information: generally retained while your account is active and for a limited period afterward for security, legal, and administrative purposes.
• Instagram connection information: retained while the account remains connected and until you disconnect it, request deletion, or the information is otherwise no longer needed. Expired tokens are not used to access Instagram.
• X connection information: retained while the account remains connected and until you disconnect it, delete your Mostra account, request deletion, or the information is otherwise no longer needed. Expired access tokens are refreshed only where X provided a refresh token and you have not disconnected.
• Article drafts and published Articles: drafts are retained while saved to your account. Published Articles are retained while published. Deleting your account immediately removes active Mostra copies of Articles authored by that account, subject to the backup and legal exceptions below.
• Drafts and submissions: retained while under creator or administrative review and afterward as needed to maintain the requested record, submission history, integrity, and dispute documentation.
• Approved Records: retained while published. Following a verified creator removal request, Mostra will aim to remove public access within 10 business days and delete active platform copies within 30 calendar days.
• Self-service submission deletion: when an authenticated submitter uses Delete the submission, Mostra immediately removes the active submission and any published Mostra record tied to it. Mostra may retain a minimal non-content deletion receipt containing the submitter account identifier, original submission identifier, deletion timestamps, and a one-way source fingerprint used for security, duplicate detection, and resubmission confirmation. The receipt does not retain the submission title, caption, source URL, thumbnail, description, credits, or production details.
• Backups: restricted backup copies may remain for up to 90 days before ordinary deletion or overwrite.
• Account deletion receipts: after self-service account deletion, Mostra may retain a minimal, server-only receipt containing a one-way account identifier and aggregate counts of records removed. It does not contain your email address, profile, social handle, access token, Article text, submission title, caption, image, or source URL, and is retained only as reasonably necessary for security, audit, fraud prevention, and dispute resolution.
• Security, fraud, and legal records: retained as reasonably necessary for the relevant investigation, dispute, legal obligation, or enforcement need.

When information is retained for legal, security, backup, dispute-resolution, or enforcement purposes, it will be restricted from ordinary public or promotional use.

You can disconnect Instagram through Mostra Settings. Disconnecting deletes Mostra's active Instagram connection record, including the stored access token, and prevents future access through that connection.

Disconnecting Instagram does not automatically delete a thumbnail, caption, source link, or catalogue information that you previously selected, reviewed, and submitted to Mostra. To request deletion of previously imported or published information, use the process below.

You may also remove Mostra or request deletion through settings made available by Meta or Instagram. When Meta sends Mostra a valid signed deauthorization request, Mostra deletes the active connection and stops future Instagram access. When Meta sends a valid signed data-deletion request, Mostra deletes the associated Instagram connection, Instagram-originated submissions, copied thumbnails, verification records, and published Mostra records. Mostra returns a confirmation code and a public status URL for the request.

To request deletion directly, visit the Mostra Data Deletion page or email niveditagaur@mostra.media with the subject Data Deletion Request and include:

• the email address associated with your Mostra account;
• your Instagram username, if the request concerns Instagram data;
• the Mostra profile or submission URLs involved; and
• a description of the information you want deleted.

Do not send passwords or access tokens. We may ask you to verify your identity or authority before completing the request. We will confirm receipt and provide status information. We will explain any information we cannot delete and the reason for retaining it, where required.

X disconnection

You can disconnect X through Mostra Settings. Disconnecting deletes Mostra's active X connection record, including stored access and refresh tokens, and prevents future access through that connection. It does not delete content from X and does not automatically delete a Mostra Article that you previously selected, reviewed, and published. You may delete that content or your account using the controls Mostra makes available, or contact us using the process above.

Self-service account deletion

An authenticated user can select Delete Account at the bottom of Account Settings. After the user enters the required confirmation, Mostra immediately removes the active profile, social connection tokens, drafts, submissions, authored Articles, stored submission images, and published records owned by that account, and then deletes the authentication account. Limited restricted backups and the minimal non-content receipt described in Section 7 may remain. Credits or factual information supplied by a different user may remain where necessary to preserve that other user's record, but the deleted account will no longer remain linked to it.

Depending on your location and applicable law, you may have rights to:

• request access to personal information we hold about you;
• request correction of inaccurate information;
• request deletion of personal information;
• request restriction of or object to certain processing;
• withdraw consent;
• request a portable copy of information you provided;
• opt out of a sale, sharing, or targeted advertising if Mostra begins such activity; and
• appeal a decision regarding a privacy request where applicable.

You may update some information through your account settings. For other requests, email niveditagaur@mostra.media. We may need to verify your identity and authority. Authorized agents may submit requests where permitted by law, but we may require proof of authorization and identity verification.

We will not unlawfully discriminate against you for exercising a privacy right. Some information may be exempt from a request, including information needed to provide a requested service, protect security, comply with law, preserve another person's rights, or establish or defend legal claims.

This section supplements the rest of this Privacy Policy for California residents. During the preceding 12 months, Mostra may have collected the following categories of personal information, as described above:

• identifiers, such as email address, account ID, profile name, IP address, and social-account identifiers;
• customer-record and profile information you provide;
• internet or electronic-network activity, such as account, page, feature, and interaction activity;
• audio, visual, and similar information in creator-submitted media;
• professional or employment-related information in creator biographies and credits;
• commercial or preference information, such as favorites, watchlists, and follows; and
• inferences or suggestions derived from creator-selected captions and activity.

We collect these categories from you, other submitters, connected services you authorize, public sources used for verification, and service providers. We use and disclose them for the business and operational purposes described in Sections 3 and 5.

Mostra does not currently sell personal information or share it for cross-context behavioral advertising. We do not knowingly sell or share the personal information of people under 18.

California residents may exercise applicable rights by emailing niveditagaur@mostra.media. Whether a particular California privacy law applies to Mostra or a request depends on the law's scope and exemptions, but we will respond to verified requests as required by applicable law.

Mostra uses reasonable administrative, technical, and organizational measures designed to protect personal information. Measures include authenticated access, restricted server-side access to Instagram and X connection records, database access controls, and secure HTTPS communications.

No method of transmission, storage, or security is completely reliable. We cannot guarantee absolute security. You are responsible for protecting your credentials and for promptly notifying us of suspected unauthorized account activity.

Mostra is operated from the United States. If you use the Service from another country, your information may be transferred to, stored in, and processed in the United States and other locations where our service providers operate. Those locations may have data-protection laws different from those in your jurisdiction.

Where required, Mostra will use an appropriate legal mechanism for international transfers.

The Service is not directed to children under 18, and Mostra does not knowingly permit children under 18 to create accounts or submit content. If you believe a child has provided personal information to Mostra, contact us so we can investigate and take appropriate action.

We may update this Privacy Policy to reflect changes to the Service, integrations, legal requirements, or privacy practices. We will post the updated policy and revise the effective date. If a change materially affects your rights, we will provide additional notice where reasonably practicable or required by law.

For privacy questions, access or correction requests, Instagram or X data questions, or deletion requests, contact:

Mostra Email: niveditagaur@mostra.media