Mosaic Privacy Policy
Last updated: October 2, 2026
1. About This Policy
This Privacy Policy explains how Creators Guild of America ("CGA," "we," "us," or "our") collects, uses, shares, and protects personal information through Mosaic, CGA's verification and credits platform at
https://mosaic.creatorsguildofamerica.org, and the emails and services connected to it (together, "Mosaic").
This policy applies to Mosaic users and to people who are not users but whose information reaches Mosaic, such as company contacts asked to confirm a credit and people invited to join.
2. Who Is Responsible for Your Information
3. Information We Collect
Information you give us
- Account information. Your name, email address, username, and password (stored in protected form, not as readable text). If you sign in with Google, we receive basic profile information Google shares with us, such as your name and email address.
- Profile information. Information you add to your profile, such as a bio, role, links, and images.
- Credits. Details of work credits you list, such as the project, company, role, and dates, and the name and email address of the company contact you ask to confirm each credit.
- Invitations. The email addresses of people you invite.
- Verification information. Information and documents you submit to apply for verification, and our notes on the review.
- Course and certification information. Your course progress, quiz results, and certifications.
- Membership information. Your membership application and its review status, your membership tier and term, and your billing history. Payments are processed by Stripe (see Section 10). We do not receive or store your full card number.
- Communications. Messages you send us, support conversations, and survey or feedback responses.
Information collected automatically
- Device and connection information. Your IP address, browser type, device type, operating system, and similar technical information.
- Usage information. Pages viewed, features used, dates and times of access, and referring pages.
- Security information. Records of sign-up and sign-in attempts and other security events. When we log a refused request, we mask the IP address in that log.
Information from other sources
- Google. If you use Sign in with Google, Google confirms your identity and shares basic profile information.
- Approvers. When a company contact responds to a credit confirmation request, we record their response.
- Stripe. Stripe tells us whether a payment succeeded and gives us limited details such as the card brand, last four digits, and expiration date, so we can manage your membership.
- Cloudflare. Cloudflare tells us whether a sign-up or sign-in request passed its bot check (see Section 8).
4. People Who Are Not Mosaic Users
Mosaic depends on people who have not signed up and have not agreed to our terms. We treat their information with particular care.
Approvers. When a user lists a credit, they can name a contact at the relevant company and provide that person's email address. We use that email address to send the contact a request to confirm the credit, along with the details needed to respond, such as the user's name and the credit information. We send approvers only emails related to the requests they receive. We never add approvers to marketing lists. We keep the approver's name, email address, and response as part of the credit record.
Invitees. When a user invites someone to Mosaic, we use the email address provided to send the invitation.
Your choices. If you received an approval request or an invitation and do not want to receive further requests, or if you want us to delete your information, contact us at
support@creatorsguildofamerica.org. If you believe a request concerns work you did not oversee, or that someone used your email address improperly, tell us and we will review it.
5. How We Use Information
We use personal information to:
- Create and manage accounts and confirm email addresses.
- Display public profiles, credits, verification status, and certification records.
- Send credit confirmation requests and invitations on users' behalf.
- Review verification applications and grant, maintain, or revoke verification.
- Provide courses, score quizzes, and issue certifications.
- Review membership applications, process dues, and manage renewals and cancellations.
- Send account and service emails, such as confirmations, security alerts, receipts, renewal notices, and policy updates.
- Send CGA news and updates to users (see Section 7).
- Provide support and respond to inquiries.
- Protect Mosaic and its users, including detecting and blocking bots, fraud, abuse, and impersonation.
- Understand how Mosaic is used and improve it.
- Comply with law, enforce our terms, and protect our rights and the rights of others.
6. Public Information
Mosaic is designed to make verified professional records visible. The following can be public:
- Your profile page at mosaic.creatorsguildofamerica.org/{your username}, including the information you add to it.
- Your credits and their confirmation status.
- Your verification status, including any seal.
- Your certification records at their own public addresses.
Accounts that have not completed email confirmation do not have a public page.
Public pages can be viewed by anyone, indexed by search engines, and copied. You can edit or remove most profile content and credits in your account. To remove a certification record or other public information you cannot remove yourself, contact
support@creatorsguildofamerica.org. We cannot remove copies others have made or that search engines have cached.
7. Emails From Us
Account and service emails. We use Twilio SendGrid to send emails needed to operate Mosaic. You cannot opt out of these while you have an account.
CGA news and updates. When you create an account, we add your email address to CGA's mailing list for news, programs, and events, managed through Mailchimp. Members, former members, and brands may receive different communications suited to their relationship with CGA. You can unsubscribe at any time using the link in any of these emails. Unsubscribing does not affect account and service emails.
Approvers never receive marketing emails. See Section 4.
8. Bot Protection by Cloudflare Turnstile
Mosaic uses Cloudflare Turnstile, a security service provided by Cloudflare, Inc., on its sign-up and sign-in pages to tell people apart from automated bots. Turnstile runs in the background and usually does not require you to do anything.
To perform this check, Cloudflare processes technical signals from your browser and connection, such as your IP address and information about your browser. Cloudflare processes this information on CGA's behalf to protect Mosaic. Cloudflare also uses this information for its own purpose of improving Turnstile's ability to detect bots, and for that purpose Cloudflare is responsible for its processing under its own policies.
In addition to Turnstile, Mosaic limits how often requests can be made from an IP address and keeps records of refused requests, with IP addresses masked, to protect against abuse.
9. Cookies and Similar Technologies
Mosaic uses cookies and similar technologies that are needed to keep you signed in, keep Mosaic secure, and remember your settings. Cloudflare Turnstile relies on technologies that are strictly necessary for bot detection. Some Mosaic pages include Cloudflare's web analytics script, which helps us understand how pages are used. Where our support messenger appears, it may use cookies needed to operate it.
You can control cookies through your browser settings. If you block necessary cookies, parts of Mosaic, including sign-in, may not work.
10. Service Providers
We use the following service providers to operate Mosaic. They process personal information for us to perform these services.
- Google Cloud (Google LLC): hosting Mosaic and storing application secrets.
- Google sign-in (Google LLC): letting you sign in with your Google account. See the Google Privacy Policy.
- Cloudflare (Cloudflare, Inc.): bot protection on sign-up and sign-in (Turnstile), and web analytics on some pages. See Section 8.
- Twilio SendGrid (Twilio Inc.): sending account, service, and request emails.
- Stripe (Stripe, Inc.): processing membership payments through Stripe Checkout. See the Stripe Privacy Policy.
- Mailchimp (Intuit Inc.): sending CGA news and updates to users who have not unsubscribed.
- Zapier (Zapier, Inc.): moving information between the services listed here.
- Airtable (Formagrid, Inc.): maintaining member records.
- Intercom (Intercom, Inc.): member support and relationship management.
- Slack (Slack Technologies, LLC): notifying CGA staff internally about account and membership activity.
We may change service providers over time and will update this list.
11. How We Share Information
We share personal information only as described in this policy:
- With service providers listed in Section 10, so they can provide services to us.
- Publicly, for the information described in Section 6.
- With approvers and invitees, to the extent needed to send a request or invitation a user initiated.
- With your direction or consent.
- For legal reasons, when we believe in good faith that disclosure is needed to comply with law or legal process, to enforce our terms, or to protect the rights, safety, or property of CGA, our users, or others.
- In a reorganization, if Mosaic or CGA's interest in it is transferred, including in a merger, reorganization, or transfer of assets, in which case the recipient will be bound by this policy or will give you notice of any change.
CGA does not sell personal information, and does not share it for cross-context behavioral advertising.
12. How Long We Keep Information
We keep personal information only as long as needed for the purposes in this policy, unless a longer period is required by law.
- Account and profile information: while your account is open, and for a limited period after you close it, unless you ask us to delete it sooner.
- Credit records, including approver information: for as long as the credit remains on Mosaic, and for a limited period after it is removed.
- Certification records: for as long as the record is published, so that the record remains reliable, unless removed on request or revoked.
- Membership and payment records: for as long as needed to meet tax, accounting, and legal obligations.
- Security and request logs: for a limited period, unless needed longer to investigate a security issue.
- Mailing list records: until you unsubscribe. We keep a record that you unsubscribed so that we do not email you again.
- Backups: deleted information may remain in backups for a limited period before it is overwritten.
When information is no longer needed, we delete or de-identify it.
13. How We Protect Information
We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including encrypted connections and restricted access. No method of transmission or storage is completely secure, and we cannot guarantee security.
14. Your Choices and Rights
- Access and correction. You can view and update most account and profile information in Mosaic. You can also ask us for a copy of your information or to correct it.
- Deletion and account closure. You can ask us to close your account and delete your information. Some information may be kept as described in Section 12, such as records we must keep by law.
- Marketing emails. You can unsubscribe at any time using the link in any marketing email.
- Approvers and invitees. See Section 4.
To make a request, email
legal@creatorsguildofamerica.org. We may need to confirm your identity before acting on a request. We will not discriminate against you for exercising your choices or rights.
15. California Residents
California's "Shine the Light" law allows California residents to request information about disclosures of personal information to third parties for their own direct marketing purposes. CGA does not disclose personal information to third parties for their own direct marketing purposes. To make a request, email
legal@creatorsguildofamerica.org.
16. Residents of Other U.S. States
Depending on where you live, you may have rights under your state's privacy law, such as the right to access, correct, delete, or obtain a copy of your personal information, and to opt out of certain processing. To make a request, email
legal@creatorsguildofamerica.org. If we deny your request, you may appeal by replying to our response.
17. Users Outside the United States
Mosaic is operated from the United States, and information is processed in the United States and other countries where our service providers operate. Privacy laws in those countries may differ from the laws where you live. Where the law of your country requires it, we will process your information on an appropriate legal basis, protect international transfers with appropriate safeguards, and honor the rights that law gives you, which may include the right to object to processing and to complain to your local data protection authority.
18. Children
Mosaic is intended for people 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has given us personal information, contact us at
legal@creatorsguildofamerica.org and we will delete it.
19. Changes to This Policy
We may update this policy from time to time. If we make material changes, we will notify users by email, by a notice in Mosaic, or both, before the changes take effect. The "Last updated" date at the top shows when this policy was last revised.
20. Contact
Creators Guild of America
4500 Park Granada Blvd, Suite 202
Calabasas, CA 91302