Privacy Policy

Heartland (“we,” “us,” or “our”) operates Marketing Mosaic, multi-brand marketing analytics in one view. Marketing Mosaic is an internal dashboard for authorized Heartland staff and other users we invite. There is no public self-serve signup.

This policy describes how we collect, use, store, and share information when you use Marketing Mosaic. It is written to match how the product works today.

We collect the categories of information below to run Marketing Mosaic and the marketing work it supports.

Account and authentication

When we create or you use an account, we store your name, email address, password hash, role, and which brands you may access. We keep you signed in with a session cookie issued by our authentication provider (Auth.js).

Brand and client marketing data

Authorized users enter and maintain brand records, including names, websites, logo URLs, CRM and digital settings, and contacts such as implementation-agency company, name, and email. Brands may also store scheduled email-report recipient addresses.

Google account and API data

When a user connects Google products for a brand, we receive the Google account email used to authorize the connection and OAuth tokens, which we store encrypted. We request the following Google scopes so the dashboard can read (and, where needed, act on) connected properties:

• OpenID, email, and profile (to identify the Google account)
• Google Analytics 4 (read-only)
• Google Search Console (including sitemap submission where used)
• Google Business Profile
• Google Ads and Local Services Ads

We store selected property, site, location, and ads-account identifiers, plus synced marketing metrics, PageSpeed and Lighthouse audit runs, and related error or connection-status details.

Other product data

• Weather snapshots for configured locations (including zip code, city, and state) from the National Weather Service
• Generated AI overviews for a brand, date range, and comparison mode
• Audit logs of significant actions (who did what, on which brand, and when)
• Usage counters for third-party APIs such as Ahrefs monthly call volume

Cookies and local storage

We use a session cookie to keep you signed in and a theme-preference cookie (marketing-mosaic-theme) so the interface stays in light or dark mode. The same theme preference, whether the Ask Milo sidebar is open, and whether the brand navigation is collapsed, may also be stored in your browser’s local storage. We load Google Tag Manager (container GTM-PBRHBLD6) on pages of Marketing Mosaic. Tags configured in that container may set cookies and send usage data to the services configured in Tag Manager.

Ask Milo and browser-only tools

If you use Ask Milo, your prompt and the brand context needed to answer it are sent to our AI provider for that turn. We do not store Ask Milo conversations as a chat history in our database. Image compress and WebP conversion tools process files in your browser; we do not upload those files to our servers unless a future feature adds that path.

We use the information described above to:

• Authenticate users and enforce role-based brand access
• Show combined marketing analytics, reports, and in-app tools for connected brands
• Sync and refresh Google, weather, and other connected data
• Generate AI overviews and Ask Milo answers from brand data you can already access
• Send scheduled email reports to addresses stored on a brand
• Operate, secure, debug, and improve Marketing Mosaic

Marketing Mosaic accesses Google user data only to provide and improve the dashboard features a connected brand uses: metrics, search and ads reporting, Business Profile insights, PageSpeed and Lighthouse audits, Search Console tools, AI overviews, Ask Milo, and email reports. We do not sell Google user data, use it to serve advertisements, or use it for purposes unrelated to those features.

Marketing Mosaic's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Access inside Marketing Mosaic is limited by role (for example Super Admin, Admin, Corporate, Regional Marketer, and Brand Marketer) and per-brand assignment. We do not sell personal information.

We share information with processors only as needed to run the service:

• Google — OAuth, Analytics, Search Console, Business Profile, Ads, Local Services Ads, and PageSpeed Insights
• Google Tag Manager — site usage measurement for Marketing Mosaic
• Fireworks — AI overviews and Ask Milo
• Ahrefs — SEO research tools used by Ask Milo
• Resend — delivery of scheduled brand email reports
• National Weather Service — weather data for brand locations
• Federal Reserve Bank of St. Louis (FRED) — economic series used by Mega Chart
• Railway — application hosting and related infrastructure

We may also disclose information if required by law, to protect Heartland or our users, or in connection with a reorganization of Heartland operations that includes Marketing Mosaic.

Google OAuth access and refresh tokens are stored encrypted. Passwords are stored as hashes, not in plain text. Transmission uses HTTPS. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

We keep account, brand, connection, metric, audit, and related records for as long as they are needed to operate Marketing Mosaic, and otherwise as Heartland requires. When a Google product is disconnected, we stop using that connection’s tokens for new syncs. When an account or brand is removed, we delete or de-identify associated records in the ordinary course of operating the product, except where we must retain information for security, audit, or legal reasons.

Authorized users can update some account details (such as password) in Marketing Mosaic. Brand and integration data is managed by users with the appropriate role. To request access, correction, or deletion of personal information we hold about you, contact us at privacy@heartland.com. We may need to verify that you are the person the request concerns and that we are allowed to fulfill it.

Marketing Mosaic is a workplace tool. It is not directed at children, and we do not knowingly collect personal information from children.

We may update this policy as Marketing Mosaic or our practices change. The effective date at the top of this page will change when we do. The updated policy applies when it is posted on this page.

Privacy questions and requests can be sent to privacy@heartland.com.

Heartland
Available upon request