Privacy Policy

This Privacy Policy explains how Moonlight Tech LLC ("Company," "we," "us," or "our") collects, uses, discloses, and protects your personal information when you use the Moltinger platform and services at moltinger.com (the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

1. Data Controller

The data controller responsible for your personal information is:

Moonlight Tech LLC
Email: [email protected]

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, and password when you register for an account.
• Billing Information: Payment card details (card number, expiration date, CVC), billing address. These are collected and processed directly by Stripe and are never stored on our servers.
• API Keys: Third-party API keys (e.g., Anthropic, OpenAI) that you configure for your instance. These are encrypted at rest using AES-256-GCM with per-instance key derivation.
• Support Communications: Information you provide when contacting us for support.

2.2 Information Collected Automatically

• Technical Data: IP address, browser type and version, operating system, device type, and screen resolution.
• Usage Data: Pages visited, features used, timestamps of actions, and referring URLs.
• Log Data: Server logs that may include request URLs, response status codes, and timestamps. These are used for security monitoring and debugging.

2.3 Information from Third Parties

• Stripe: Transaction status, payment confirmation, subscription status, and invoice data. Stripe may share limited information as described in their Privacy Policy.

3. How We Use Your Information

We use your personal information for the following purposes:

• Service Delivery: To create and manage your account, provision and operate your instance, and provide customer support.
• Payment Processing: To process subscription payments, issue invoices, and manage billing through Stripe.
• Security: To detect and prevent fraud, unauthorized access, and abuse of the Service. This includes rate limiting, audit logging, and monitoring.
• Communication: To send transactional emails (account verification, password reset, billing notifications) and, with your consent, product updates and announcements.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.
• Service Improvement: To analyze usage patterns and improve the performance, reliability, and features of the Service.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:

• Contract Performance: Processing necessary to fulfill our contract with you (account management, service delivery, billing).
• Legitimate Interests: Processing necessary for our legitimate business interests (security, fraud prevention, service improvement), balanced against your rights.
• Legal Obligation: Processing necessary to comply with legal requirements (tax reporting, law enforcement requests).
• Consent: Where required, such as for marketing communications. You may withdraw consent at any time.

5. Third-Party Service Providers

We share your personal information with the following third parties, solely for the purposes described:

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

6. Cookies & Tracking Technologies

6.1 Cookies We Use

• Strictly Necessary Cookies: Authentication session cookies (NextAuth session token) and instance access cookies. These are essential for the Service to function and cannot be disabled.

6.2 Cookies We Do Not Use

We do not use analytics cookies, marketing cookies, social media tracking pixels, or any third-party advertising trackers. We do not use Google Analytics or similar services.

6.3 Third-Party Cookies

Stripe may set cookies when you interact with the payment form (Stripe.js) for fraud detection purposes. See Stripe's Cookie Policy for details.

6.4 Do Not Track

We honor Do Not Track (DNT) signals and Global Privacy Control (GPC) signals. Since we do not use tracking or analytics cookies, there is no tracking behavior to disable.

7. Data Retention

• Account data: Retained for the duration of your account plus 30 days after deletion, then permanently erased.
• Instance data: Retained for 30 days after subscription cancellation, then permanently destroyed.
• Billing records: Retained for 7 years as required by tax and accounting regulations.
• Audit logs: Retained for 90 days for security purposes, then automatically purged.
• Encrypted API keys: Deleted immediately when you remove them or when your instance is destroyed.

8. Data Security

We implement industry-standard technical and organizational measures to protect your data:

• Encryption in transit: All connections use TLS 1.2+ (HTTPS enforced via HSTS with preload).
• Encryption at rest: Customer API keys are encrypted using AES-256-GCM with PBKDF2 key derivation (100,000 iterations) and per-instance salting.
• Password hashing: User passwords are hashed with bcrypt (cost factor 12). We never store plaintext passwords.
• Instance isolation: Each customer instance runs in its own container with dedicated network isolation, read-only filesystem, and non-root execution.
• Payment security: Payment card data is handled entirely by Stripe, which is PCI DSS Level 1 certified. Card details never touch our servers.
• Access controls: Administrative access is restricted, audited, and requires multi-factor authentication.

While we take security seriously, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

9. Your Rights

9.1 GDPR Rights (EEA, UK, Switzerland)

If you are located in these regions, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Restriction: Request that we limit processing of your data in certain circumstances.
• Portability: Request your data in a structured, machine-readable format.
• Object: Object to processing based on legitimate interests.
• Withdraw Consent: Where processing is based on consent, withdraw it at any time.
• Complaint: Lodge a complaint with your local data protection authority.

9.2 CCPA/CPRA Rights (California Residents)

If you are a California resident, you have the right to:

• Know: Request disclosure of the categories and specific pieces of personal information we have collected.
• Delete: Request deletion of your personal information.
• Correct: Request correction of inaccurate personal information.
• Opt-Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising.
• Non-Discrimination: You will not be discriminated against for exercising your privacy rights.

9.3 How to Exercise Your Rights

To exercise any of the above rights, contact us at [email protected]. We will respond within 30 days (or within the timeframe required by applicable law). We may need to verify your identity before processing your request.

10. International Data Transfers

Your data may be processed in the United States, where our servers are located. If you are located outside the United States, your data will be transferred to and processed in the US.

For transfers from the EEA/UK, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms. Stripe independently maintains appropriate data transfer mechanisms as described in their Data Processing Agreement.

11. Children's Privacy

The Service is not intended for individuals under the age of 18 (or the applicable age of majority). We do not knowingly collect personal information from children. If we become aware that we have collected data from a child without parental consent, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at [email protected].

12. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you by email within 72 hours of becoming aware of the breach (or as required by applicable law). We will also notify relevant data protection authorities where required.

13. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you. Rate limiting and fraud detection are applied uniformly based on technical signals (IP address, request frequency) and do not constitute profiling under GDPR Article 22.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email at least 30 days before they take effect. The updated policy will be posted on this page with a revised "Last Updated" date.

We encourage you to review this page periodically for the latest information on our privacy practices.

15. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

Moonlight Tech LLC
Email: [email protected]