Moil Privacy Policy
Last updated: September 1, 2026
1. Introduction
This Privacy Policy explains how Moil Enterprise Inc. ("Moil", "we", "us"), with its principal place of business at Buda, TX, USA, collects, uses, shares, and protects personal information when you use our websites, applications, and services at www.moilapp.com and its subdomains (the "Services"). By using the Services you agree to this Policy. It should be read together with our Terms and Conditions.
2. Information We Collect
• Account and identity: name, email, password, and authentication data (including Google sign-in). • Business and brand data: business name, industry, plans, brand colors, fonts, logos, products, offers, and anything you tell the coach about your business. If you give us your website address, we read the public page to extract your brand. • Content and prompts: messages, files, and instructions you submit to the AI coach and the content tools, including the documents you upload (PDF, Word, CSV, and Excel — commonly sales exports from Stripe, Shopify, Square or QuickBooks). • Photographs and images, which may include images of people you have photographed. • Voice and audio: when you use a voice feature, your speech is streamed to a transcription provider; when the coach speaks, the text is sent to a speech provider. Interview-practice answers are recorded as audio you upload. • Financial and transaction data: if you connect Stripe or Square, we read your own payments and invoices; uploaded sales exports contain the same kind of data. • Connected accounts: when you link Meta (Facebook/Instagram), Google (send-only Gmail), Stripe, or Square, we receive and store the access credentials and account details the feature needs. • Applicant and candidate data: job seekers provide profile, employment history, and résumé data; employers may upload information about applicants, which we process on the employer's behalf. • Location and time zone: addresses you enter, places you select from autocomplete, and the time zone your browser reports (so your posts publish on your own day). • Inferred and derived data: the coach keeps a working memory of facts about your business, and computes metrics and milestones from what you have told it. • Usage and device data: log data, IP address, device and browser type, pages viewed, and interactions, collected via cookies and similar technologies. • Prospective-customer data: if you use the free preview on our marketing site before creating an account, we store the business website you entered and, if you choose to give it, your email address.
3. Notice at Collection
This table summarises what we collect, why, who else sees it, and how long we keep it. It is the Notice at Collection required by California law and is a useful summary wherever you live.
| Category | Where it comes from | Why we process it | Who else sees it | How long we keep it |
|---|---|---|---|---|
| Account and identity | You, or Google sign-in | Create and secure your account; support | Hosting, database and email providers | Life of the account, then 30 days |
| Business profile and brand | You; your website, when you ask us to read it | Generate plans, content, and brand assets | AI providers; hosting | Life of the account |
| Coach conversations and AI memory | You (what you type or say to the coach) | Answer you; remember your business between sessions | AI providers; hosting | Life of the account; individual memories deletable in-app |
| Uploaded documents (PDF, DOCX, CSV, XLSX) | You — often exports from Stripe, Shopify, Square or QuickBooks | Answer questions about your own numbers | AI providers; hosting | Life of the account |
| Photos and images, which may show people | You (photo library, logo uploads, chat attachments) | Produce your posts, flyers, and video | AI image/video providers; image hosting | Life of the account, unless you delete the photo |
| Voice and audio | You, when you use voice features or record an interview answer | Transcribe what you said; speak answers back | Speech-to-text and text-to-speech providers | Transcript kept with the conversation; recordings — see §12 |
| Financial and transaction data (sensitive) | Stripe Connect / Square, when you connect them; files you upload | Show what you were paid and what is owed; month-end reporting | Hosting only — never sent to advertising networks | Life of the connection; deleted on disconnect |
| Connected-account credentials | Meta, Google, Stripe, Square, at your direction | Publish, send, or read only what the feature needs | Not shared; encrypted at rest | Deleted immediately when you disconnect |
| Applicant and candidate data | Job seekers, and employers who upload it | Run the job marketplace on the employer's instructions | Hosting; the employer who posted the role | As instructed by the employer; deleted on request |
| Location and time zone | You (address fields, Places autocomplete); your browser | Local market research; schedule posts in your own day | Maps provider; hosting | Life of the account |
| Usage, device and log data | Your browser and our servers | Security, debugging, service quality | Analytics and monitoring providers | Server logs 30–90 days [to be confirmed by engineering] |
| Website-preview data (before signup) | The website address a visitor types on our marketing site | Generate the free preview and, if you leave an email, follow up | AI providers; hosting | 12 months if the preview is never claimed [to be confirmed] |
We do not use any of these categories for cross-context behavioral advertising inside the logged-in Moil application. Marketing and analytics tools run on our public website only, and only after you accept them — see section 8.
4. Sensitive Information
Some features involve information that state privacy laws treat as sensitive: • Financial account and transaction data, when you connect Stripe or Square or upload a sales export. • Audio of your voice, when you use voice features or record an interview answer. • Precise location, if you choose to share it for local market research. We process this information only to provide the feature you turned on. We ask for your permission at the moment you connect the account or enable the feature. We do not use it for advertising, we do not use voice audio to identify you, and we do not sell or share it. You can withdraw permission at any time by disconnecting the account or turning the feature off, which stops the processing and deletes the stored credentials.
5. How We Use Information
We use personal information to: provide, maintain, and improve the Services; power AI features (coaching, business plans, content, images, video, voice, and job matching); personalize your experience; process payments and manage subscriptions; communicate with you (service messages always, and marketing messages where you have consented or where the law allows); keep the Services secure and prevent fraud or abuse; and comply with legal obligations.
6. AI Processing of Your Data
To generate output, your prompts and the relevant parts of your business data are sent to the AI providers listed on our Subprocessors page. They act as our service providers and are bound by our agreements with them. Training: we do not ask any provider to train on your content, and we do not send your content to any provider for that purpose. Each provider's own API terms govern what they may do with data sent to their API; the Subprocessors page records each provider's position. Two providers deserve a specific mention because of where they are based: DeepSeek (used for the deeper reasoning behind some strategic coaching answers) and Alibaba Cloud Model Studio / Qwen (used for text and image generation). If you would rather your business data were not processed by a particular provider, contact us before using the affected feature. Learning across customers: we use aggregated, de-identified patterns — never your name, your business name, or your figures — to improve the advice the coach gives other businesses. Nothing that identifies you or your business leaves your account. AI output may be inaccurate. See our Terms and Conditions for the disclaimers that apply.
7. GOOGLE USER DATA
If you connect a Google account, we access only the data needed to provide the features you request, and we ask for the narrowest scopes required. Moil requests send-only Gmail access (gmail.send) together with basic identity (openid, email, profile). Moil cannot read, search, modify or delete any message in your Gmail account. We use your Google account address only to show you which account is connected and to set the correct sender address on email you approve. Moil's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: • We do not use Google user data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models, and we do not transfer Google user data to any third-party AI or ML service. • We never send the contents of your Gmail account, your recipients' addresses, or your Google account identifiers to any AI provider. • We do not transfer Google user data to third parties except as necessary to provide the services, comply with applicable law, or as part of a merger, acquisition or sale of assets with your consent. • We do not use Google user data for advertising. • We do not allow humans to read Google user data unless we have your consent, it is necessary for security or to comply with applicable law, or the data is aggregated and de-identified. You can revoke Moil's access at any time in your Google Account permissions, and you can ask us to delete Google user data we hold by emailing cs@moilapp.com.
8. Meta (Facebook and Instagram)
If you connect Meta so that Moil can publish for you, we receive and store: the list of Facebook Pages you administer, an access token for the Page you choose, the linked Instagram business account identifier, your Meta account display name, the identifiers of posts we publish, and the engagement metrics for those posts. We use this only to publish what you approve and to report back how those posts performed. We do not use it for advertising and we do not sell or share it. You can disconnect Meta at any time in Settings, which revokes Moil's authorization at Meta and deletes the stored tokens. You can also remove Moil from Facebook's "Apps and Websites" settings; Moil operates the data-deletion callback and status page that Meta requires for that flow.
9. Payment Connections (Stripe and Square)
Stripe is our payment processor for your Moil subscription. Separately, you can connect your own Stripe or Square account so Moil can show you what you have been paid and what is outstanding. These connections are read-only in behaviour. Moil reads charges, invoices and merchant profile data; Moil never initiates a charge, a refund, or a transfer of your money. Square grants Moil read-only scopes. Stripe does not offer a read-only scope to platform applications like ours, so the credential Stripe issues is broader than what we use it for — we constrain it in our code, and the connected-account data we read is only what is described here. Disconnecting in Settings deletes the stored credential.
10. How We Share Information
We share personal information with: service providers and subprocessors who process data on our behalf (hosting, storage, payments, AI, analytics, email — see our Subprocessors page); other users where the Services are designed to do so (an employer and a candidate in the job marketplace, or a social platform when you direct us to publish); authorities or others when required by law or to protect rights and safety; and a successor entity in a merger, acquisition, or sale of assets. We do not sell personal information for money. On our public marketing website we use analytics and marketing tools that some state laws treat as a "sale" or "share" — see section 12.
11. Cookies and Tracking
On our public marketing website we use strictly necessary cookies, plus Google Analytics, Microsoft Clarity, the Meta Pixel, and the Apollo visitor tool. Those four load only after you choose "Accept all" in our cookie banner, and never when your browser sends a Global Privacy Control signal. Inside the logged-in Moil application we use product analytics and session tooling (Segment, Hotjar) to understand how features are used and to debug problems. See our Cookie Policy for the detail, and Your Privacy Choices to change your mind at any time.
12. Data Retention
We keep personal information for as long as your account is active and as needed to provide the Services, then only as required to comply with legal obligations, resolve disputes, and enforce agreements. Section 3 gives the period for each category. A few specifics worth stating plainly: • Documents you generate and download are removed from our export storage shortly after the download link expires (about 17 minutes). • Connected-account credentials are deleted immediately when you disconnect. • Coach conversations and the AI memory built from them are kept for the life of the account; you can delete individual memories from the memory panel at any time. • Voice: we keep the transcript as part of your conversation. Retention of raw interview-practice recordings is being finalised [to be confirmed by engineering]; ask us and we will delete a specific recording.
13. Data Security
We use administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit, encryption of connected-account credentials at rest, and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a security incident affects your personal information, we will notify you and any regulator we are required to notify without unreasonable delay and within the time the law requires. For Texas residents that is no later than 60 days after we determine that a breach occurred.
14. Your Rights and Choices
Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information, to object to or restrict certain processing, and to withdraw consent. You will not be treated differently for exercising any of these rights. How to reach us: email cs@moilapp.com, or use the form on our Your Privacy Choices page. We verify that a request really comes from you (usually by replying from the address on the account) and respond within the time the law requires — 45 days in California, extendable once where the law allows. An authorized agent may act for you with written permission.
15. Deleting Your Account and Data
Email cs@moilapp.com with the subject "Delete my account" from the address on your account. Self-service deletion and export are being built into Settings; until they ship, this is the way to make the request, and we treat it exactly the same. Once we have confirmed it is you, we delete your account, business profile, conversations, uploaded files, generated content, connected-account credentials, and voice-session records within 45 days, with three exceptions we want you to know about: • Records we must keep for tax, accounting, fraud-prevention, or legal-hold reasons. • Content you have already published to a third-party platform, which is governed by that platform — you delete it there. • A minimal deletion marker: when you delete a single remembered fact, we keep a one-way marker of it so the coach does not learn the same fact back from your existing conversations. The marker cannot be read back as the original text and exists only to make your deletion stick. Disconnecting Facebook, Instagram, Google, Stripe, or Square deletes the related credentials straight away and stops us reading that account.
16. U.S. State Privacy Rights (including California)
If you live in California, Colorado, Connecticut, Texas, Virginia, or another state with a comprehensive privacy law, you have the right to know what personal information we collect, to access, correct, and delete it, to obtain a portable copy, and to opt out of the "sale" of personal information, of "sharing" or processing for targeted (cross-context behavioral) advertising, and of certain profiling. We use third-party marketing and analytics tools on our public marketing website — currently Google Analytics, Microsoft Clarity, the Meta Pixel, and Apollo — that these laws may treat as a "sale" or a "share". You can opt out at any time by choosing "Reject non-essential" in our cookie banner, by using the Your Privacy Choices page, by emailing us, or by enabling the Global Privacy Control signal in your browser, which we honour as a valid opt-out. We do not run these tools inside the logged-in Moil application, and we do not knowingly sell or share the personal information of anyone under 16.
17. Where We Operate and International Transfers
The Services are offered to users in the United States, and we process and store information in the U.S. and in other countries where our providers operate. If you access the Services from the European Economic Area or the United Kingdom: Moil Enterprise Inc. is the controller of your personal information, you may exercise the rights described above by writing to cs@moilapp.com, you may lodge a complaint with your local supervisory authority, and where required we use appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers.
18. Children's Privacy
The employer side of the Services is for adults: you must be 18 or older to create a business account. Job seekers must be at least 16, and where the law requires parental consent for someone under 18 it is the job seeker's and their guardian's responsibility to have it. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.
19. Changes to This Policy
We may update this Policy from time to time. We will update the "Last updated" date and, for material changes, give you at least 30 days' notice by email before they take effect. Your continued use of the Services after that constitutes acceptance.
20. Contact Us
For privacy questions or requests, contact Moil Enterprise Inc. at cs@moilapp.com or Buda, TX, USA.
Related: Cookie Policy, Subprocessors, Your Privacy Choices, Data Processing Addendum, and Terms and Conditions.