Privacy Policy

1. Who we are

Moatlight (“we” or “us”) is the controller of the personal data described here. Contact us at ceo@moatlight.com. This policy applies to our website, app and shared report pages. It sits alongside our Terms of Service.

2. What we collect

Account data. Name, email address, and either a password (stored only as a hash) or your Google account ID, name, email and profile image if you sign in with Google. Whether your email is verified.

Session and security data. Session tokens, the IP address and browser user agent of each session, and request counters we use to limit abuse (rate limiting).

Website and report data. The domain you submit; the public pages we read from it; the business profile we infer (name, description, offers, category, country, language, audiences, competitors, claims) and any edits you make; the buyer questions; the answers AI engines returned, the brands and URLs in them, and the scores and suggested moves we derive. Your answers about what counts as a result for you, and whether you track it.

Product usage. Simple records of how you move through a report (for example opened, reached the end, which moves you ticked as done), and the optional feedback you submit. The feedback is stored in our own database. We also send product events (for example signing up, submitting a website, rerunning or sharing a report, ticking a move as done, or reaching a plan limit) and error reports to PostHog, linked to your account ID, name and email when you are signed in. Some events are sent from our servers, others from your browser. PostHog also records page views and clicks automatically (which button or link you pressed, its visible label and the page). Event data contains counts, settings and button labels, not the text you type into forms. We never send the secret part of a shared-report link to PostHog or Sentry. PostHog and Sentry may also record a session replay, a playback of how you used the pages, so we can find bugs and confusing screens. Form inputs and passwords are masked in PostHog recordings, and Sentry masks all text and media. Sentry records about one in ten visits, and every visit where an error occurs, and also collects technical error and performance data.

Communications. Emails you send us, and the transactional emails we send you.

We do not collect payment data today. If we add paid plans, payments will be handled by a payment provider and we will update this policy and the list below.

3. Cookies and tracking

We use a session cookie to keep you signed in. We also use PostHog for product analytics and session recordings, which stores a random identifier in your browser (cookie or local storage) to recognise repeat visits. Sentry keeps a short-lived session identifier in your browser’s session storage for replays. We also keep the channel you arrived from (for example search, a link, or an AI assistant) in your browser’s session storage for the visit, and attach it to our product events. We use no advertising cookies. We do not currently show a cookie banner. You can block or delete these cookies in your browser, and Moatlight works without them; you can also email us to object to analytics.

4. How we use data, and our legal bases

• Provide the service (create your account, run and show reports, send emails you need). Basis: contract.
• Keep it secure and prevent abuse (sessions, rate limits, fraud). Basis: legitimate interests.
• Improve the product (measure how the product is used, understand whether reports are useful, find and fix errors). Basis: legitimate interests.
• Research on what predicts AI recommendations, using aggregated, non-identifying results. Basis: legitimate interests. You can opt out in Settings.
• Respond to you and meet legal duties. Basis: contract, legal obligation.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

5. Public websites and third-party content

To build a report we read public web pages and receive AI-generated answers that can name companies and, rarely, people. This is business information from public sources and is used only to produce your report. Our crawler, MoatlightBot/1.0, respects robots.txt. If you run a site we read and want us to stop, or want something removed, write to ceo@moatlight.com.

6. Shared reports

If you turn on sharing, anyone with the secret link can view that report, which includes the domain, profile information, questions, answers and findings. Shared pages are not indexed by search engines and do not pass a referrer to the sites they link to. Turning sharing off kills the link for good.

7. Who receives data

We use these service providers to run Moatlight. They process data on our instructions under their own terms and security commitments.

We may also disclose data to professional advisers, to a buyer in a merger or sale of the business, or where the law requires it. We will update this list when providers change and, for material additions, tell you.

8. International transfers

We and our providers operate in the United States and other countries. If you are in the EEA, the UK or Switzerland, we rely on safeguards such as Standard Contractual Clauses where data is transferred to countries without an adequacy decision. A data processing agreement is available on request to ceo@moatlight.com.

9. How long we keep data

• Account, report and feedback data: while your account is open.
• Sessions: expire after 7 days (refreshed while you are active) and stop working when revoked.
• Error, performance and replay data in Sentry: kept under Sentry’s retention settings for our plan.
• Analytics and error data in PostHog: kept under PostHog’s retention settings for our plan, and removed or anonymised when you ask us to delete your account.
• Rate-limit counters: short-lived and overwritten.
• After you ask us to delete your account we remove your data from our systems, except what we must keep by law or for security. Provider backups roll off on their normal cycle.

10. Your choices and rights

You can edit your profile and report details in the app, turn report sharing off, and opt out of research use in Settings. Depending on where you live (for example the EEA, UK, or California) you may also have the right to access, correct, delete, export or restrict use of your data, to object to processing, to withdraw consent, and not to be discriminated against for using these rights. Email ceo@moatlight.com and we will respond within 30 days. You may also complain to your local data protection authority.

11. Security

Passwords are hashed, connections use TLS, database tables use row-level security, our crawler only reaches public internet addresses, and we limit sign-in and report attempts. No system is perfectly secure. If a breach affects you we will notify you as the law requires.

12. Children

Moatlight is for businesses and is not directed to anyone under 18. We do not knowingly collect data from children.

13. Changes

We will post updates here and change the date above. For material changes we will also email you or tell you in the product before they apply.

14. Contact

Privacy questions and requests: ceo@moatlight.com.