PRIVACY POLICY

Moat8

Last updated: October 8, 2026

Applies to: the Moat8 Data Vault service at moat8.space — the web dashboard, the desktop and command-line applications, and the application registered in the Google Cloud console as “Moat8 Data Vault” that integrates with Google Workspace services. Other Moat8 products and websites are governed by their own privacy policies. The public Plays workflow catalog and AI guide at /workflows are covered by the separate Plays Privacy Notice.

This Privacy Policy ("Policy") describes how Moat8 LLC, a Wyoming limited liability company doing business as "Moat8" ("Moat8," "we," "us," or "our"), collects, uses, discloses, and safeguards information in connection with the Moat8 Data Vault product, the website located at moat8.space (the "Site", excluding the separate Plays catalog), the Moat8 web application (moat8.space/app), the Moat8 desktop application, the moat8 command-line tool, the Moat8 HTTP API, and any related applications and services that reference this Policy (collectively, the "Service").

Moat8 is a data vault for AI agents. The Service connects to the work tools a customer chooses — Google Workspace (Gmail, Google Drive including Google Docs and Google Sheets, and Google Calendar) and the other services and databases described in Section 9 — reads them read-only, and converts their content into clean, structured Markdown and CSV files, so that the customer's own AI agents have accurate, up-to-date business context.

The prepared output files are written to and stored on the customer's own computer or the customer's own server infrastructure. Moat8's servers hold encrypted credentials for the customer's connected accounts, account and operational metadata, an index of the files prepared for the customer's vault, prepared file content held briefly in a delivery buffer, for a connected Telegram bot, the messages it receives, and, where you use the in-app help assistant, your conversations with it for thirty days, each as described in Sections 2, 3 and 9. Support requests you send are kept in our help desk, which is operated for us by Atlassian (Section 3.10).

Please read this Policy carefully. By accessing or using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, you must not access or use the Service.

1. Scope of This Policy; Roles of the Parties

1.1 Three categories of individuals interact with, or are affected by, the Service, and this Policy addresses all three:

• "Customer" or "Controller" — the business or organization that signs up for the Service, connects its own work accounts, and uses the Service to generate context files for its AI agents.
• "Authorized Users" — individuals authorized by a Customer to access or administer the Service on the Customer's behalf (for example, employees, contractors, or administrators of the Customer).
• "Data Subjects" — individuals whose personal data may be contained within the Customer's own emails, files, documents, calendar entries, messages, meeting records, database records, or online store records that the Customer chooses to connect to the Service (for example, the Customer's own employees, clients, or counterparties, or the customers of the Customer's online store).

1.2 With respect to the underlying business content that a Customer connects to the Service (emails and their attachments, files, documents, spreadsheets, calendar entries, messages, issues, support tickets, CRM records such as contacts and deals, source code, meeting notes and transcripts, database records, and an online store's orders, customers and products), the Customer is the data controller or "business" under applicable data protection laws (including the GDPR and the CCPA/CPRA), and Moat8 acts solely as a data processor or "service provider" on the Customer's behalf. Moat8 processes such content only on the Customer's documented instructions, does not use it for Moat8's own independent purposes, does not sell or share it for cross-context behavioral advertising, and implements appropriate technical and organizational measures to protect it, as further described in this Policy.

1.3 With respect to the limited categories of personal data that Moat8 itself collects directly — namely Account Data, Connector Credentials, Technical Data, Usage Data, Communications Data, Help Assistant Conversations, and Support Requests (each as defined in Section 3) — Moat8 acts as an independent data controller for the purposes described in this Policy.

1.4 This Policy is directed at Customers and Authorized Users of the Service and at visitors to the Site. If you are a Data Subject whose information has been processed by a Customer using the Service and you have questions about that processing, please contact the relevant Customer directly: Moat8 does not control which accounts a Customer connects or what content those accounts contain.

2. How the Service Processes Data; Local-First Architecture

2.1 What happens when a source is connected. When a Customer connects a source (the supported sources are described in Section 9):

1. The Service uses the applicable Connector Credential to retrieve content from that source, read-only, under the Customer's own authorization (a Telegram bot instead delivers new messages to the Service, as described in Section 9).
2. The Service transforms that content into Markdown and/or CSV files on Moat8's servers.
3. Those files are delivered to, and stored on, the Customer's own computer, virtual machine, or server infrastructure ("Customer Infrastructure"). The Service does not create, change, or delete content in any connected source.

2.2 What Moat8 stores on its own servers. Moat8's servers store:

• (a) Connector Credentials — encrypted at rest (see Section 7), used solely to authenticate to the Customer's connected accounts on the Customer's behalf;
• (b) Account Data and billing records necessary to administer the Customer's subscription;
• (c) A vault file index — a record of each file prepared for the Customer's vault, including its path, the identifier and version of the item it was prepared from, content hash, size, and timestamps. This index does not contain file bodies. Paths and titles are derived from source content (for example, email subject lines, document and attachment names, or the names of an online store's customers) and therefore typically contain personal data;
• (d) Prepared file content in a short-lived delivery buffer, held in object storage until the Customer's devices have retrieved it and then purged as described in Section 2.3;
• (e) Connection records, device records, and technical logs necessary to operate, secure, monitor, and troubleshoot the Service — for each connected source, its type, the identifier and display name of the connected account (for a Google source, and for some other providers such as Microsoft and Box, its email address), the settings chosen, and its status; for each paired device, the details described in Section 3.5;
• (f) Messages received from a connected Telegram bot — stored encrypted until the Customer disconnects the bot or closes the account, because Telegram does not deliver them a second time (Section 9);
• (g) Help Assistant Conversations — the questions typed into the in-app help assistant, its answers, and the status summaries it looked up, kept for thirty (30) days (Section 3.9);
• (h) A help-desk link — a record connecting the account to its customer record in our help desk, so that the Service can show the account its own support requests (Section 3.10).

Apart from the messages described in (f), Moat8's servers do not durably store the content of the Customer's connected sources, such as the bodies of emails, documents, spreadsheets, calendar entries, messages, or database rows. That content is held only in the delivery buffer described in Section 2.3 and is then purged.

2.3 The delivery buffer. In order to deliver prepared files to a Customer's devices, the Service holds prepared file content in object storage operated within Moat8's own hosting infrastructure, on storage encrypted at rest by the hosting platform. An automated sweep runs every few minutes and purges content whose retention window has expired. The window is twenty-four (24) hours by default and may be configured per deployment between one (1) hour and thirty (30) days; it is measured from the last time the content was prepared or re-confirmed for delivery, so content that a device is still retrieving is not purged from under it. Content in the delivery buffer is used for no purpose other than delivering the files the Customer requested.

2.4 No advertising, no sale, no model training. Moat8 does not use content that passes through the Service for advertising, does not sell it, does not share it with third parties for their own independent purposes, and does not use it to develop, improve, or train generalized or shared machine-learning or artificial-intelligence models, whether our own or a third party's. Moat8 does not run language models over the content of connected sources; the only part of the Service that uses a language model is the in-app help assistant, which receives what you type into it and, when you ask about your own sources or devices, the status summary described in Section 3.9 — never the content of a connected source. See Section 5 for the specific commitments that apply to data received from Google APIs.

2.5 Customer responsibility for connected accounts. The Customer is solely responsible for ensuring that it has all necessary rights, consents, and legal bases (including under applicable data protection and employment laws) to connect its accounts to the Service and to permit the Service to process the content of those accounts on the Customer's behalf.

3. Information We Collect

3.1 Account Data. The email address of your account, any other contact details you give us, such as your name or company name, and, where a paid plan is purchased, billing information. Sign-in is performed through Google Sign-In (OpenID Connect) or, where offered, with a one-time sign-in link sent to your email address. Moat8 does not create or store passwords. For Google Sign-In it records the stable subject identifier and email address of the Google account used to sign in, and does not store the name Google sends; for a sign-in link it records the email address the link was sent to. Payment card details are collected and processed by our payment provider acting as merchant of record; Moat8 does not receive or store payment card numbers.

3.2 Connector Credentials. When a Customer connects a source, we collect and store, in encrypted form, the credential necessary to connect to that source on the Customer's behalf: the access and refresh tokens resulting from an OAuth or equivalent authorization, or the API key, access token, bot token, or database login details that the Customer provides, together with, where the provider needs it, the address or region of the Customer's account at that provider. For a database reached through an SSH bastion, the Service generates a key pair and stores its private key encrypted. Where a source is connected through an OAuth application that the Customer registers with the provider itself, we also store that application's client ID and client secret, encrypted with the connection's other credentials and deleted with them. For a Shopify store, the Customer creates that application in its own store; we store the store's address with its client ID and secret, and the access token Shopify issues for them, which expires after twenty-four (24) hours. Credentials are requested with the minimum permissions the relevant platform offers for the functions the Service performs, and are read-only wherever the platform supports read-only scopes; for a Customer's own OAuth application, the permissions are those the Customer grants following the Service's setup guide, which lists read-only permissions wherever the provider offers them.

3.3 Vault File Index. For each file prepared for a Customer's vault we retain the record described in Section 2.2(c). Paths and titles are derived from source content and therefore typically contain personal data.

3.4 Connection and Job Metadata. The type of source connected, the date and time of connection, the status and timing of each extraction or transformation job, file counts, and file sizes.

3.5 Devices and Device Tokens. Tokens issued by the Service to a Customer's own devices (the command-line tool and the desktop application) when they are paired with a vault are stored only as a SHA-256 hash; the token value itself is shown once at issuance and is never recoverable from our systems. For each paired device we also keep the name shown in the Service — the name the computer reports about itself, unless you give it another one — the sources it receives, its platform and application version, the IP address it last connected from and when, and, once it is turned off, when that happened. A turned-off device stays listed until the account is closed.

3.6 Technical Data and Usage Data. Technical Data means IP address, browser type and version, device identifiers, operating system, referring URLs, pages viewed, and timestamps, collected through server logs, cookies, and similar technologies described in Section 10; for each signed-in session, it includes the IP address and browser it was started from. Usage Data means pseudonymous records of how the Site and the Service are used — for example, which type of source is connected, whether a connection or synchronization succeeded or failed and with which error code, which source is clicked in the source catalogue, and which source you ask us to add — recorded by our servers and, only where you allow it, on the public pages of the Site (Section 10).

3.7 Communications Data. If you contact us, the content of your communication together with your contact details and any information you choose to provide. Support requests are described in Section 3.10.

3.8 Special categories. Moat8 does not seek, and the Service is not designed to process, special categories of personal data under the GDPR or sensitive personal information under the CCPA/CPRA. Where such data is present in a Customer's connected sources, it is processed as described in Section 2 and is stored on Customer Infrastructure, save for the limited server-side records enumerated in Section 2.2.

3.9 Help Assistant Conversations. Where the in-app help assistant is available, the questions you type into it and the answers it gives, kept as one conversation per account per day and linked to your account's internal identifier (not your name or email address). Text that looks like a password, token, key, or setup code is masked before the question is stored or sent to the language model. The assistant answers from Moat8's product documentation and, when your question is about your own sources or devices, from a status summary of your vault that it looks up at that moment, using a permission that is limited to your own vault and expires after ten minutes. The summary contains, for each connected source, its type (for example "Gmail", numbered when you have more than one of the same type), whether it is connected or needs reconnecting, how long ago it was last read successfully and last failed; and for each device, its name as shown in the Service (Section 3.5), which sources it receives, and when it last checked in or was turned off. The summary becomes part of the conversation. The assistant cannot see the content, file or folder names, or account names or addresses of your connected sources, cannot see Google user data, and cannot change anything in your vault. Please do not paste content from your sources, personal data about other people, or credentials into it. If you share a conversation with a support request, a copy of it goes with that request (Section 3.10). How conversations are processed, and for how long they are kept, is described in Sections 8, 11 and 12.

3.10 Support Requests. When you write to the Moat8 team from the Help panel of the web application, we collect the type of request, its subject and message, your later replies, the page of the Service you sent it from, your browser's user-agent string, your account's internal identifier, and your account's email address, so that we can answer you. If you open a request from the help assistant and leave the option to share the conversation selected, the request also carries that day's conversation with the assistant — your questions and its answers, with text that looks like a credential masked, but without the status summaries it looked up. Unlike questions to the assistant, the subject, message and replies of a request are sent as you write them; please do not include passwords, tokens, setup codes, or content from your sources. Requests are kept in our help desk, Jira Service Management, which Atlassian operates for us; it also emails you our answers, and you can reply to those emails. A message sent to our support email address becomes a request in the same help desk. The Service shows you your own requests and our replies.

4. How We Use Information

We use the information described in Section 3 to:

• create, administer, and authenticate Customer and Authorized User accounts;
• establish, maintain, and refresh authenticated connections to a Customer's connected sources;
• perform the core function of the Service — retrieving content from connected sources and transforming and delivering it as Markdown/CSV files to Customer Infrastructure;
• process payments, issue invoices, and manage subscriptions;
• provide customer support and respond to inquiries, including answering the questions you ask the in-app help assistant (Section 3.9) and the support requests you send (Section 3.10);
• monitor, secure, debug, and improve the performance, reliability, and security of the Service, including detecting and preventing fraud, abuse, and unauthorized access;
• understand, in pseudonymized form, how the Site and the Service are used, in order to fix problems and improve them (analytics, Section 10);
• send billing and payment notices, which are issued by our payment provider acting as merchant of record, and correspond with you about the Service in response to your enquiries;
• comply with applicable law, legal process, and enforceable governmental requests, and to establish, exercise, or defend legal claims.

We do not use Connector Credentials, the vault file index, or connection metadata for any purpose other than operating, securing, supporting, and improving the Service on the applicable Customer's behalf. Analytics may record the type of a connected source and the outcome and error code of a connection or synchronization, but never its content, names, addresses, paths, or data volumes.

5. Google User Data — Limited Use Disclosure

Moat8's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

5.1 Scopes we request. The Service requests only the following Google scopes, each for an implemented, user-facing feature:

We do not request write, modify, or delete scopes for any Google API, and no code path in the Service writes to a Google service.

5.2 Use limitation. Google user data is used only to provide and improve the user-facing features the user connected it for — preparing the vault files that the user and the user's own AI agents read. It is not used for any other purpose.

5.3 No advertising. We do not use Google user data for advertising.

5.4 No model training. We do not use Google user data to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models.

5.5 No transfer. We do not transfer Google user data to third parties, except: (a) to provide or improve user-facing features that are visible and prominent in the Service, and only with the user's consent; (b) for security purposes, such as investigating abuse; (c) to comply with applicable law; or (d) as part of a merger, acquisition, or sale of assets, after obtaining the user's explicit prior consent.

5.6 No human access. We do not allow humans to read Google user data, except: (a) with the affected user's affirmative agreement for specific messages or files; (b) where necessary for security purposes, such as investigating abuse or a security incident; (c) to comply with applicable law; or (d) where the data has been aggregated and anonymized and is used for internal operations.

5.7 Retention and deletion of Google user data. Google user data retrieved by the Service is written to the user's own infrastructure and is held on Moat8's servers only in the delivery buffer and file index described in Sections 2.2 and 2.3, apart from the email address of each connected Google account, which is kept in its connection record (Section 2.2(e)). A user may disconnect any Google source at any time from within the Service, may revoke Moat8's access at myaccount.google.com/permissions, and may request deletion of the data Moat8 holds as described in Section 12.

5.8 Security assessment. Because the Service requests restricted Google API scopes, it is subject to Google's Cloud Application Security Assessment (CASA) regime, which Moat8 maintains as a condition of continued access to those scopes.

5.9 AI agents and prompt injection. The files the Service prepares are derived from third-party content — emails, documents and calendar entries written by other people — and must be treated by any AI agent that reads them as untrusted input. The Service does not run language models over that content, does not send Google user data to any model, and does not act on instructions contained in that content; it only converts it into files on the Customer's own infrastructure. The in-app help assistant (Section 3.9) is the only part of the Service that uses a language model; it can look up a status summary of your sources and devices, and it cannot read that content. Customers who connect AI agents to their vault should apply their own prompt-injection safeguards to what those agents read.

5.10 No Google user data in analytics. We do not send Google user data to our analytics provider or to any other analytics service. This includes data aggregated, anonymized, or derived from it — such as the name and email address received through Google Sign-In, email subjects, file, folder, or document names, calendar entries, the addresses of connected Google accounts, and counts or sizes of items synchronized from Google sources. Analytics events about Google sources record only the type of the source and steps in its lifecycle — that it was connected or disconnected, finished its first read, needed reconnecting, or failed, with an error code — never anything read from it.

5.11 No Google user data in the help assistant. The in-app help assistant has no access to Google user data. The status summary it can look up (Section 3.9) names a connected Google account only by its source type (for example "Gmail"), never by the account's name or address, and contains no content, file names, or counts from it. We do not send Google user data to OpenRouter, to the provider of the assistant's language model, or to any other language model or AI service.

5.12 Support requests. When you send a support request (Section 3.10), the email address of your account — for an account that signs in with Google, the address received through Google Sign-In — is passed to our help-desk provider, Atlassian, so that our answer can reach you. This happens only when you send a request, the address is used for no other purpose, and no other Google user data is passed with it. Do not paste content from your Google sources into a request.

6. Legal Bases for Processing

6.1 EEA / UK / Switzerland. Our legal bases under the GDPR and equivalent UK and Swiss legislation are:

• Performance of a contract (Art. 6(1)(b) GDPR) — to create and administer accounts, process payments, and provide the Service pursuant to our terms of service with the Customer, including answering the questions you ask the in-app help assistant.
• Legitimate interests (Art. 6(1)(f) GDPR) — to secure, measure, and improve the Service, including the analytics recorded by our servers about the use of the Service (Section 10.4), prevent fraud, and communicate with Customers and Authorized Users about the Service, where those interests are not overridden by your data protection interests or fundamental rights and freedoms.
• Consent (Art. 6(1)(a) GDPR) — where we rely on consent, for example for certain marketing communications, non-essential cookies, and analytics on the public pages of the Site (Section 10), which you may withdraw at any time.
• Compliance with a legal obligation (Art. 6(1)(c) GDPR).

Where Moat8 processes Customer content as a processor on behalf of a Customer (Section 1.2), the Customer, as controller, is responsible for establishing an appropriate legal basis for that processing under Articles 6 and, if applicable, 9 of the GDPR.

6.2 United States. Moat8 processes personal data in the United States consistent with applicable federal and state privacy laws, including the CCPA/CPRA and comprehensive state privacy laws such as the Virginia CDPA, Colorado CPA, Connecticut CTDPA, and Utah UCPA, to the extent applicable, on the following bases: necessity for performance of a contract with the Customer; our legitimate business interests in operating, securing, and improving the Service, balanced against your privacy interests; compliance with applicable law, legal process, or an enforceable governmental request; and consent where required by applicable state law. U.S. state privacy laws generally do not require an enumerated "legal basis" in the same manner as the GDPR; instead they grant specific consumer rights (Section 14) and impose purpose- and use-limitation obligations, which Moat8 observes by processing personal data only for the purposes described in Section 4.

6.3 Canada. If you are located in Canada, our processing is governed by PIPEDA and, where applicable, substantially similar provincial legislation. We collect, use, and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances, relying on consent (express or implied, depending on sensitivity), necessity for the performance of a contract, or legal authorization, as applicable. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting us using the details in Section 17; we will explain any resulting implications before giving effect to your request.

7. Data Security

We implement technical and organizational measures designed to protect information from unauthorized access, disclosure, alteration, and destruction, including:

• Encryption at rest. Connector Credentials are encrypted with AES-256-GCM using a random initialization vector per encryption and a verified authentication tag.
• Encryption in transit. All traffic to the Service is served over TLS 1.2 or higher.
• Read-only by design. The Service requests read-only access wherever the source platform offers it, reads databases in read-only transactions, and contains no code path that creates, changes, or deletes content in a connected source. The only actions it takes at a provider beyond reading are those a connected Telegram bot needs in order to deliver messages, described in Section 9.
• Credential handling. Device tokens are stored only as SHA-256 hashes and are never recoverable after issuance; there are no account passwords — sign-in uses Google Sign-In or, where offered, a single-use, time-limited link sent by email; the Service refuses to start in production with default or weak secrets; secrets are not committed to our source repositories.
• Isolated file conversion. Documents and spreadsheets (PDF, Word, PowerPoint, Excel and OpenDocument files) are converted into Markdown and CSV on our own servers, in a separate process that has no network access, cannot write to disk, and runs under strict limits on time and memory; their content does not leave our infrastructure.
• Tenant isolation. Every stored object is scoped to a single account and its vault, and every device token is bound to that vault and to the specific connections it was granted.
• Access control and logging. Access to production systems holding Connector Credentials is restricted to personnel who require it to operate the Service. Security-relevant events are recorded in the Service's operational logs, from which secrets, credentials and authorization codes are redacted; those logs are retained as described in Section 12.
• Web application hardening. The session cookie is marked HttpOnly; all of the Service's cookies are marked Secure and SameSite and are scoped to the Service's own origin; state-changing requests are accepted only from that origin and must carry a session-bound anti-forgery token.
• Security assessment. The Service is subject to the CASA assessment regime described in Section 5.8, which is based on the OWASP Application Security Verification Standard.
• Security contact. Vulnerabilities and suspected security incidents can be reported to security@moat8.ai; machine-readable details are published at /.well-known/security.txt.

No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security. Because the prepared output files reside on Customer Infrastructure, Customers are responsible for securing their own systems, including the storage of the files the Service delivers to them.

If we become aware of a security incident affecting Account Data, Connector Credentials, or other data we control, we will notify affected Customers and, where required, the relevant supervisory authorities and Data Subjects, without undue delay and in accordance with applicable law, including Articles 33 and 34 of the GDPR where applicable.

8. How We Share Information

We do not sell personal data, and we do not share Connector Credentials or the content accessible through them with third parties for their own independent marketing or advertising purposes. We share information only as follows:

• Sub-processors and service providers, each engaged under contractual confidentiality and data protection obligations consistent with this Policy:

An up-to-date list is maintained at https://moat8.space/subprocessors and is also available on request to legal@moat8.ai.

• Third-party sources you connect — by design, the Service exchanges data with the platforms a Customer chooses to connect, strictly as necessary to perform the functions the Customer has authorized.
• Downloads and updates of our applications — the desktop and command-line applications are downloaded from GitHub (GitHub, Inc.) and check GitHub for updates and for the minimum supported version, so GitHub receives the IP address and technical details of the browser or device that connects to it, under GitHub's own privacy statement. No account data or content is sent to GitHub.
• Corporate transactions — in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to customary confidentiality protections and continued application of this Policy or a substantially similar policy.
• Legal requirements — where required to comply with applicable law, regulation, legal process, or an enforceable governmental request, or to protect the rights, property, or safety of Moat8, our Customers, or others.
• With your direction or consent — in any other circumstance where you have directed or consented to the disclosure.

9. Third-Party Sources and Services

The Service interoperates with the sources a Customer chooses to connect ("Connected Sources"). The sources it supports fall into three groups:

• Google Workspace — Gmail, Google Drive (including Google Docs and Google Sheets), and Google Calendar, connected through Google's consent screen with the read-only scopes listed in Section 5.1;
• other work services — such as Slack, Jira, Notion, Telegram, tl;dv, Fathom, Fireflies, and Shopify, connected through the provider's authorization flow, with an API key or bot token that the Customer creates, or, for Shopify, with an app that the Customer creates in its own store;
• databases and data tools — such as PostgreSQL, connected with a database login that the Customer provides (we recommend one that can only read) and read in read-only transactions, and Metabase, connected with an API key that the Customer creates; for Metabase, the Service reads saved questions and dashboards and runs each saved question to export its current result, which queries the databases connected to Metabase but changes nothing in them.

The sources available to a Customer are those shown in the Service when adding a source; some may be unavailable on a given deployment. Section 5 applies to data received from Google APIs; data from other Connected Sources is processed as described in Sections 2 to 4 and 12.

Experimental sources. Some sources are marked Experimental in the Service — for example Microsoft Teams, Outlook Calendar, Outlook Mail, OneDrive, SharePoint, Word, PowerPoint, OneNote, Box, Asana, ClickUp, HubSpot, Salesforce, Zoho CRM, Pipedrive, Intercom, Zendesk, Freshdesk, ServiceNow, Airtable, monday.com, Zoom, Todoist, Stripe, Attio, Apollo, Cal.com, Coda, Slab, Slite, Document360, GitHub, GitLab, and Bitbucket. They have not yet been verified with live customer data. They are read by open-source connector code that runs on Moat8's own servers under the same controls as every other source: no third-party service other than the source's own provider receives their content or credentials, and they are processed as described in Sections 2 to 4 and 12. Several of them are connected through an OAuth application that the Customer registers with the provider (Section 3.2), others with an access token or API key that the Customer creates. Some providers, such as Salesforce and Pipedrive, offer no read-only access; the Service still only reads from them. Moat8 may switch an Experimental source off at any time; its connections then stop reading, and the files already delivered remain on the Customer's devices.

Telegram. A Telegram bot cannot read a group's history, so Telegram delivers each new message in the groups that the Customer's bot is in to the Service instead. Because those messages cannot be retrieved again, the Service keeps them encrypted in its database until the Customer disconnects the bot or closes the account. To receive them, the Service sets the bot's delivery address to the Service (and removes it on disconnect), replies to the pairing messages the Customer sends the bot privately, and makes the bot leave a group when the Customer's paired Telegram account is not a member of it, or when the Customer removes the bot from a group in the Service. Messages that arrive from a group before the Service has confirmed that the paired account is a member of it are held encrypted for up to three (3) days and deleted unread if no confirmation comes. Messages already kept from a group that the bot later leaves stay until the Customer disconnects the bot. It stores nothing from private chats and never posts to groups.

Shopify. For a Shopify store, the Service reads the store's orders, customers and products — including the names, email addresses, phone numbers and addresses of the store's customers, as far as Shopify makes them available to the Customer's app — through an app that the Customer creates in its own store, with the read-only access the Service asks for, and whose credentials the Customer gives to the Service. In doing so Moat8 acts as the Customer's service provider (Terms of Service, Section 3.2). Moat8 uses the store's data only to prepare the Customer's vault files, never contacts the store's customers, and does not sell the data or make it available to search engines or to anyone else. Payment card details are not read. Disconnecting the store deletes its credentials and file index as described in Section 12; the app itself stays in the store until the Customer deletes it there.

Each Connected Source is governed by its own privacy policy and terms, and Moat8 is not responsible for their privacy or security practices. We encourage Customers to review the privacy policy of any Connected Source before authorizing a connection.

10. Cookies, Similar Technologies and Analytics

10.1 Strictly necessary cookies. The web application uses cookies that are strictly necessary to provide the Service: a session cookie that keeps you signed in (__Host-session, up to fourteen (14) days), an anti-forgery cookie that protects your requests (__Host-session_csrf, for as long as the session lasts), and short-lived cookies that protect the sign-in, source-connection, and identity-confirmation flows (__Host-session_signin and __Host-session_connect, ten (10) minutes; __Host-session_stepup, fifteen (15) minutes). They are scoped to the Service's own origin (Section 7) and cannot be switched off without making the Service unusable. The web application also keeps short-lived state needed to finish an action, such as returning you to it after you sign in or confirm your identity, in your browser's session storage, and clears it when you sign out.

10.2 Our analytics provider. We use PostHog (PostHog, Inc.) as our processor for analytics, with data stored in the European Union (Frankfurt, Germany). Our PostHog projects are set to discard IP addresses, and no location is recorded: events sent by our servers carry none, and analytics on the public website is set not to look one up. Events about your use of the Service are linked to your account's internal identifier — a random identifier we assign to the account — never to your name or email address. This identifier is pseudonymous rather than anonymous: we can connect it to your account, and PostHog keeps the events linked to it together.

10.3 Public website. On the public pages of the Site — the pages outside the web application — analytics runs in your browser only after you accept it in the consent banner. Nothing is recorded before you choose, and nothing is recorded if you decline. Your choice is kept for 180 days in a cookie named m8_consent, which is set whichever you choose; you can change it at any time with "Cookie settings" at the foot of every page. If you accept, the analytics script, served from our own domain, sets an analytics cookie that lasts up to twelve (12) months and keeps a few entries in your browser's session storage for that tab, and we record the pages you view, your clicks and scrolling, heatmaps of where visitors click, recordings of your sessions on those public pages with everything typed into fields masked, the website or campaign that referred you, and your browser and device type. These records pass through our own server, which removes your IP address and cookies before sending them on, and no location is recorded. Visits to the public website are not linked to your account. If you withdraw consent, the analytics cookie and the session-storage entries are deleted and recording stops.

10.4 The Service. Analytics in the Service is recorded by our servers. The web, desktop, and command-line applications contain no third-party analytics code and write nothing for analytics to your browser or device; the web application tells our servers about a few of your actions, such as which source you click in the source catalogue, and our servers record them. The events record, for example, that an account was created or signed in and with which sign-in method; that a source of a given type was connected, disconnected, or read for the first time, needed reconnecting, or failed with a given error code; that a setup code was created and with which kind of access; that a device was paired, first checked in, and received its first files, with its platform and application version; which source you click in the source catalogue; and, when you ask us to add a source that is missing, the name you type and, if you add one, your note on what you would use it for. Please do not include personal data in a source request. These events are based on our legitimate interest in operating and improving the Service (Section 6), and you can object at any time (Section 10.6). Inside the web application we do not use session recording, heatmaps, or automatic click capture.

10.5 What analytics never contains. Analytics never contains the content of your connected sources; email subjects, file, folder, or document names, paths, or calendar entries; the names or addresses of your connected accounts; device names; Google user data, including data aggregated, anonymized, or derived from it (Section 5.10); counts or sizes of items from any connected source; what you type into the help assistant or a support request; your name or email address; or passwords, tokens, setup codes, or other credentials. We do not use advertising cookies or any other advertising technology.

10.6 Your choices and retention. You can decline or withdraw consent to analytics on the public website at any time with "Cookie settings" at the foot of every page. You can object to the analytics recorded about your use of the Service at any time by writing to legal@moat8.ai or by sending an "Account and data" request from the Help panel. We then stop recording events for your account and, on request, delete those already recorded. Analytics data is kept for up to twelve (12) months and is deleted within thirty (30) days after your account is closed, or on request (Section 12). You can also block or delete cookies in your browser settings; blocking strictly necessary cookies will stop the Service from working.

11. International Data Transfers

Moat8 and its sub-processors process Account Data, Connector Credentials, the vault file index, delivery-buffer content, messages received from a connected Telegram bot, Help Assistant Conversations, and Technical Data in the United States; the questions you type into the help assistant, and the status summary it looks up (Section 3.9), are also processed in the United States by OpenRouter and by the provider of its language model. Support Requests are processed by Atlassian in the United States and other locations of its infrastructure. Operational metrics and service logs are processed on our monitoring server, hosted by DigitalOcean in the European Union (Amsterdam, the Netherlands). Usage Data is stored by PostHog in the European Union (Frankfurt, Germany); PostHog, Inc. is a U.S. company, and any access from the United States is covered by the EU-U.S. Data Privacy Framework (with its UK and Swiss extensions) and the Standard Contractual Clauses. Where we transfer personal data originating from the EEA, the United Kingdom, Switzerland, or Canada to a country that has not been recognized as providing an adequate level of protection, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum, or another valid transfer mechanism recognized under applicable law.

12. Data Retention and Deletion

We retain the categories of information described in Section 3 only for as long as reasonably necessary:

How to delete your data. A Customer or Authorized User may disconnect any source at any time from within the Service. Disconnecting a source deletes that source's Connector Credentials, its vault file index entries and, for a Telegram bot, the messages kept from its groups from Moat8's servers as part of the same operation, and its buffered content within minutes; the files it produced are removed from the Customer's devices on their next synchronization. For a Shopify store, delete the app you created in the store as well: disconnecting does not remove it from Shopify. To close the account and delete the remaining data Moat8 holds (the account record, device registrations, connection history, the analytics linked to the account, and your support requests; help assistant conversations are deleted automatically as described above), write to legal@moat8.ai from the email address of the account, or send an "Account and data" request from the Help panel; we complete the deletion within thirty (30) days and confirm by email. Files already delivered to Customer Infrastructure remain on the Customer's own systems and are outside Moat8's control.

Data deleted from our systems may remain for a limited period in backups of our databases, which are kept only to restore the Service after a failure, until those backups are replaced. We may retain information for longer where required by applicable law, to resolve disputes, or to enforce our agreements.

13. Your Data Protection Rights

If you are located in the EEA, the United Kingdom, or Switzerland and are the data subject of personal data controlled by Moat8 (Section 1.3), you have the right, subject to applicable law and certain exceptions, to: access the personal data we hold about you and obtain a copy; request rectification of inaccurate or incomplete data; request erasure; request restriction of processing; object to processing based on legitimate interests or for direct marketing; request portability in a structured, commonly used, machine-readable format; withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and lodge a complaint with your local supervisory authority.

You can object to the analytics recorded about your use of the Service, and withdraw consent to analytics on the public website, at any time as described in Section 10.6.

To exercise these rights with respect to personal data controlled by Moat8, contact us using the details in Section 17. If your request relates to content held within a Customer's Connected Sources or on Customer Infrastructure, we may direct you to the relevant Customer, who acts as controller of that content.

14. Additional Disclosures for California Residents (CCPA/CPRA)

If you are a California resident, the CCPA as amended by the CPRA grants you the right to: know what personal information we collect, use, disclose, and sell; request deletion; request correction of inaccurate personal information; opt out of the sale or sharing of personal information; limit the use of sensitive personal information; and not be discriminated against for exercising these rights.

Moat8 does not sell personal information as that term is defined under the CCPA/CPRA, and does not share personal information for cross-context behavioral advertising. In the twelve (12) months preceding the effective date of this Policy, the categories of personal information we collected are those described in Section 3, collected from the sources described in this Policy, for the business purposes described in Section 4, and disclosed to the categories of third parties described in Section 8.

California residents may exercise their rights by contacting us using the details in Section 17. We will verify your request using information associated with your account before responding, and you may designate an authorized agent to make a request on your behalf in accordance with applicable law.

15. Children's Privacy

The Service is intended for use by businesses and their Authorized Users and is not directed at individuals under the age of 18 (or the applicable age of majority in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will take reasonable steps to delete it.

16. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the Service, or applicable law. If we make material changes, we will notify Customers by email or through a notice on the Site before the change takes effect, and we will update the "Last updated" date at the top of this Policy. Your continued use of the Service after the effective date of an update constitutes acceptance of the updated Policy.

17. Contact Us

If you have questions, concerns, or requests regarding this Policy or our data practices, or if you wish to exercise any of the rights described above, please contact:

Moat8 LLC Attn: Privacy / Data Protection 30 N. Gould St, Ste R, Sheridan, WY 82801, USA legal@moat8.ai · Security: security@moat8.ai

Moat8 has not appointed, and does not currently intend to appoint, a representative in the European Economic Area or the United Kingdom under Article 27 GDPR / UK GDPR, and has not appointed a Data Protection Officer under Article 37 GDPR / UK GDPR, as Moat8 does not meet the applicable thresholds for such appointments. If our processing activities change such that an appointment becomes required by law, we will update this Policy accordingly and provide the relevant contact details here.