Privacy Policy

• We collect what we need to run the Services: account info, billing details (your full card number goes to our payment processor, never to us), usage and activity logs, and the content that passes through the API because of your use of it.
• We do not sell personal data, and we do not use the content that flows through our APIs to advertise to anyone.
• For WhatsApp message content and contacts, Mossmoon acts as a processor on behalf of the customer using the API; the customer is the controller.
• You can ask us to access, export, correct, or delete your data. See Your rights.
• Questions: [email protected].

This Policy covers three groups of people whose data we may process:

• Account holders: the developers, agencies, and businesses with a Mossmoon account.
• End-Customers of WhatsApp Lines: individuals whose WhatsApp account is linked to a line that our customer provisioned (for example, an agency's client). Their phone number, profile name, and message content flow through the line on the customer's instructions.
• Message recipients and contacts: people who exchange messages with an End-Customer through a line, or who appear in the End-Customer's WhatsApp contacts.
• Website visitors: anyone who visits mossmoon.app, whether or not they have an account.

Whether Mossmoon is the “data controller” or “data processor” (terms used in GDPR and similar laws) depends on the data:

When we act as a processor, we only process data on documented instructions from you (the controller), as set out in these Terms, our API, and your configuration.

You give us directly

• Account data: email address and password (stored only in hashed form by our authentication provider).
• Payment data: when you save a card or top up, you enter card details directly with our payment processor, Square. We never receive your full card number. We keep a Square customer ID and card token, the card brand, last four digits, expiry month and year, and transaction IDs, and we share your email address with Square.
• Support and sales correspondence: when you email us or use our contact-sales form, we keep your name, email address, and the content of your messages.
• Configuration: webhook URLs and secrets, line settings, logos you upload, credentials for integrations you connect (such as a GoHighLevel token, stored encrypted), and opaque identifiers you supply (e.g. agency_external_user_id).

We collect automatically when you use the Services

• Website and dashboard activity: pages you view, links and buttons you click (including their text), time on page, scroll depth, the referring page, and campaign (UTM) parameters. We collect this for all visitors using a first-party cookie. If you later sign in, we link the activity from that browser to your account.
• API usage: each authenticated API request, including the endpoint, time, response code, and user-agent, linked to your account.
• Device and network data: IP address, user-agent string, and approximate location derived from IP (city, region, country).
• Cookies and similar storage: see Cookies.

We process on your behalf

• WhatsApp message content (text and media), sender and recipient phone numbers, delivery and read receipts, and group membership events.
• End-Customer details: the phone number and profile name of the End-Customer's WhatsApp account, any phone number you supply for the line, and the End-Customer's IP address when they open the connect page (used to route their line through their region).
• Contacts: the End-Customer's WhatsApp contacts and the public profile details WhatsApp exposes for people they message (name, “about” text, business profile, profile picture).

• To operate the Services: authenticate requests, keep WhatsApp Lines connected, route each line through its region, deliver webhooks, and sync with integrations you connect.
• To bill you: apply prices, run charges through the payment processor, maintain financial records.
• To support you: respond to inquiries, debug issues, and send service emails about your account (for example onboarding help, trial and billing notices, and line alerts).
• To keep the Services safe: detect and prevent fraud, abuse, spam, and security incidents; enforce our acceptable-use rules; protect users.
• To improve the product: analyze how visitors and customers use the website, dashboard, and API, including per-account activity, to understand where people get stuck and make Mossmoon better.
• To comply with the law: respond to legal process, prevent harm, exercise or defend legal claims.

We do not use the content of WhatsApp messages to train AI models, target advertising, or sell to anyone. We don't send bulk marketing email; if we ever do, we'll ask for your consent first and include an unsubscribe link. The one follow-up email we may send after signup (asking whether you need help connecting a line) has an unsubscribe link, and unsubscribing stops it and any similar email. Emails about your account, billing and lines are not marketing and keep coming.

We keep a record of the emails we send you. Outside the EEA, the UK and Switzerland, our emails also contain a tiny image that tells us when an email is opened, so we can see whether important notices (a failed payment, a disconnected line) reach you. We don't do this for recipients in those regions, or when we don't know where you are. Blocking images in your email app stops it.

If you are in the European Economic Area, United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR:

We share personal data only with the categories of recipients listed below, and only as needed for the purposes listed in Why we use it.

• Service providers / processors: companies that help us run the Services and use the data only to provide their service to us:
  • Database, authentication and application hosting providers: account, billing, activity, and message data;
  • Server hosting providers (servers that run WhatsApp Lines, in Germany): line connections, messages in transit, and connection credentials;
  • Media storage and delivery providers: message media and profile pictures;
  • Network providers: each line's WhatsApp traffic uses a dedicated IP address. The provider can see connection metadata but not message content, which WhatsApp encrypts;
  • ipinfo.io (IP geolocation): the End-Customer's IP address when they open a connect page;
  • Square (payments): see What we collect;
  • Resend (email delivery): your email address and the content of emails we send you, and of contact-form messages;
  • Background job processing providers: identifiers and job data needed to run billing and line maintenance;
  • Anthropic (AI service used by our staff for internal analysis and support): account and usage data our staff query. Anthropic does not use this data to train its models.
  Business customers can ask for the current list of named providers at [email protected].
• Integrations you connect: if you connect a platform such as GoHighLevel, we send it the messages, media, and contact details for the lines you bridge, on your instructions.
• Meta / WhatsApp: operating a WhatsApp Line necessarily exchanges data with WhatsApp's servers (phone number, connection metadata, messages in/out). WhatsApp's own privacy practices apply to that exchange.
• Your end-customers' counterparts: recipients of messages you send through a line see the End-Customer's phone number and the message you sent, by the nature of messaging.
• Law enforcement, regulators, courts: when we have a good-faith belief that we are legally required to disclose, or when disclosure is necessary to prevent imminent harm. Where lawful, we'll narrow the disclosure to what's required and notify affected accounts.
• Corporate transactions: if Mossmoon is involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to the same Privacy Policy commitments.

When you provision a WhatsApp Line for an End-Customer, we host a persistent connection to WhatsApp on their account so that inbound messages can be forwarded to your webhook and outbound messages can be sent through the API. To do that, we process:

• The End-Customer's WhatsApp phone number and profile name;
• Connection credentials used to keep the line authorized (stored on our servers; never exposed to you or any other party);
• Inbound and outbound message content and media, sender and recipient phone numbers, contact names and profile details as resolved by WhatsApp, and delivery / read acknowledgments.

The End-Customer's WhatsApp remains primary on their phone. They can disconnect the connection at any time from WhatsApp on their phone (Linked devices). A disconnected line stops processing messages until the End-Customer links it again, and is released automatically if it stays disconnected for more than 7 days during a paid month, or more than 24 hours otherwise (during a free trial or while a payment is failing).

When a line is released (by you, automatically, or by us), we log the connection out of WhatsApp, delete its connection credentials (with a weekly cleanup as a backstop), and stop processing new messages for that line. Message history and billing records for the line are retained as described in Retention.

We use a small set of first-party cookies and similar storage on the website and dashboard. We don't use third-party analytics or advertising cookies or scripts.

If you visit from the EEA, the UK or Switzerland, a small notice asks whether we may record how you use the site. Until you choose "Accept", we record none of your website or dashboard activity. You can change your choice at any time: Cookie settings.

We keep personal data only as long as needed for the purposes we collected it for, or as required by law. Indicative periods:

You can request earlier deletion as described in Your rights, subject to retention we're legally required to maintain.

We implement reasonable and appropriate administrative, technical, and organizational measures to protect personal data, including encryption in transit (TLS), encryption at rest provided by our database and storage providers, hashed passwords, encryption of third-party integration tokens, database access controls, access to production data limited to a small number of named staff, and audit logging when staff view message content. API Keys are kept retrievable so you can view them in the dashboard.

No system is perfectly secure. You play a part too: protect your account credentials, rotate API Keys if you suspect compromise, and notify us at [email protected] if you discover a vulnerability or believe an incident has occurred.

Mossmoon is operated from the United States. Our application runs in the United States, our WhatsApp line servers run in Germany, and our service providers may also process data in the European Union, the United Kingdom, and other countries. Each line's traffic is routed through a network address in the line's own region. Where we transfer personal data from the EEA, UK, or Switzerland to a country that doesn't have an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK addendum where applicable), along with supplementary measures as needed.

Depending on where you live, you may have rights to:

• Know what personal data we hold about you and get a copy;
• Correct inaccurate or incomplete data;
• Delete personal data (subject to retention we're required to keep);
• Restrict or object to certain processing;
• Receive your data in a portable, machine-readable format and, where technically feasible, have it transmitted to another provider;
• Withdraw consent where we relied on consent;
• Lodge a complaint with your local data protection authority.

For data we process as a processor on a customer's behalf (WhatsApp messages and contacts), please contact the customer first; we'll support them in responding to your request. For everything else, including closing your account and deleting your data, email [email protected]. We handle these requests by email rather than in the dashboard, and we respond within 30 days. We may need to verify your identity before acting.

If you are a California resident, the categories of personal information we collect, the purposes for which we collect each category, and the categories of third parties with whom we share each category are described in What we collect, Why we use it, and Who we share with.

We do not sell personal information and we do not share personal information for cross-context behavioral advertising as those terms are defined under the CCPA / CPRA. We do not knowingly collect sensitive personal information for the purpose of inferring characteristics about a consumer.

You may exercise your rights to know, delete, correct, and limit the use of sensitive personal information by contacting [email protected]. We will not discriminate against you for exercising your rights.

The Services are not directed to children under 18 (or the age of digital consent in your jurisdiction, whichever is higher). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact [email protected] and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we'll update the Effective Date at the top and, where reasonable, provide additional notice (for example, an in-product banner or an email to the address on your account). Continued use of the Services after a change takes effect means you accept the updated Policy.

Privacy questions and security disclosures: [email protected]. General support: [email protected].