Moonwater builds, hosts and maintains software for the organizations we work with. This policy explains what personal information we collect when you visit our website or use the applications we operate, how we use it, and the choices you have.
1. Who we are and what this policy covers
Moonwater Creations LLC ("Moonwater," "we," "us" or "our") is a technology consulting and software company based in Burbank, California. This Privacy Policy applies to personal information we process in connection with:
- our website at moonwatercreations.com (the "Site");
- the client workspaces, portals and applications we host and operate, including the sign-in screens that lead to them (the "Applications"); and
- our business dealings with clients, prospective clients, partners and vendors, including email and meetings.
Together we call these the "Services." When we process personal information on behalf of a client organization, for example records that a client stores in an Application we built for it, we do so as that client's service provider, and Section 8 explains how that works.
This policy does not apply to third-party websites or services that we link to or that you connect, which are governed by their own policies.
2. Information we collect
Information you provide to us
- Contact and business information, such as your name, email address, company, job title and the content of messages you send us, for example when you contact us through the Site or by email.
- Account information, such as your name, email address and the organization you belong to, when you are given access to an Application.
- Content you submit through an Application, such as requests, comments, files, documents, messages and questions you put to an assistant feature.
- Engagement information, such as contracts, billing contacts, invoices and correspondence relating to work we perform.
Information collected automatically
- Log and device information, such as IP address, browser type, operating system, the pages or screens you view, the time and date of your visit, and referring URLs.
- Usage and audit information within the Applications, such as sign-in events, actions taken, changes made and error reports. We keep this to operate and secure the Applications and to give our clients an accurate record of activity in their workspace.
The Site does not use advertising or analytics cookies and does not include third-party tracking scripts.
Information from third parties
- Identity providers. If you sign in with Google, we receive basic profile information from Google, described in Section 3.
- Your organization. A client may give us your name and email address so that we can grant you access to its Application.
- Services you connect, such as a code repository or collaboration tool, share information with us as you authorize.
3. Signing in with Google
The Applications let you sign in with your Google account. Sign-in is handled through Amazon Cognito, the authentication service provided by Amazon Web Services. When you choose to sign in with Google, we request only the basic scopes openid, email and profile, and receive your name, email address, profile picture and a unique Google account identifier. We never receive your Google password. Signing in does not give us access to your Gmail, Google Drive, Calendar, contacts or any other Google data. Connecting a Gmail mailbox in Pressroom is a separate choice that you make yourself, and Section 4 describes it.
We use information received from Google only to authenticate you, to confirm that you are permitted to access a particular Application, and to show your name within it. We do not sell this information, use it for advertising, or use it to train artificial intelligence or machine learning models, and we do not transfer it to others except as necessary to provide the Services, to comply with law, or with your consent.
Moonwater's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
4. Connecting Gmail in Pressroom
Pressroom is an Application we provide to public relations agencies. Its Email Studio lets each person connect their own Gmail mailbox. Connecting is optional and separate from signing in. Nobody can connect a mailbox for you.
What you approve. When you choose Connect Gmail, Google asks you to approve two permissions: to view your email messages (gmail.readonly) and to manage drafts (gmail.compose). Pressroom uses the second permission only to create, update and delete the drafts it saves for you. Pressroom never sends email from your account. You send from your own mailbox.
What Pressroom reads. When you choose Sync in Email Studio, Pressroom reads recent messages from your inbox: at first the last 14 days, then what has arrived since. For each message it reads the sender, the recipients, the subject, the date and the text of the message.
How we use it. We use this information only to provide Email Studio to you: to show your inbox inside Pressroom, to match a message to the client and the media contact it concerns, to recognize a reply to a pitch you sent so your relationship history stays current, and to save drafts you write or approve in Pressroom into your own Gmail drafts folder.
AI features. If you ask Pressroom to draft a reply, the message you are replying to is sent to the AI model provider so the draft can be written. When a reply to one of your pitches arrives, Pressroom may send that reply to the model provider to classify it, for example as interested or as a pass. If you ask Luna, Pressroom's assistant, about your mail, the messages she needs to answer are sent to the model provider. This runs on your agency's own account with the model provider. Gmail data is not used to develop, improve or train generalized artificial intelligence or machine learning models.
Who can see it. Only you can see your mailbox in Pressroom. Other people at your agency cannot open it. Moonwater staff do not read your email, except with your agency's express permission to resolve a support request, where it is necessary for security purposes such as investigating abuse, or to comply with applicable law.
Where it is kept. Copies of the messages Pressroom has read are stored in your agency's own database, which is separate from every other agency's and hosted with Amazon Web Services in the United States. The credential that lets Pressroom reach your mailbox is stored in a dedicated secrets service and is never shown to anyone. We do not sell Gmail data, use it for advertising, or transfer it to others except as needed to provide Email Studio to you, to comply with law, or as part of a merger or acquisition with your consent where required.
Disconnecting and deleting. You can disconnect your mailbox in Email Studio at any time, which deletes the stored credential, and you can remove Pressroom's access in your Google account. Messages already copied into your agency's Pressroom stay there until we delete them at your agency's request. To ask us to delete them, use our Contact page.
Pressroom's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
5. How we use information
We use personal information to:
- provide, operate, maintain and support the Services, including building and delivering the software our clients engage us for;
- authenticate users and control access to each client's workspace;
- respond to enquiries, communicate about engagements, and send administrative and service messages;
- monitor, secure and troubleshoot the Services, and detect, prevent and investigate fraud, abuse and security incidents;
- understand how the Services are used so we can improve them;
- manage our business relationships, including contracting, invoicing and record-keeping;
- comply with legal obligations and enforce our agreements; and
- carry out any other purpose we describe to you when we collect the information, or with your consent.
We do not sell personal information, and we do not use it for targeted advertising.
6. AI-assisted features
Some Applications include features powered by third-party large language models, such as an in-app assistant or tools that draft, summarize or review content. When you use these features, the content needed to fulfil your request is sent to the model provider for processing. For client work, these features generally run on the client organization's own account with the model provider.
We do not use client content or personal information from the Applications to train artificial intelligence models, and under the commercial terms of the model providers we use, that content is not used to train their models. AI-generated output can be inaccurate, and the software we deliver through these features is reviewed by a person before it is released.
Which AI vendors we use, what each receives and what each publishes about keeping and training on it is on our AI vendors page.
7. How we share information
We share personal information only as described below:
- Service providers that process information on our behalf and under our instructions, including cloud hosting, storage and authentication (Amazon Web Services), email and productivity tools (Google Workspace), AI model providers (such as Anthropic), and source-code hosting (GitHub).
- Your organization. If you use an Application on behalf of a client, that client's administrators may be able to see your account information and your activity within its workspace.
- At your direction, for example when you connect a third-party service or ask us to share information with someone.
- Legal and safety reasons, when we believe in good faith that disclosure is required by law or legal process, or is necessary to protect the rights, property or safety of Moonwater, our clients or others.
- Business transfers, in connection with a merger, acquisition, financing, reorganization or sale of assets, subject to standard confidentiality protections.
8. Data we process on behalf of clients
Each client's Application runs in its own isolated environment, with its own database and access controls. When we store or process personal information within a client's Application, we act as a service provider or processor for that client, and we use that information only to provide our services to that client under our agreement with it.
The client is responsible for its own privacy practices and for the notices it gives the people whose information it stores. If you have questions about information a client holds about you, or want to exercise your rights over it, please contact that organization directly. If you contact us, we will refer your request to the client and assist it as our agreement requires.
9. Cookies and similar technologies
The Applications use cookies and browser storage that are strictly necessary to keep you signed in, to protect sessions, and to remember basic preferences. Blocking them may prevent you from signing in.
The Site loads its typefaces from Google Fonts, which means your browser requests font files from Google's servers and Google receives your IP address as part of that request. Google's handling of that data is described in the Google Privacy Policy.
Because we do not sell or share personal information for cross-context behavioral advertising, there is nothing for a Do Not Track or Global Privacy Control signal to opt you out of; we treat such signals as an opt-out request should that ever change.
10. How long we keep information
We keep personal information for as long as needed for the purposes described in this policy, including to provide the Services, maintain business and financial records, resolve disputes and meet legal obligations. Information we process for a client is kept, returned or deleted as set out in our agreement with that client. When information is no longer needed, we delete or de-identify it.
11. How we protect information
We use administrative, technical and organizational safeguards designed to protect personal information, including encryption in transit and at rest, isolation of each client's environment, least-privilege access controls, restricted and logged administrative access, and audit logging. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. If we learn of a security incident affecting your personal information, we will notify you and the relevant authorities as the law requires.
12. Where information is stored
Moonwater is based in the United States, and the Services are hosted primarily in data centers in the United States. If you access the Services from outside the United States, your information will be transferred to, stored and processed in the United States, where data protection laws may differ from those in your country. Where the law requires, we put appropriate safeguards in place for these transfers.
13. Your choices and rights
Depending on where you live, you may have the right to:
- know what personal information we hold about you and receive a copy of it;
- correct inaccurate information;
- delete your information;
- receive your information in a portable format;
- object to or restrict certain processing; and
- withdraw consent, where we rely on consent.
To make a request, contact us through our Contact page. We will verify your request using information associated with you and respond within the time the law requires. You may use an authorized agent where the law allows. We will not discriminate against you for exercising any of these rights. You can opt out of non-essential emails at any time by replying to let us know; we will still send messages necessary to administer an engagement or your account.
14. Additional information for California residents
This section supplements the policy for California residents under the California Consumer Privacy Act, as amended (the "CCPA"). In the past twelve months we have collected the following categories of personal information, for the business purposes described in Section 5, from the sources described in Section 2:
- Identifiers, such as name, email address, IP address and account identifiers;
- Professional or employment-related information, such as company and job title;
- Internet or other electronic network activity, such as log, usage and audit information; and
- Commercial information, such as records of services purchased from us.
We disclose these categories to the recipients described in Section 7 for business purposes. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past twelve months. We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit its use. We do not knowingly sell or share the personal information of consumers under 16.
California residents have the rights to know, access, correct and delete personal information, and the right not to be discriminated against for exercising those rights. To exercise them, contact us as described in Section 18.
15. Additional information for the EEA, UK and Switzerland
If you are in the European Economic Area, the United Kingdom or Switzerland, we process your personal information on the following legal bases: to perform a contract with you or your organization; for our legitimate interests in operating, securing and improving the Services and running our business, where those interests are not overridden by your rights; to comply with legal obligations; and with your consent, where we ask for it. In addition to the rights in Section 13, you have the right to lodge a complaint with your local data protection authority.
16. Children
The Services are intended for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, please contact us and we will delete it.
17. Changes to this policy
We may update this policy from time to time. When we do, we will change the effective date at the top of this page, and if the changes are material we will give additional notice, such as by email or a notice within the Applications.
18. Contact us
If you have questions about this policy or our privacy practices, please reach us through our Contact page, marked for the attention of Privacy.
Moonwater Creations LLC
Burbank, California