Privacy Policy

1. Who we are and what this covers

[Legal company name] (“Moodlands”, “we”, “us”) operates the Moodlands website, apps and related services (the “Service”). This policy explains what personal information we collect, how we use and share it, and the choices and rights you have. It applies to:

• Customers: business owners and designers who create an account;
• Visitors to our website; and
• Clients of our customers: people who fill in a designer's intake form, review a proposal, sign an agreement, pay a deposit or use an approval portal.

If you are a designer's client: the designer decides what information they collect from you and why. We store and process it on their behalf, under their instructions, and their own privacy policy applies. Please send requests about that information to the designer. If you contact us, we will pass your request to them.

We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, including Quebec's Law 25.

2. Information we collect

Information you give us

• Account details: your name, email address, studio or business name, and how you use Moodlands (for your own business or for clients). If you sign in with Google, Google shares your name, email address and profile picture with us; we don't receive your Google password.
• Business and brand details: business name, industry, description, location, website, phone, contact email, brand kits, and the designs, text and images you create or upload.
• Client information (designers): names, contact details and business details of your clients, their intake answers and chosen styles, proposals, typed signatures with date and time, approval decisions and comments.
• Messages you send us, such as support requests.

Payment information

Payments are handled by Stripe. We never see or store full card numbers. We receive limited details from Stripe, such as the card brand, last four digits, billing country, and whether a payment succeeded.

Information collected automatically

• Technical data: IP address, browser and device type, pages and features used, and the date and time of requests, including in server logs.
• Usage counts that enforce fair-use limits, such as how many style codes a session or network has revealed today. These are kept for a short time and reset daily.

Cookies and browser storage

We use one essential cookie (ml_sid) to apply daily usage limits. It holds a random identifier, not your name or email, and lasts up to 30 days. While Moodlands is in preview, some work (such as brand kits and launch packs) is saved in your browser's local storage on your device rather than on our servers. We don't use advertising cookies, and we don't use third-party analytics or tracking tools. If that changes, we will update this policy and ask for consent where required.

3. How we use information

We use personal information to:

• provide the Service: create your account, build your brand kits and designs, and deliver proposals, agreements and portals to the people you choose;
• run AI features you ask for (see section 4);
• process subscriptions, payments and refunds;
• keep the Service and its users secure, prevent fraud and abuse, and enforce usage limits and our Terms;
• answer support requests and send service messages, such as receipts, security alerts and changes to our terms;
• understand and improve how the Service is used, using aggregated or de-identified information where we can;
• send marketing emails, only with your consent, as Canada's anti-spam law (CASL) requires. Every marketing email has an unsubscribe link;
• meet legal obligations, such as tax and accounting records.

We don't sell personal information, and we don't use your content or your clients' information to train AI models.

We rely on your consent, which may be implied where the purpose is obvious (for example, using your email to sign you in). You can withdraw consent at any time, subject to legal or contractual limits. Some features may stop working if you do.

4. AI features

When you use an AI feature, we send only what that request needs, such as your business name, industry, brand kit details and the text you ask it to write or edit. We send it to the AI provider listed in section 5. Our providers process this information to return results to us and, under their terms with us, don't use it to train their models. Please don't put sensitive personal information into AI features.

5. How we share information

We share personal information only:

• With service providers that help us run the Service, under contracts that limit their use of it to the services they provide to us. We keep this list current and tell designers before adding a provider that will process their clients' information:

• With the people you choose: for example, when a designer sends you a proposal, or you submit an intake form to a designer.
• For legal reasons: to comply with law or a valid legal request, or to protect the rights, safety and property of our users, the public or us.
• In a business transaction: if we are involved in a merger, acquisition or sale of assets, under confidentiality terms, with notice to you.
• With your consent, in any other case.

6. Where information is stored

We and our service providers may store and process personal information outside your province and outside Canada, including in the United States. Information held there is subject to the laws of that country, and authorities there may be able to access it. We use contracts and safeguards to protect it in line with this policy and Canadian law. Where Quebec's Law 25 applies, we assess the privacy risks before transferring information outside Quebec.

7. How long we keep information

• Account and design data: while your account is open. After you close it, we keep it for 30 days so you can reactivate and export it, then delete or anonymize it within 90 days of closing. Copies in backups expire within a further 30 days.
• Clients' information: as the designer instructs, and no longer than the designer's account. Designers can delete client records at any time.
• Billing and tax records: as long as tax and accounting laws require, generally six years in Canada.
• Server logs: up to 90 days, unless needed longer to investigate a security issue.

8. Security

We protect personal information with safeguards suited to its sensitivity, including encryption in transit, access controls that limit staff access to those who need it, and security monitoring. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify affected people and report it to the Office of the Privacy Commissioner of Canada and other regulators as the law requires, and tell affected designers so they can inform their clients.

Staff access. To run the Service, Moodlands staff can see a short summary of each account: the owner's name and email, their plan and whether a payment failed, whether Stripe payments are set up, the dollar totals invoiced and collected this month, and counts (for example, how many brands, pages, bookings, invoices and emails it has). Staff never see your customers' names, contact details, messages, form answers or files from that summary. Staff can only see an account's content when its owner gives them a support code in Settings (this needs an account; the demo keeps everything in your browser). That access is read-only, lasts up to 24 hours (or until the owner turns it off), and every access is logged.

9. Your rights and choices

Depending on where you live, you can ask to:

• access the personal information we hold about you and learn how it has been used and shared;
• correct information that is inaccurate or incomplete;
• withdraw consent, or delete your information, subject to legal limits;
• receive information you gave us in a structured, commonly used format, where the law provides this right;
• stop marketing emails at any time with the unsubscribe link.

You can update most account details in the app. For other requests, contact [privacy@moodlands.com]. We may need to confirm your identity first, and we will respond within 30 days. We will tell you if we need longer, as the law allows.

If you are unhappy with our response, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information. People in other places, such as the European Union, the United Kingdom or US states with privacy laws, may have similar rights, including the right to complain to their local regulator. We honour those rights where they apply.

10. Children

The Service is for adults running or working for a business. It isn't meant for anyone under 18, and we don't knowingly collect personal information from children. If you think a child has given us information, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the Service changes. If we make material changes, we will tell you by email or in the app before they take effect, and we will ask for your consent where the law requires it. The date at the top shows when it was last updated.

12. Contact and privacy officer

Questions or requests about privacy go to the person in charge of protecting personal information at Moodlands:

[Name and title of privacy officer]
[Legal company name]
[Business address]
[privacy@moodlands.com]

See also our Terms of Service.