1. Overview and Scope
This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information in connection with the Moonphase mobile application (the "App"), connected recording devices, and related services that link to this Privacy Policy (collectively, the "Services"). It also explains your privacy rights and choices. In this Privacy Policy, "personal information" means information that identifies an individual or can reasonably be linked to an individual.
The Services may include links to, or integrations with, third-party websites, applications, platforms, or other services. This Privacy Policy does not apply to the collection and use of personal information by those third parties when they act independently. Their own privacy policies apply to that processing, and we encourage you to review them before using or connecting to their services. Our collection and disclosure of information through those connections, and processing by service providers acting on our behalf, remain covered by this Privacy Policy.
Additional privacy notices provided for particular features supplement this Privacy Policy and explain any additional processing and choices relevant to those features.
2. Who We Are
NOOKLAB LIMITED ("we," "us," or "our") provides the Services and is responsible for the personal information processed as described in this Privacy Policy. Where applicable data protection law uses the term "controller," we are the controller of that information. Our privacy contact details are provided in Section 13.
3. What Information We Collect
The information we collect depends on how you use the Services, the features you enable, and the information you choose to provide or make available through connected services.
Information You Provide
When you create or use an account, we collect account and profile information, such as your email address, account identifiers, login and authentication information, profile details, and preferences. When you contact us, we collect your contact details, support requests, feedback, and any attachments or other information you provide.
We also collect content you record, upload, or submit through the App or connected recording devices, including audio recordings, text, questions, and instructions, together with related recording details. Recordings may contain your voice and information about you, as well as the voices and information of other people. When recordings are uploaded to our cloud-based Services, we and the service providers described in Section 6 process the recordings and related content to provide recording, transcription, and AI-assisted features.
Before recording other people or making their information available through the Services, please inform them about the recording and how their information will be used, and obtain any consent required by applicable law. Your acceptance of this Privacy Policy or permission to access your microphone does not, by itself, constitute another person's consent. If your personal information is included in a recording, you can contact us as described in Section 13 to ask questions or exercise the applicable rights described in Section 10, whether or not you have an account.
Information Generated Through the Services
We process information generated from your content and interactions with the Services, including transcripts, summaries, responses, speaker labels, and information stored in the memory feature. Where speaker-recognition features are enabled, we also process voice samples, voice characteristics, and associated profiles used to recognize speakers across recordings. Voice information used to identify a person may be treated as biometric or sensitive personal information under applicable law.
Information Collected Automatically
When you use the App or connected devices, we collect device and usage information, such as device identifiers, device model, operating system and application version, firmware information, IP address, network and connection status, usage records, and diagnostic or security logs. SDKs and similar technologies involved in this collection are explained in Section 5.
Depending on the features you use and your device platform, the App requests permissions such as access to the microphone, Bluetooth, nearby devices or local network, notifications, files, and calendar. You can manage device permissions as described in Section 10.
Information from Connected Third-Party Services
If you sign in through or connect a third-party service, we receive the account details, authorization information, and other information made available through that connection. This can include profile information or content from connected calendar, task, or AI services, within the scope of your authorization.
4. How We Use Information
We use personal information to provide and operate the Services, including account and device management, recording and content services, and AI-assisted features. We also use it to enable the connections, actions, and sharing you authorize through the Services.
We use contact and account information, together with information you provide when communicating with us, to respond to inquiries, provide customer support, and send service-related communications about your account, the Services, and changes to our policies. Where we send promotional communications, we do so in accordance with applicable law and provide a way to unsubscribe.
We use device, usage, and diagnostic information to maintain service performance and security, troubleshoot problems, and improve reliability and usability. We also process personal information as necessary to comply with legal obligations, prevent fraud and misuse, enforce our terms, resolve disputes, and protect the rights and safety of users and others.
Where applicable law requires a legal basis, we process personal information to perform our agreement with you, comply with legal obligations, or pursue our legitimate interests in operating and protecting the Services, provided those interests are not overridden by your rights. Where consent is required, including for certain uses of sensitive information, we obtain that consent. You can withdraw it as described in Section 10. If we intend to use personal information for a materially different purpose, we will provide additional notice and obtain consent where required before doing so.
5. SDKs and Similar Technologies
We use software development kits (SDKs), local storage, and similar technologies in the App. SDKs are software components that enable functions within an application, while local storage allows information to be stored on your device. These technologies help support authentication, device connectivity, and service preferences, and collect device identifiers, usage records, and related technical information for analytics and diagnostics.
Some of these technologies are provided by third parties that receive information as described in Section 6. Where applicable law requires consent for the use of these technologies, we obtain it and provide a way to withdraw it. Section 10 explains how to contact us about your privacy choices.
6. How We Disclose Information
We disclose personal information to service providers that help us deliver and support the Services, including providers of cloud hosting, authentication, transcription, AI processing, analytics, and customer support. Depending on the service they provide, these providers process account information, content, device and usage information, or support communications needed for that service. For example, transcription and AI providers process relevant recordings, text, or other content to provide the features you use. We require providers acting on our behalf to follow our instructions and protect personal information.
You can authorize connections with third-party services or share and export content to recipients you choose. Such connections can allow external AI assistants, calendar services, or task services to access recordings, transcripts, summaries, and other information within the scope of your authorization, and to carry out actions you request. Third parties acting independently process information under their own privacy policies, as explained in Section 1.
We may also disclose information to authorities or other recipients where required by law, in response to a valid legal request, or where necessary to protect rights and safety, prevent fraud or unlawful activity, or establish or defend legal claims.
If we are involved in a merger, acquisition, reorganization, or sale of all or part of our business, personal information may be disclosed or transferred in connection with that transaction, subject to applicable data protection requirements.
7. International Transfers
Your personal information may be stored and processed in countries where we or our service providers operate, including countries outside your place of residence. Data protection laws in those countries may differ from those in your country.
When we transfer personal information internationally, we comply with applicable data protection requirements. Where required by applicable law, transfers are made only under a valid transfer mechanism and with appropriate safeguards in place to protect your personal information. You can contact us using the details in Section 13 for more information about these transfers and the applicable safeguards, including how to obtain a copy of those safeguards.
8. Data Retention
We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy. In determining retention periods, we consider the nature of the information, the Services provided, how long your account remains active, and any legal, security, dispute-resolution, or recordkeeping needs that justify continued retention. When information is no longer needed, we delete it or anonymize it. Information in backups is protected until it is deleted or overwritten in accordance with our backup retention practices.
9. Security
We use reasonable technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure, taking into account the nature of the information and the risks involved. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Your Privacy Rights and Choices
Subject to applicable law, you may have rights to access and obtain a copy of your personal information, correct it, request its deletion, restrict or object to its processing, and receive it in a portable format. We will not unlawfully discriminate against you for exercising your privacy rights.
Depending on your U.S. state of residence and applicable law, you may also have the right to confirm whether we process your personal information and obtain information about our collection, use, and disclosure; opt out of the sale of personal information, sharing for cross-context behavioral advertising, targeted advertising, or profiling that produces legal or similarly significant effects; limit certain uses and disclosures of sensitive personal information or withdraw consent to its processing; and appeal a decision on a privacy request.
We do not sell your personal information or share it for cross-context behavioral advertising, as those terms are defined under applicable U.S. state privacy laws. This does not prevent disclosures to service providers or at your direction as described in Section 6, where those disclosures do not constitute a sale or sharing under applicable law.
Where we rely on consent, you can withdraw it at any time by using the relevant controls available in the Services or contacting us. Withdrawal does not affect the lawfulness of processing before consent was withdrawn. You can also manage device permissions in your device settings and unsubscribe from promotional messages using the instructions provided. If you withhold information needed for a feature, disable a permission, or withdraw consent, we may be unable to provide the corresponding feature. Disabling a device permission does not, by itself, delete information already collected.
You can contact us using the details in Section 13 to exercise your rights or request withdrawal of a third-party service's access. Withdrawing access does not automatically delete information an independent third party has already received; you may need to contact that provider separately.
You can delete content using the controls available in the Services or contact us to request deletion of your account and personal information. We handle deletion requests in accordance with applicable law and retain information only where we have a lawful reason to do so. Copies you have exported or shared with other people or independent third-party services are subject to their control and retention practices.
Where permitted by applicable law, you may use an authorized agent to submit a request on your behalf. We may request information reasonably necessary to verify your identity or the agent's authority. We respond to requests within the period required by applicable law. If we decline a request, we will explain our decision as required by law. Where you have a right to appeal, you can contact us using the details in Section 13, identify the request, and explain why you are seeking review. We will provide the outcome and any further complaint options required by law. You may also have the right to complain to a competent data protection authority, including, where applicable, the authority in the country of your habitual residence, place of work, or the alleged infringement.
11. Children's Privacy
Our Services are not directed to children. We do not knowingly collect personal information from children without parental consent where that consent is required by law. Recordings or other content submitted by users can nevertheless contain information about children. If you are a parent or guardian and believe that a child's information has been processed through the Services contrary to applicable law, please contact us so that we can investigate and take appropriate action, including deletion where required.
12. Changes to This Privacy Policy
We may update this Privacy Policy as our Services and practices change. We will make the updated policy available through the Services and update the date above. For material changes, we will provide additional notice, such as an in-app notice or email, and obtain consent where required by law.
13. Contact Us
If you have questions or concerns about this Privacy Policy, or would like to exercise your privacy rights, please contact NOOKLAB LIMITED at privacy@hellomoonphase.com.