Privacy Policy

Last Updated: February 25, 2026

Moshi Labs, Inc. ("Moshi," "we," "our," or "us") provides an engagement-analytics and conversational-commerce platform that helps our merchant customers ("Moshi Customers") optimise messaging campaigns and manage communications with their own end users ("End Users"). This Privacy Policy explains how we collect, use, disclose, and otherwise process personal information when you visit our website https://moshi.ai, use any dashboard, API, or related service (together, the "Services"), or interact with us offline.

Summary of Key Points

• What info do we collect?
  We collect information you provide, data generated by your use of the Services, information from Moshi Customers about their End Users, and analytics data via cookies and pixels.
• Sensitive data?
  We do not intentionally collect sensitive personal information (e.g., health records, biometric templates) and we prohibit uploading protected-health information (PHI). End Users may voluntarily share sensitive information during conversations; such data is processed only as necessary to deliver the Services.
• Third-party sources?
  Yes, including public databases, marketing partners, and social platforms like Instagram/Facebook.
• Why do we process data?
  To operate the Services, train and improve AI models, attribute conversions, provide support, prevent fraud, market our products, and comply with law.
• How do we share data?
  With Moshi Customers, service providers, affiliates, business partners, and (in limited cases) law enforcement or purchasers of our business.
• Your rights?
  U.S. state privacy laws (e.g., CPRA, VCDPA, CPA) grant access, deletion, correction, and opt-out rights. You can also opt out of marketing SMS at any time by texting STOP.
• Retention?
  We keep personal information only as long as necessary for the purposes described here, after which we delete or de-identify it.

1. Scope

This Privacy Policy applies to personal information processed by Moshi in connection with the Services. It does not apply to websites or services that link to a different privacy policy. Moshi does not target or market to individuals in the European Economic Area or United Kingdom.

2. Personal Information We Collect

A. Information You Provide to Us Directly

• Account Creation – name, business email, password, role.
• Communications – email, phone, mailing address, business address, incorporation details, and any information you include in messages or support tickets.
• Surveys & Events – responses and contact details.

B. Information We Collect Automatically

• Usage Data – pages visited, features used, time spent, campaign metrics viewed.
• Device & Network Data – IP address, browser type, OS, referring URLs, device identifiers, approximate geolocation (derived from IP).
• Cookies & Pixels – we place first-party cookies (_moshi_id) and pixels to (i) keep you logged in, (ii) analyse performance, and (iii) attribute orders or conversions to Moshi-powered messaging interactions for billing. You can manage preferences via our Cookie Banner.
• Form & Interaction Data – when you interact with forms, widgets, or input fields on the Site, we may collect partial input data, field interaction events, and metadata before formal submission for analytics, fraud prevention, and service improvement.

C. Information from Other Sources

• Moshi Customers – may supply End-User names, phone numbers, Instagram IDs, order data, and message transcripts so we can provide analytics and conversational services. Moshi Customers are responsible for obtaining any required consents.
• Social Media Platforms – When you connect an Instagram Business Account, we receive profile metadata, message threads, media, and engagement metrics.

3. How We Use Your Information

• Provide & Secure the Services – authenticate users, operate dashboards, deliver messages, prevent fraud.
• AI Model Training & Service Improvement – We train and fine-tune machine-learning models, including large-language models, on aggregated or de-identified End-User Data and usage data. We use automated processing, including AI-powered systems, to deliver the Services (e.g., generating conversational responses, classifying inquiries, recommending products). We do not use automated processing to make decisions that produce legal or similarly significant effects on individuals without human review.
• Automated Messaging – When you submit your information via a form on https://moshi.ai or related pages, we may use it to initiate automated conversations with you via SMS, MMS, or iMessage. These messages may be generated by artificial intelligence.
• Attribution & Billing – run cookies/pixels and internal identity graphs to determine which Moshi interactions drove a conversion, per our Attribution Methodology Specification.
• Marketing – send newsletters, product updates, and event invitations (opt-out any time).
• Compliance & Enforcement – enforce our Terms of Service and Mobile Messaging Terms & Conditions; respond to lawful requests.

4. How We Disclose Your Information

• Moshi Customers – usage data and End-User messages for accounts they control.
• Service Providers – cloud hosting, SMS carriers, messaging platforms (including Apple iMessage), payment processors, analytics vendors bound by confidentiality.
• Business Partners & Affiliates – joint offerings or corporate transactions.
• Legal & Safety – to comply with subpoenas, court orders, or defend rights.
• Transfer of Business – merger, acquisition, financing, or asset sale.

5. Your Privacy Choices & Rights

• Email – click "unsubscribe" in marketing emails.
• SMS – text STOP to opt out, or HELP for help. Message & data rates may apply.
• Cookies – manage in the Cookie Banner or browser settings.
• AI Training – to opt out of having your de-identified conversation data used for AI model training, email support@support.moshi.ai.
• State Privacy Rights (CA, CO, VA, CT, UT) – access, deletion, correction, portability, opt-out of "sale"/"sharing" or targeted advertising. Submit requests at support@support.moshi.ai; we will verify identity via email confirmation.

6. Security of Your Information

We employ administrative, technical, and physical safeguards, including encryption in transit and at rest, and access controls.

7. International Data Transfers

Moshi is based in the United States. If you access the Services from outside the U.S., you understand that your information may be transferred to, stored, and processed in the U.S.

8. Data Retention

We retain personal information for as long as necessary to (i) provide the Services and fulfill the purposes described above, (ii) comply with our legal obligations, and (iii) resolve disputes. End-User Data linked to a merchant account is generally deleted or de-identified within 24 months of account closure, while aggregated analytics and de-identified training data may be retained indefinitely.

9. Supplemental Notice for California Residents

See CPRA Notice for categories collected, purposes, and disclosures. Moshi does not sell personal information as defined by the CPRA and does not share personal information for cross-context behavioural advertising.

10. Supplemental Notice for Nevada Residents

Moshi does not sell covered information as defined in Nevada Revised Statutes Chapter 603A.

11. Children's Information

The Services are not directed to children under 13. We do not knowingly collect information from children.

12. Other Provisions

• No PHI – The Services are not designed to process Protected Health Information under HIPAA; uploading PHI is prohibited.
• Third-Party Links – External sites are governed by their own policies.
• Changes – We may update this Policy. Material changes will be posted here and, if required, emailed.

13. Contact Us

Moshi Labs, Inc.
c/o Corporation Service Company
251 Little Falls Drive
Wilmington, DE 19808
Email: support@support.moshi.ai