Privacy Policy

The Moori service is operated by the individual or entity contactable at hello@moori.app. For the purposes of UK data protection law, Moori acts as the data controller for personal data you provide when creating an account and using the service. The full legal trading name of the operator will be confirmed on this page before public launch. If you have any questions about who is responsible for your personal data, contact us at the address in the Contact section below.

Moori collects the information you provide when you create an account and use the app: your name, email address, business name, client names and contact details, project details, payment milestone records, document request records, and any files your clients upload through secure portal links.

Your data is used solely to provide the Moori service to you. We do not sell, rent, or share your data with third parties for advertising or marketing purposes.

All data in Moori is scoped to your workspace. Your clients, projects, and files are completely isolated from other accounts. No other Moori user can access your data.

Files uploaded by your clients through portal links are stored in private cloud storage buckets. There are no public file URLs. Every download link is a short-lived signed URL that expires within minutes.

Moori uses the following third-party services to operate the platform. Each acts as a data processor under Moori's instructions:

• Clerk — handles account authentication and session management. Moori does not store or process passwords. See Clerk's Privacy Policy.
• Supabase — provides the database and file storage infrastructure that Moori runs on. Data is stored in the EU (Ireland). See Supabase's Privacy Policy.
• Resend — sends transactional email on Moori's behalf: contact form and support ticket notifications, and secure portal-link emails you choose to send to your clients. See Resend's Privacy Policy.
• Sentry — error monitoring, used to detect and diagnose technical problems with the Moori application. Automated scrubbing removes email addresses and portal-link tokens before any error report is sent. See Sentry's Privacy Policy.
• Upstash — provides the rate-limiting infrastructure used to prevent abuse of forms and upload endpoints. Only a salted, one-way hash of your IP address is stored, never the address itself. See Upstash's Privacy Policy.

Moori uses essential session cookies required for authentication. No third-party advertising or tracking cookies are set. See our Cookie Policy for full details.

Your data is retained for as long as your account is active. You can request deletion of your account and data at any time by contacting us at the address below.

If you are based in the UK or European Economic Area, you have the following rights regarding your personal data:

• Access — you can request a copy of the personal data Moori holds about you.
• Correction — you can ask us to correct personal data that is inaccurate or incomplete.
• Erasure — you can ask us to delete your personal data. We will do so where we have no legal obligation to retain it.
• Restriction — you can ask us to limit how we process your data in certain circumstances, for example while a correction request is resolved.
• Portability — where technically feasible, you can ask for your personal data in a structured, commonly used, machine-readable format.
• Objection — you can object to certain types of processing of your personal data.
• Complaints — if you believe we have not handled your personal data lawfully, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, email us at hello@moori.app. We will respond within one calendar month.

For privacy enquiries or to exercise a data subject right, email hello@moori.app.