What we collect, and what we do with it.
The website, free business review and service relationship: information we receive, who processes it, how long it stays, and how to make a privacy request.
📌 Counsel: confirm the responsible legal entity, address, effective date and applicable privacy obligations. Deployment settings, vendor contracts and the request-handling process must be verified before publication.
Who this covers
This draft covers visitors, people requesting a free business review, referral contacts and people involved in a client service relationship. Business contact details, public listings and review quotations can identify owners, staff or reviewers; being public does not make all of that information anonymous.
Client work is scoped in a separate written agreement. Where we handle a client's customer or staff information on its instructions, the respective responsibilities and permitted uses must be set out in that agreement and its data processing addendum. This draft does not establish those roles or authorize new processing.
The review request
When you ask for a free review we collect what you type into the form: your name, the business name, city and type, what it needs most, the tools it runs, your email or phone number (one of the two), any notes, the page you came from, and the referral code in the link if there was one.
- We store your request privately, together with a record of each submission. Repeat requests for the same business and contact are linked, preserving the original request and later submissions. Submitting the form does not send an email confirmation or start a review automatically.
- Our application logs record whether the request was stored, without the contact details you entered. Our hosting provider also processes the web request.
📌 Before this page is in force: confirm the deployed private intake storage and hosting logs match this description. The Reviewer checks it against the data map (WS18-01).
We use this information to understand your request, prepare the review, respond and discuss a privately scoped service proposal. Providing a phone number does not by itself establish consent to marketing texts or calls.
Business reviews and AI
The review gathers public business website content, listings, search results and answers returned by AI services. That material can include names, phone numbers, email addresses, street addresses and review quotations. We use it to assess how the business appears and to draft findings and proposed improvements.
Review inputs, processing records, evidence and rendered reports are stored. Report links can be opened by anyone holding the link. The storage code also defaults to objects readable by URL; private storage and deployed access settings still need verification. An unlisted link is not an authenticated account.
At completed-job finalization, the original job's submitted name and email are replaced, including when report email delivery failed. Failed or stale jobs can retain them. This does not remove contact details from public-source evidence, emails, provider copies or related records.
A lead record keeps findings, an email hash and a follow-up draft that can include your first name. An optional setting also retains the full name and email. When AI follow-up drafting is enabled, Anthropic can receive the first name, business details, findings and report link. Public-source personal information can also appear in review prompts.
📌 Counsel: verify the active contact-retention setting, provider data-use terms and public-link disclosures. There is no blanket assurance here that all contact data is removed or that every provider excludes it from training.
Information used for client services
The existing service components can hold business and contact details, account and billing identifiers, connection information, proposed and completed changes, review decisions, before-and-after evidence and reports. Referral or partner records can hold contact details, notes and attribution. These records support delivery, payment reconciliation and an action history when the relevant service is configured and authorized.
The existing Google Business Profile connector accepts OAuth tokens. The WordPress connector still accepts an application-specific username and password and checks them over HTTPS using the bounded public-network transport. Current WS00 policy denies all client writes. This slice adds no token-storage hardening, disconnect or provider-revocation workflow. Complete cross-system offboarding remains pending. Do not send account passwords in a review request or email.
Configured payment flows use Stripe-hosted payment entry. This application stores payment identifiers and status information; it does not collect raw card numbers or security codes.
📌 Counsel: reconcile the active service scope, client/customer data, controller and processor roles, consent records, retention exceptions and offboarding with the service agreement and data processing addendum. Code capability alone does not establish that a service is active.
Site activity and browser storage
The reviewed site code does not set application cookies or load advertising pixels. It uses browser session storage to remember a referral label and carries that label into links and intake. This is not a claim about every hosting or provider setting.
Rendered report pages send activity events. Event and email-engagement components can record page or action names, timestamps, report identifiers, referral labels and hashed IP addresses. Public static pages send a page-view event with a fixed page label. Accepted, privately stored intake requests produce a separate conversion event. These two event records contain no contact fields or IP hashes; separate daily abuse counters use hashed IP addresses. Opening an email is not reliable evidence that a person read it.
Abuse controls process IP addresses and store hashed counters. The intake browser sends the pathname only; a direct API caller can still submit a longer page value, which is stored privately. Site analytics independently restrict page values to fixed labels. The pages load fonts from Google, which receives the browser's network request.
📌 Counsel: decide the required notices, consent and choices for referral storage, report and email activity, fonts and any future analytics. Confirm the actual deployed behavior before approval.
Providers and other recipients
The following list describes recipients visible in the code. Some integrations are optional. It is a candidate provider and subprocessor list, not confirmation of signed agreements, enabled accounts or processing locations.
| Provider or recipient | Purpose and information received |
|---|---|
| Vercel | Website hosting, request processing, logs and stored records, including review inputs, evidence, reports and service records. |
| Resend and the configured team mailbox provider | Email recipients, reply addresses, message contents and delivery metadata. Submitting the intake form sends nothing to Resend. Separate authorized email workflows, mailbox replies and forwarded copies can hold personal information. |
| Anthropic | Business research, public-source content, findings and review generation; optional follow-up drafts can include the requester's first name and report link. |
| OpenAI, Perplexity and Google Gemini | Business-related questions and context for answer comparisons when configured; results can contain public personal information. |
| Google Fonts | Browser requests for fonts, including network and browser metadata. |
| Stripe | Payment entry on its hosted pages, contact and account references, payment records and billing events when configured. |
| Google Business Profile | OAuth authorization and business/account references. Provider mutations remain subject to the approval policy. Website password connectors are disabled. |
| Paperclip, when configured | Internal intake, review and service identifiers, source paths and status projections. The mirror omits contact fields and free-text submissions; linked private records still require authorized access. |
| Team members, agents and authorized service operators | Request and service records needed for their work. Actual permissions, support tools, local exports and access locations require verification. |
📌 Counsel: confirm each provider's role, agreements, subprocessors, retention, training settings, region and deletion process, including the mailbox provider and any overseas operator access. No US-only storage or access assurance has been verified.
No advertising sale or sharing integration was identified in the reviewed code. That finding does not determine the legal meaning of sale or sharing, or establish every provider's independent use of data.
📌 Counsel: determine any sale/sharing classification and required opt-out links or preference signals from the actual contracts and processing. Provider training exclusions remain unverified.
How long information stays
An approved retention schedule and complete deletion process are still pending. The table describes current code behavior, not permission to retain records indefinitely. A timeout, expired link, cancelled service or stopped message sequence does not by itself erase the underlying information.
| Record category | Current retention or deletion behavior |
|---|---|
| Private review requests, submission history and mirror mappings | Not yet set 📌 set with the retention schedule (spec WS05-11); intake storage has no automatic deletion today |
| Review requests, replies and sent emails | Mailbox and delivery-provider periods are unverified. No application-driven mailbox purge is implemented. |
| Jobs, reports, public-source evidence and reusable review material | No general expiry is implemented. Completed jobs replace the submitted name/email as described above; failed jobs and related copies need separate handling. |
| Temporary review context and top-level abuse counters | Context removal is attempted after staged success. The scheduled monthly cleanup selects context and top-level dated counters older than a configurable period, seven days by default. Limits and failures mean this is not a seven-day maximum. |
| Activity events and nested event/partner abuse counters | No implemented expiry. The cleanup misses nested event and partner counter paths. |
| Lead, referral, outreach and suppression records | No general expiry. Stopping messages retains contact and suppression records; any exception for honoring opt-outs needs an approved schedule. |
| Service accounts, billing, decisions, change history and credentials | No complete deletion or offboarding purge. Billing cancellation does not erase records or revoke all access. Counsel must set any required financial or dispute-record periods. |
| Access links and tokens | Account access tokens default to 90-day validity. Expiry restricts use but does not purge all token records or linked data. |
| Logs, provider copies, backups and local exports | Periods and deletion routes are unverified. Deleting an application record does not establish deletion of these copies. |
📌 Counsel: approve periods and starting events by category, legal holds, suppression exceptions, backup expiry and vendor deletion requirements. The implementation must then be tested against that schedule.
Privacy requests and possible rights
To ask about information connected to you, write to hello@moonrobin.com with the subject “Privacy request.” Describe whether you want access or a copy, correction, deletion, or to stop follow-up contact. Include the business name and the contact address you previously used if available. Do not email passwords, payment-card details or identity documents.
You may also use an unsubscribe link where one is provided. Unsubscribing stops the applicable message flow; it does not delete all records. For information processed on a client's instructions, identify that business so the request can be routed to the responsible party.
Depending on applicable law, rights may include knowing and accessing information, receiving a copy, correction, deletion, opting out of sale or sharing, limiting certain uses of sensitive information, and exercising rights without discrimination. Authorized-agent requests, verification requirements, exceptions and response deadlines require counsel's determination.
📌 Counsel: determine CCPA/CPRA applicability and the required request methods, notices, rights and deadlines. Do not assume a business-contact exemption. The request intake, identity verification, response tracking and complete export/deletion workflow are not yet implemented or operationally verified. This draft does not promise a tested response deadline.
Security and access
The application includes request authentication on selected operations, bounded public-network requests and partial log scrubbing. These controls do not authenticate every report reader, protect every storage object or prove staff access is limited in deployment. Storage access, least-privilege permissions, incident response and request handling must be verified before this notice is approved.
📌 Counsel: confirm incident and breach-notice obligations with the response procedure. No absolute security or incident-notification guarantee is made in this draft.
Children
The website and business services are not directed at children. Please contact us if you believe a child submitted personal information.
Changes to this page
This draft must be reconciled with the implemented controls before publication. An approved notice will identify its effective date and describe material changes as required.
Contact
Privacy questions: hello@moonrobin.com.
📌 Counsel: add the verified entity and mailing address. Confirm this mailbox is monitored, with an operator responsible for verification and responses, before the notice takes effect.