Privacy and information protection

Privacy Policy

Account, business and industry-network data is handled around isolation, opt-in sharing, limited use, portability and human decision-making.

Version and effective date: October 18, 2026 · Operator details and local legal review required before production launch

User isolated

Only data available to the current account is selected

Limited use

No business-data sale and no shared customer pool

Self hosted

The deployer controls the database and infrastructure

Human decisions

AI cannot send messages or make commitments automatically

1. Scope and controller

This policy applies to the MooYeah website, authenticated workspace and backend APIs. Before production launch, the operator’s legal name, registered address and privacy contact must be completed here. For a self-hosted deployment, the server operator is the relevant data controller.

2. Information we process

Account data includes name, workspace name, email, irreversible password hash, sessions and membership. Business data includes companies, contacts, products, communications, tasks, AI prompts and outputs. AI Campaign also processes sender identity, encrypted SMTP authorization codes, expiring HTML drafts and embedded images. Delivery logs retain status, subject, recipient domain and an irreversible email hash rather than recipient plaintext. Industry-network data includes the opt-in professional profile, role, MBTI, birthday, avatar, tags, connections, posts and city-level location. Company supply/demand information submitted for AI Discovery enters a human review queue; standard company fields, review status and supporting materials are stored, while additional supporting materials are admin-only. Technical data may include security logs, request times, errors, IP addresses and browser information.

3. Purposes, scope and legal bases

Data is used only for authentication, performance of the service contract, user isolation, lead and follow-up management, user-initiated AI analysis, import/export, membership, security, troubleshooting and legal compliance. After a user explicitly accepts publication for a supply/demand submission, administrators may verify company identity, products and sources. Approved standard company fields become VERIFIED shared information and may receive priority in relevant AI Discovery results; additional supporting materials are not sent to external AI. Checking the registration box is not blanket consent. Separate consent will be requested where law requires it for non-essential marketing. Private workspace business data is not sold or automatically added to the shared company library.

4. AI and prompt desensitization

AI features read only workspace data available to the signed-in user. When prompt desensitization is enabled, known company, product and price values are replaced with symbols before context is sent to an external AI provider. Free text can still contain identifying information, so users should not submit unauthorized personal data or trade secrets. AI may be inaccurate; prices, regulations, delivery, quality conclusions and external commitments require human review.

5. Cookies and sessions

MooYeah uses necessary cookies for the HttpOnly login session and language preference. The login cookie authenticates the account and is unavailable to browser JavaScript. The locale cookie retains the Chinese or English selection. Advertising tracking cookies are not used unless separately disclosed with any required consent.

6. Storage, isolation, network and retention

Workspace data and sender accounts are isolated by user. SMTP authorization codes are encrypted with a dedicated server key and are never returned by the API. AI Campaign drafts and images are removed after expiry; delivery logs follow the AI-log retention period. The industry network is opt-in, with profiles undiscoverable and locations hidden by default; social posts are deleted 7 days after publication. Account deletion has a 30-day recovery period; deleted leads enter a recoverable 90-day archive; AI request logs, audit logs and backups use separate default periods of 180, 365 and 30 days.

7. Processors and international transfers

Data may be sent to an AI, email, payment, map or integration provider only when that feature is enabled. Opening the map requests resources from Mapbox. Professional-profile city selection uses MooYeah's bundled directory and does not call a third-party location service. MooYeah does not send workspace leads, birthdays, contact details or AI prompts to the map provider. Provider, purpose, storage region and transfer mechanism must be disclosed before launch. The project contains no Cloudflare functionality.

8. Security

Controls include password hashing, HttpOnly sessions, server-side authorization, user and workspace isolation, validation, audit records and human approval boundaries. AI Campaign adds public-host SMTP restrictions, TLS login testing, encrypted credentials, HTML allow-list sanitization, sandboxed preview, one-recipient delivery and rate limits. No internet service can guarantee absolute security; incidents will be handled and notified as required by applicable law.

9. User rights

Users may access, correct, export or delete their information, withdraw optional processing and object to automated recommendations. In the industry network, users can disable discovery and location sharing, delete or report posts, decline requests, remove connections or block users. A signed-in user may re-verify the password and request account deletion from workspace settings. The account is suspended immediately and enters a 30-day recovery period before attributable data is removed by the controlled maintenance process. To cancel during the recovery period, contact info@mooyeah.com.

10. Children, complaints, updates and contact

MooYeah is intended for business professionals and not children. Requests to access, correct, delete, withdraw consent, close an account, complain or obtain an explanation may be sent to info@mooyeah.com and will be answered after identity verification as required by law. Material changes will be prominently notified with a revised date; renewed consent will be requested where legally required. The actual operator must still complete a legal review for its location, target markets and providers before launch.

Privacy requests and contact

Please email info@mooyeah.com.