PRIVACY POLICY
Moonlux, a service of Moonshot OS Inc. Last updated: 1 October 2026
1. Who we are
Moonshot OS Inc., a Delaware corporation, operating Moonlux. Mail: Moonshot OS Inc., 717 N Highland Ave, Suite 12, Los Angeles, CA 90038. Email: legal@moonlux.ai
We offer the Service worldwide except where sanctions law prevents it. During the early beta we do not yet accept members resident in the European Economic Area, the United Kingdom or Switzerland. We do not knowingly collect information from anyone under 18.
For the purposes of the EU and UK General Data Protection Regulations, Moonshot OS Inc. is the controller of your personal data.
Before opening sustained membership in the EEA or UK, we will complete the applicable representation, transfer and consumer-law arrangements and identify any required representatives here.
2. What we collect, and why
You give us:
| What | Why |
|---|---|
| Name, email address | To identify you and to reply to you |
| Profession, specialty, subspecialty | To understand where you fit |
| Licence status, licence number, board certification, jurisdiction | To confirm you meet platform requirements |
| Years in practice, practice status, work authorisation | To determine eligibility for specific opportunities |
| Your description of your background | To understand what you would be well suited to |
| Hours you can commit, platforms you already use | To match you appropriately |
| Anything you send us in correspondence | To help you |
We obtain from third parties:
| What | From |
|---|---|
| Verification of your credentials and standing | State licensing boards, professional certifying bodies, federal registries including the NPI registry and the OIG exclusion list |
| Whether a payment succeeded, your country, and subscription status | Stripe, our checkout and payment provider |
| Whether an email was delivered, bounced, or reported as spam | Our email provider |
Generated as you use the Service:
| What | Note |
|---|---|
| Which modules you have opened, and when | |
| Session records | Including an IP address truncated to its first three segments and a general browser type. We do not store your full IP address. |
| Aggregate usage counts | Page views, form starts, form completions. First-party only; we use no third-party analytics or advertising trackers. |
| Placement and payment milestones | Recorded by us or reported by you |
| Content you choose to forward to us | See §3 |
| Merit usage milestones | Whether the browser experience was opened, a practice check began, or a check completed. These events contain no file names, contents, or findings |
| Optional downloaded-checker licence key | To confirm access when that checker is used. Nothing about the files it checks — names, contents, or findings — is ever sent to us. |
| Work Radar extension state | Saved and dismissed opening references and the cached public feed stay in local browser storage. Moonlux does not receive browsing history, visited pages, open tabs, task text, keystrokes, or files from the extension. |
| AI plugin tool inputs | The opportunity filters or limited professional facts you ask the plugin to compare are processed transiently to return the answer. Moonlux does not store those tool inputs in a member profile, and the plugin does not accept real task files or confidential work content. The AI service hosting the conversation processes the conversation under its own privacy policy. |
| Legal and email-consent records | The policy versions accepted, time, purpose, and a one-way identifier needed to honour or prove the choice |
3. What we do not collect
We do not collect the content of your work.
Where you forward platform correspondence to us, we extract specific facts and discard the message body. Where we provide software that runs on your own device, it does not transmit your work, your keystrokes, your screen, window titles, or web addresses to us.
We do not collect your full IP address, your precise location, your contacts, or your browsing activity outside the Service. We do not buy personal information about you from anyone.
4. How we use it
To operate the Service and provide what you asked for; to verify your credentials; to communicate with you about your account; to take payment; to maintain your record; to keep the Service secure and detect abuse; to understand in aggregate whether the Service works; to send occasional field updates when you expressly subscribe; to preserve evidence of your legal and communication choices; and to comply with law.
We do not use your information to train machine learning models, and we do not provide it to anyone else for that purpose.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law. There is no advertising on the Service.
4a. Legal bases (EEA, UK, Switzerland)
| Purpose | Legal basis |
|---|---|
| Operating your account and the Service you asked for | Contract |
| Checking your credentials against public registers | Legitimate interests (platforms require confirmed credentials; the check is limited to what the register publishes) |
| Taking payment and keeping tax records | Contract; legal obligation |
| Security, abuse prevention, aggregate usage counts | Legitimate interests |
| Answering legal demands, keeping records the law requires | Legal obligation |
| Optional field updates | Consent; you may withdraw it at any time |
We rely on consent for optional field updates and where the law otherwise requires it. Withdrawing that consent does not affect account or transactional messages you requested. We do not process special-category data. Please do not send us health or other special-category information.
5. Who we share it with
Service providers, who process on our instructions and for no other purpose: Stripe (payments), our email delivery provider, our database and hosting providers, and our operational alert provider.
International transfers. We are based in the United States, and so are most of our providers. Where we transfer personal data from the EEA, the UK or Switzerland, we rely on the EU–US Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses with the UK Addendum. You can ask us for a copy of the relevant safeguards at legal@moonlux.ai.
Platforms, only what you specifically ask us to send, and only with your agreement on each occasion. We do not pass your details to a platform without asking you first.
Legal, where we are required by law, or where necessary to establish or defend a legal claim, or to protect someone's safety. If we receive a legal demand for your information we will tell you unless we are prohibited from doing so.
A successor, if Moonshot OS is acquired or merges, on notice to you and subject to this policy.
Nobody else.
6. How long we keep it
| You applied and nothing followed | Six months from your last activity, then deleted automatically |
| You are a member | For as long as your account is open, and 30 days after it closes |
| You ask us to delete | Processing begins the same day; most account and profile data is removed promptly |
| Verification records | While the related credential record exists |
| Financial and tax records | Seven years, as required for tax purposes |
| Security and access logs | Twelve months |
| Legal-acceptance and consent audit records | As reasonably necessary to establish and honour the choice, then deleted or de-identified |
Deletion of your service record is permanent and cascades to associated service records. Minimal legal-acceptance, consent, financial, or security records may remain only for the limited periods and purposes stated above; they are not used to operate a profile or send optional updates.
7. Your rights
Wherever you live, you may ask us to:
- tell you what we hold about you and where it came from;
- give you a copy in a portable format;
- correct anything inaccurate;
- delete it;
- stop using it for a particular purpose.
Email legal@moonlux.ai. We will not ask you why, and we will not treat you differently for asking. We will respond within 45 days and will verify your identity through the email address on your account before acting.
If you are a California resident, the California Consumer Privacy Act gives you the rights above, plus the right to know the categories of personal information collected, the purposes, and the categories of third parties it is disclosed to — all set out in §§2, 4, and 5 — and the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months. You may use an authorised agent; we will ask for proof of authorisation.
Residents of other states with comparable laws, including Colorado, Connecticut, Virginia, Texas, and Utah, have equivalent rights and may exercise them the same way. We do not conduct profiling that produces legal or similarly significant effects.
If you are in the EEA, the UK or Switzerland, you also have the rights to restrict processing, to object to processing based on legitimate interests, and to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office). We will respond within one month, extendable by two further months for complex requests, as the law allows.
If you are in Canada, Australia or another country with a privacy law, you have the rights that law gives you, and you may exercise them the same way.
8. Security
Encrypted in transit and at rest. Access to production data is limited to those who need it and is logged.
The system is separated so that each component holds only the rights it needs: the component that accepts your application cannot read any application back, and deletion can only be performed through a specific audited path. Passwords for staff accounts are stored using a modern password-hashing algorithm; sign-in links are stored only as hashes.
No system is perfectly secure, and we do not claim otherwise.
9. If something goes wrong
If your personal information is exposed, we will tell you directly and promptly — in any event within the time required by applicable state law, and without waiting for that deadline where we can act sooner. We will tell you what happened, what was affected, and what we are doing.
Where the GDPR applies, we will notify the competent supervisory authority within 72 hours of becoming aware of a breach that is likely to put your rights at risk, and tell you directly without undue delay where the risk is high.
10. Cookies
We use cookies that are strictly necessary to operate the Service: to keep you signed in, and to protect against cross-site request forgery. We use no advertising, analytics, or tracking cookies, and no third-party cookies.
Because we use only strictly necessary cookies, we do not display a consent banner. Blocking these cookies will prevent you from signing in.
We do not respond to Do Not Track signals, as there is no consistent standard, because we do not track you across sites in the first place.
11. Children
The Service is not for anyone under 18 and we do not knowingly collect their information. If you believe a minor has given us information, email legal@moonlux.ai and we will delete it.
12. Changes
We may update this policy. If a change is material we will email you before it takes effect and update the date above.
13. Contact
legal@moonlux.ai, https://www.moonlux.ai/support, or Moonshot OS Inc., 717 N Highland Ave, Suite 12, Los Angeles, CA 90038.