Privacy Policy

“Customer Content” has the meaning given in section 5 of our Terms of Service. Its contractual protections apply whether or not it contains personal information. This Policy does not expand our rights to use it.

When we process personal information in Customer Content on an organization’s behalf to provide the Services, that organization determines the content and instructions and is generally the controller or business; Moxn acts as its processor or service provider where those roles apply. An applicable data processing agreement governs that processing. For information we process for our own account administration, billing, security, and service analytics purposes, our role depends on the activity and applicable law, and we may act as a controller or business.

If an organization provides your workspace, its administrators may manage your access, permissions, integrations, and content within the available controls. Contact the organization about its policies and requests concerning content it controls. This Policy does not govern an external service’s independent practices.

• Account and business information: names, email addresses, profile details, organization and workspace membership, roles, authentication identifiers, and account preferences, provided by you, your organization, or authentication providers.
• Customer Content: documents, skills, prompts, code, files, comments, metadata, inputs and outputs, version history, and execution or agent-session records that you or your authorized users, agents, and integrations submit or generate. These records may contain personal or confidential information.
• Connected-service information: integration credentials and tokens, permission scopes, repository or resource identifiers, and content or metadata exchanged with services you authorize.
• Billing information: subscription details, billing contacts, transaction and payment status, and payment-method references. Payment processors collect payment details; Moxn does not store full payment-card numbers.
• Usage and diagnostic information: IP addresses, device and browser details, timestamps, requested URLs, account or workspace identifiers, feature interactions, resource consumption, errors, and performance measurements. Logs may incidentally include content or personal information; content in logs remains subject to our Customer Content restrictions.
• Communications: information you provide in support requests, feedback, and other communications, and available delivery or engagement information for communications we send.

We collect information directly from you and your organization, automatically through the Services, and from authentication, payment, and other integrations in connection with their authorized functions.

We use information to provide and maintain the Services; authenticate accounts and enforce permissions; store, version, retrieve, and collaborate on content; carry out authorized integrations and agent actions; process subscriptions; respond to support requests; send service communications; diagnose problems; prevent abuse; and meet legal obligations or establish and defend legal claims.

Customer Content and models. We do not use Customer Content to train, fine-tune, or otherwise develop or improve AI or machine-learning models for use by or for the benefit of other customers or third parties, or authorize providers acting on our behalf to do so. This includes content-derived training and evaluation materials, summaries, embeddings, and synthetic examples. Removing identifiers or transforming content does not remove this protection.

AI for your workspace. We may process Customer Content using AI to provide features for you, such as inference, retrieval, indexing, and summarization. Any training or fine-tuning we perform with Customer Content must be under your instructions, including a feature you enable. The resulting customer-specific model or adaptation is used solely to provide Services to you and your authorized users; underlying software, infrastructure, and unmodified base models may be shared. This describes permitted processing, not a promise that a particular customization feature is available. Customer-selected external providers are addressed in section 4.

Operational analytics. We may use technical and operational metrics across customers to analyze and improve the Services, including through statistical and machine-learning methods for notification timing and frequency, capacity, reliability, and performance. Examples include feature-use counts, notification delivery and engagement events, latency, error rates, and resource consumption. These metrics exclude Customer Content and representations of its substantive meaning. Document titles, search text, prompts, and content excerpts do not become operational metrics merely because they appear in logs.

Operational metrics may be linked to accounts or workspaces and are not necessarily anonymous. We use aggregation and data minimization as appropriate. We do not disclose customer-identifying metrics or confidential information to other customers through analytics, or use the metrics permission to extract customer knowledge for their benefit.

We may send product announcements or promotional communications where permitted, subject to your choices. Where a legal basis is required, it depends on the processing: performing a contract with you, legitimate interests such as administering and securing our business and improving service operations where not outweighed by your rights, complying with legal obligations, or consent where required. Processing Customer Content on a customer’s behalf follows its instructions and any applicable data processing agreement; this list does not override those restrictions.

Providers acting for Moxn. We use providers for hosting, storage, authentication, real-time collaboration, monitoring, background jobs, caching, payments, email delivery, and, where applicable, AI processing. Depending on the feature, these include Vercel, Supabase, Clerk, Cloudflare/PartyKit, Modal, Sentry, Upstash, Trigger.dev, Stripe, and Resend. We disclose information needed for their functions. Providers processing Customer Content on our behalf are subject to our content-use restrictions; the list may change as our infrastructure changes. Contact us for information about providers relevant to your use or an applicable data processing agreement.

Your workspace and sharing instructions. Content and related activity are available to recipients authorized through workspace permissions or your sharing, export, publication, and integration choices. Publishing to a marketplace or public repository makes the selected material available outside your workspace. Recipients’ copies may remain after you remove the original. We do not sell or license private Customer Content to other customers for their independent use.

External services you select. When you connect your own AI provider account, MCP client, agent, repository, or other external service, we exchange information necessary to carry out that connection. Its independent use is governed by your agreement and settings with it. Those terms may allow retention, human review, or model training, and may differ between free and paid accounts. Connecting through Moxn does not change those terms or settings. Review them before sending confidential information. A provider Moxn selects to process content on our behalf is not treated as your independent provider merely because you enable a Moxn feature.

Legal, security, and professional needs. We may disclose information when required by law, legal process, or a binding government demand, or as reasonably necessary to investigate misuse, protect the Services or people, and establish or defend legal claims. Professional advisers may receive information subject to confidentiality obligations.

Business transactions. Information may be disclosed under appropriate confidentiality protections in connection with a proposed or completed merger, financing, acquisition, reorganization, bankruptcy, or transfer of business assets. Existing Customer Content protections continue to apply, subject to applicable law; a transaction does not itself authorize shared model training.

We may make other disclosures at your direction or with consent where appropriate, subject to our Customer Content commitments. We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined by applicable privacy laws.

We and our providers use cookies, local or session storage, and similar technologies for functions such as authentication, session continuity, preferences, security, and diagnostics. Browser settings can limit some storage technologies, although disabling them may prevent features from working.

Our monitoring includes error reports, performance traces, and sampled session replay through Sentry. Session replay reconstructs browser interactions to help diagnose issues. The replay integration uses text and input masking and media blocking by default. These measures reduce collection of visible content but do not mean that all diagnostic information is anonymous or that content can never appear in an error, URL, or other record. Our content-use restrictions also apply to content incidentally captured in diagnostics.

We do not use these diagnostic tools for cross-context behavioral advertising. Where applicable law requires consent for a technology or use, that consent must be obtained separately; this Policy is not itself consent. We do not currently change our practices in response to a browser’s Do Not Track signal.

You may update available account settings and contact us at support@moxn.dev about personal information or to request access, correction, deletion, or an export. Our team reviews and handles these requests through our support process. For organization-controlled Customer Content, contact the workspace administrator; we assist the customer with requests as required by law and our agreement.

Depending on your location and applicable law, you may have rights to access or know about personal information, correct it, request deletion or portability, restrict or object to processing, withdraw consent, or appeal a decision on a request. These rights may be subject to legal exceptions. Where available, you may use an authorized agent and complain to your data protection authority. We may verify your identity, authority, and the scope of your request, and will respond as required by applicable law. To request a review or appeal, contact the same email address. We will not unlawfully discriminate against you for exercising your rights.

You may unsubscribe from promotional emails using the link in the message or by contacting us. Necessary account, security, billing, and service messages may still be sent. Removing an integration or revoking its access prevents future authorized access through that connection but does not necessarily delete copies already held by the external service.

We use reasonable technical and organizational measures designed to protect information, including access controls and encryption in transit. No system or method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We retain information for as long as reasonably necessary for the purposes described in this Policy and any applicable agreement. Retention depends on the type of information, workspace and subscription status, version-history functions, support and security needs, legal obligations, disputes, and applicable deletion requests.

Deleting a document from a branch or current view does not necessarily erase it from prior commits, other branches, stored files, execution records, or any backup copies. Account deletion and permanent content deletion are different operations. Contact us to request deletion beyond the available product controls. If backup copies are maintained by us or our service providers, they may remain until overwritten or removed through applicable backup processes; some records may be retained for legal, security, accounting, or dispute-related needs. Retention remains subject to applicable law and our Customer Content restrictions, including the restriction on shared model training.

External recipients and customer-selected integrations control their own copies under their terms. We cannot erase material from an independently controlled recipient merely by deleting it from Moxn.

Moxn is based in the United States. Information may be processed in the United States and other countries where we or our providers operate. Those countries may have different data protection laws.

Where applicable law requires a transfer mechanism or additional safeguards, those requirements apply to the relevant processing and any applicable data processing agreement. Accessing the Services or reading this Policy is not, by itself, consent to a restricted international transfer. Contact us about the processing locations and contractual arrangements relevant to your use.

The Services are intended for business and professional users aged 18 or older and are not directed to children. We do not knowingly collect personal information directly from children who sign up to use the Services. Customer Content may contain information about other people, for which the customer is responsible for the necessary rights and permissions. If you believe a child has provided information to us inappropriately, contact us so we can investigate and take appropriate action.

We may update this Policy to reflect changes in the Services, our practices, or legal requirements. We will post the revised Policy with its effective date and provide additional notice of material changes through the Services or an account contact as appropriate. We will obtain consent where required by law.

A policy update does not by itself authorize retroactive use of previously collected Customer Content for shared model training or remove protections that applied when it was collected.

For privacy questions or requests, email support@moxn.dev.

Moxn, Inc.
Attn: Privacy requests
33B Grape St
Woburn, MA 01801, United States