Moon
Sign in

Privacy Policy

Last updated: October 2026

1. Introduction

This Privacy Policy explains how Moon Websites, a trading name of MOONNET LTD (company number 16661802, registered in England and Wales) ("we", "us", "our"), collects, uses, and protects your personal data when you use our services or visit our website. We are committed to protecting your privacy and handling your data transparently and securely.

2. Information We Collect

2.1 Personal Information

  • Name
  • Email address
  • Phone number
  • Business details

2.2 Billing Information

  • Payment details (processed securely via third-party providers such as Stripe)
  • Billing address

2.3 Technical Data

  • IP address
  • Browser type
  • Device information
  • Website usage data and browsing patterns

2.4 Communication Data

  • Emails, messages, and support requests
  • Call recordings (where applicable for VoIP services)
  • SMS messages sent and received through our communication services

2.5 AI Chat & Support Data

  • Conversations with our AI-powered website chat assistants
  • Chat transcripts and visitor enquiry data submitted through your website
  • Questions and responses generated by AI chat features

2.6 Domain & Hosting Data

  • Domain registration details (domain name, registrant information)
  • DNS configuration and zone records
  • SSL certificate data
  • Website hosting configuration and deployment data

2.7 Account Data

  • Account credentials (passwords are securely hashed and never stored in plain text)
  • Order history and subscription details
  • Service preferences and configuration settings
  • Activity logs related to your account and services

3. How We Use Your Information

We use your data to:

  • Provide and manage our services, including website building, hosting, and domain registration
  • Process payments and subscriptions via secure payment providers
  • Communicate with you about your account or services
  • Provide AI-powered chat support on your website and manage visitor enquiries
  • Operate communication services including VoIP calls, SMS, and email on your behalf
  • Register and manage domains and DNS configuration
  • Improve our website, services, and AI features
  • Send important service updates
  • Send marketing communications (only where permitted)
  • Detect and prevent fraud or abuse

4. Legal Basis for Processing

We process your data under the following legal bases:

  • Contractual necessity — to provide the services you purchased
  • Legitimate interests — to improve services, prevent fraud, and ensure security
  • Legal obligations — for compliance with applicable laws and regulations
  • Legitimate interests — to contact businesses about our services (see section 12), and to measure how the demo websites we build are used
  • Consent — for marketing communications to individuals where the law requires it

5. Payments & Security

Payments are processed securely via trusted third-party providers (e.g. Stripe).

We do not store full card or banking details on our servers. Card data is tokenised and handled entirely by our payment processor.

All transactions are encrypted using industry-standard security (TLS/SSL).

6. Sharing Your Data

We may share your data with:

  • Payment processors (e.g. Stripe) for billing and subscription management
  • Hosting providers for website hosting and server management
  • Domain registrars (e.g. Cloudflare) for domain registration and DNS management
  • AI service providers for powering chat assistants and content generation features, and (Groq) for sorting replies to our business emails (for example "interested" or "please remove me")
  • Postal and print providers (Stannp) when we send a postcard to a business address
  • Communication service providers for VoIP, SMS, and email tools
  • Marketing and analytics platforms for service improvement

All third parties are required to handle your data securely and in compliance with data protection laws.

We do not sell your personal data.

7. AI Chat & Automated Processing

Our platform uses AI-powered chat assistants on client websites. When visitors interact with these chat features:

  • Conversation data is processed by our AI providers to generate responses
  • Chat transcripts may be stored to improve service quality and for client review
  • Visitor contact details submitted via chat are collected and provided to the relevant client
  • AI-generated content is created in good faith but should be verified by the end user

8. Call Recordings

Where VoIP services are provided, calls may be recorded for quality assurance, training, and dispute resolution purposes.

Callers will be informed of recording where required by law.

Recordings are stored securely and retained only for as long as necessary.

9. Data Retention

We retain your data only as long as necessary to:

  • Provide active services
  • Meet legal and accounting obligations
  • Resolve disputes

When you cancel your services, we will retain essential data for legal compliance and then securely delete remaining personal data.

10. Your Rights (UK GDPR)

You have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Request deletion of your data
  • Restrict or object to processing
  • Request data portability
  • Withdraw your consent at any time, where we rely on consent
  • Not be subject to decisions made only by automated means that have legal or similarly significant effects (we do not make such decisions)

To exercise these rights, contact us using the details below. We reply within one month. If you are not happy with how we handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ico.org.uk). People in the Philippines have the rights in section 18.

11. Cookies

We use cookies to:

  • Improve website functionality
  • Maintain your logged-in session
  • Analyse traffic and user behaviour
  • Support marketing and advertising

On our websites (moonwebsites.co.uk and its sub-domains, including the demo sites) we set these first-party cookies:

  • mw_vid — a random visitor ID, kept for 2 years, so we can recognise the same browser across our sites (demo, main site and checkout)
  • mw_sid — a random visit ID that expires after 30 minutes without activity
  • mw_offer — which offer a demo site showed you, kept for 30 days so the price stays the same when you come back

You can control or delete cookies through your browser settings, or ask us to delete what we hold (section 20).

12. Demo Websites and Business Outreach

We build finished example websites ("demo sites") for UK businesses and contact those businesses by email or post to show them. We do this on the basis of our legitimate interest in offering our services to businesses.

Where the business details come from: publicly available business information, such as online business listings and maps, business directories, the business's own website and the Companies House register. We use the business name, trade, address, phone number, website and business email address.

Who we email: we only send unsolicited emails to limited companies and LLPs (corporate subscribers). Sole traders and partnerships may receive a postcard at their business address instead. Every email says who we are and has a one-click unsubscribe link.

What a demo site records: when someone opens a demo site we record the visit: the IP address (and a one-way hash of it), approximate location from the IP (country, region, city), browser and device type, screen and window size, language and time zone, the page that referred you, which offer was shown, how long the page was open, how far it was scrolled, and whether the buttons were used. We use this to improve the demo sites, to see which businesses are interested, and to follow up with the business. Together with the mw_vid cookie this can form one timeline of visits across our sites (demo, main site, checkout) for the same browser.

Replies: replies to our emails are stored with the business record and may be sorted by an AI provider (Groq) so that requests to stop are acted on quickly.

How long we keep it: business contact records for as long as we may contact the business and up to 2 years after our last contact; demo visit records for up to 2 years; the addresses of people who asked us to stop, for as long as needed to make sure we never contact them again.

Your right to object: you can object at any time, free of charge. Use the unsubscribe link in any email, reply "unsubscribe", or email contact@moonwebsites.co.uk and we will stop contacting you and stop the demo-site tracking linked to your business.

13. Marketing Communications

We send marketing emails to individuals only if they have opted in, or are existing customers (where legally permitted). Emails to businesses are covered in section 12.

You can unsubscribe at any time using the link in our emails.

14. Data Security

We take appropriate technical and organisational measures to protect your data, including:

  • Secure servers with encryption at rest and in transit
  • Hashed passwords (never stored in plain text)
  • Access controls and role-based permissions
  • Regular security reviews

15. Third-Party Links

Our website or services may contain links to third-party websites. We are not responsible for their privacy practices.

16. International Data Transfers

Our main server is hosted by Contabo GmbH in the European Union. Some of our service providers process data outside the UK and the EU, mainly in the United States (for example Cloudflare, Stripe and some of our AI providers).

When data goes outside the UK, we rely on a UK adequacy decision (the EU and EEA have one) or on the safeguards the provider offers under UK GDPR, such as standard contractual clauses with the UK addendum or the UK extension to the EU-US Data Privacy Framework.

17. Facebook and Instagram Data (Moon HQ)

Moon HQ lets a business connect its own Facebook Pages, Instagram professional accounts and Meta ad accounts so it can post, schedule, see its results, answer messages and comments, and run ads from one place. This section covers the data we get from Meta (Facebook and Instagram) when a business does that.

17.1 Who is responsible

  • For the business's own Page, Instagram and ad data (posts, comments, messages, followers' names, stats and ads), the business is in charge (the controller) and we act only on its instructions (the processor). We use this data only to provide Moon HQ to that business.
  • For the details of the person who connects the accounts (their Facebook user ID, name and the access token Meta gives us), MOONNET LTD is the controller.

17.2 What we get, and why

We only receive what the business allows on Meta's permission screen, and only for these uses:

  • Your Facebook profile basics: your Facebook user ID and name, so we know who connected the accounts and can show it in your dashboard.
  • The list of Pages you manage (Page name, ID, picture and your role), so you can choose which Pages to connect.
  • Your Page's posts and their likes, comments and reach, so you can see how your posts did.
  • Publishing to your Page and Instagram: we send the posts and photos you write or approve in Moon HQ to Meta at the time you choose. We never post without you (or someone you added to your business) asking, scheduling it, or switching on an automatic feature such as an auto-reply.
  • Your linked Instagram professional account (username, name, profile picture, follower count and your posts), so you can publish to it and see your results.
  • Page and Instagram statistics (for example followers, reach, views and engagement per day), for your weekly report, best times to post and tips.
  • Business portfolio access: if you choose managed access (see below), our Meta business portfolio asks Meta for partner access to your Page, and we list the Pages your business has let our portfolio manage. Your Page admin approves or refuses the request in Meta. We use this for nothing else.
  • Ad accounts and ads (account name, currency, time zone, status, and each ad's budget, dates, spend and results), so you can boost a post, start, pause or stop it, and see what it cost and how it performed.
  • Messages and comments, only if you switch on the Inbox: the messages and comments people send your Page or Instagram account (their name or username, the ID Meta gives them for your Page, the text and any attachments), so you can read and answer them in Moon HQ.

We do not use Meta data for our own marketing, we do not build profiles of people from it, we do not sell it, rent it or share it with advertisers or data brokers, and we keep each business's data separate from every other business.

Managed access. If you give our Meta business portfolio partner access to your Page (in Meta Business Suite), our own Facebook login acts on that Page for you: we post what you ask for, read its statistics, and, if you switch on the Inbox, show its messages and comments so you can answer them. We only ask for content, community activity and insights access, never full control. You can end it at any time in Meta Business Suite (remove our business as a partner) or by tapping Disconnect in Moon HQ.

17.3 Lawful basis

  • Contract: to provide Moon HQ to the business that connected the accounts. For the details of the person who connected them (often an owner or a member of staff), contract, or our legitimate interest in running the service the business asked for.
  • Legitimate interests: to keep the service secure and to stop misuse (for example security logs).
  • For the people who message or comment on a business, the business decides the lawful basis, and we process their data only for that business.

17.4 Where it is stored and how it is protected

  • Meta data is stored in our database on our server hosted by Contabo GmbH in the European Union.
  • Access tokens from Meta are encrypted (AES-256-GCM) before they are saved, and are removed from error messages and logs.
  • Every request to Meta is signed with our app secret (Meta's appsecret_proof).
  • The business's own team connects its accounts with their own Facebook login. Our staff cannot use your Facebook login. The only exception is managed access (section 17.2), where you give our own business portfolio access to your Page in Meta.

17.5 Who else handles it

  • Contabo GmbH (European Union): hosts our server and database.
  • Cloudflare (worldwide network, United States company): carries and protects the traffic to our dashboards.
  • AI providers, only when an AI feature is used (for example a suggested reply to a message or comment, or tips from your stats): the text needed for that suggestion is sent to Groq (United States), or, if Groq is busy, to Mistral AI (European Union), OpenRouter, Together AI or Google Gemini (United States). For tips, this is a short summary of your statistics (reach, followers and your best post). You check and approve suggested replies unless you switch on automatic replies. If we add another AI provider, we update this list first.
  • Meta itself, when we send your posts, replies and ads to Facebook and Instagram.
  • Anyone the law requires us to give it to.

Transfers outside the UK and the EU are covered by the safeguards in section 16.

17.6 How long we keep it

  • Access tokens and connected accounts: until you disconnect the account, remove our app in Facebook, or your Moon HQ account is closed. Then the token is deleted straight away.
  • Inbox messages and comments: up to 12 months, then deleted automatically. They are deleted straight away when you disconnect the account or remove our app.
  • Statistics and post results: while your Moon HQ account is open, so your reports can show trends. Account statistics are deleted when you remove our app. The results of each post, and the Facebook and Instagram post IDs and links, are deleted when you remove our app with a deletion request, or when you ask us. The posts the business wrote in Moon HQ stay in its Moon HQ account until the business deletes them.
  • Ad records and invoices (budgets, spend and our fee): as long as the law requires for accounting, which in the UK is up to 6 years.
  • Deletion records: a one-way code of the Facebook user ID (not the ID itself) and the confirmation code, so you can check that a deletion was done.

17.7 How to disconnect or delete

  • Disconnect in Moon HQ at any time (Social, then Accounts, then Disconnect). We delete the token and the inbox copies for that account straight away.
  • Remove our app in Facebook (Settings and privacy, then Settings, then Business integrations or Apps and websites, then Moon Websites, then Remove). If you also ask Facebook to delete your data, Facebook tells us automatically. We then delete your connections, tokens, inbox copies and statistics, and give you a confirmation code with a link where you can check the status.
  • Email us at info@moonwebsites.co.uk and we will delete it within one month.

Step-by-step help and the status check are on our data deletion instructions page. If you messaged or commented on a business that uses Moon HQ, you can ask that business, or us, to delete it.

17.8 Meta's rules

We follow the Meta Platform Terms and Developer Policies. Nothing in this policy limits them. If Meta asks us to stop using or to delete any Meta data, we do.

18. If You Are in the Philippines

We also follow the Data Privacy Act of 2012 (Republic Act No. 10173) for people in the Philippines. What we collect, why, who receives it and how long we keep it are set out above. Under that law you have the right to:

  • be informed about how your data is processed
  • access your data
  • object to processing
  • have your data corrected
  • have your data erased or blocked
  • get a copy of your data in a format you can reuse (data portability)
  • be paid damages for harm caused by wrong or unlawful processing
  • complain to the National Privacy Commission (privacy.gov.ph)

Our data protection contact is info@moonwebsites.co.uk. Please contact us first so we can help.

19. Updates to This Policy

We may update this Privacy Policy at any time. Changes will be posted on this page. Continued use of our services constitutes acceptance of the latest version.

20. Contact Us

If you have any questions or requests regarding your data, please contact us at contact@moonwebsites.co.uk or write to us at MOONNET LTD, Suite A, 82 James Carter Road, Mildenhall, Norfolk, IP28 7DE.

For Facebook and Instagram data, email info@moonwebsites.co.uk. MOONNET LTD, company number 16661802, registered in England and Wales.