How we handle your data.

01Who we are

MoonDesk is operated by Technology for All Initiative (Tek4All), a non-profit foundation. Tek4All is the legal entity responsible for the MoonDesk service, accessible at moondesk.app and app.moondesk.app.

For anything privacy-related — questions, data requests, complaints — reach us at support@moondesk.app. For business and partnership enquiries, use impact@tekforall.org.

02What we collect

Account information

When you or your organisation's admin creates a MoonDesk account, we collect: your name, work email, role (admin, manager, member), the organisation you belong to, and the password hash you set. We do not store your password in plain text.

Content you create in MoonDesk

Anything you put into the product. Programmes, tasks, messages, calendar events, check-ins, stakeholder records, opportunity tracking entries, file uploads, comments, and audit-trail entries. This is your organisation's data. You own it.

Connected workspace data (only with explicit consent)

If an admin at your organisation connects Google Workspace via OAuth, MoonDesk reads data from the connected account to make it useful inside the product. This may include:

• Gmail message content, thread metadata, labels — used for the Brain Bar search and Luna's email triage
• Drive file content (text extracted from Docs, Sheets, PDFs) — used for cross-document search and AI synthesis
• Calendar events, attendees, descriptions — used for meeting prep and timeline context

The Google Workspace connection is initiated only by an org admin, only after they review the requested permissions on Google's consent screen, and can be revoked at any time from /integrations in the app.

Usage analytics

We log feature use, query patterns, error events, and performance metrics so we can improve the product. We do not sell this data and do not use it for advertising. Usage logs are tied to your account internally but never shared externally in identifiable form.

Communications you send us

If you email us, fill out a contact form, or join a support call, we keep a record of the exchange so we can follow up effectively.

03How we use your data

We use the data above for these specific purposes:

• Provide the service. Render dashboards, run AI queries, sync your connected workspaces, deliver notifications, route messages, store your audit trail.
• Generate AI responses. When you query MoonDesk Brain or use Luna, we send relevant context from your data to AI providers (Anthropic, Google) so they can produce an answer. The relevant context is scoped to your organisation only; nothing crosses tenant boundaries.
• Send transactional email. Account invites, password resets, magic-link sign-ins, security notifications. We never send marketing email without explicit opt-in.
• Maintain security and prevent abuse. Detect suspicious activity, throttle abusive use, investigate incidents.
• Improve the product. Understand what works, what breaks, what's missing. Aggregated, never personally identifying.
• Comply with the law. Respond to lawful requests where we have a legal obligation.

04AI and model training

MoonDesk uses Anthropic Claude for AI synthesis and Google Gemini for embeddings and intent classification. Both providers operate their API services under business-tier terms that explicitly prohibit training on customer-submitted data:

• Anthropic. API submissions are not used for training. See Anthropic's Commercial Terms of Service.
• Google. Gemini API data is not used to train or improve Google's foundation models. See Gemini API Additional Terms.

If we ever change this stance (we have no plans to), we would notify you 30 days in advance and require opt-in consent.

05Subprocessors

To run MoonDesk we use a small set of trusted infrastructure providers. Each has data processing agreements in place with us. Here's everyone who touches your data:

If we add a subprocessor in the future, we'll update this list and post the change 30 days before it takes effect.

06Data retention

We keep your data only as long as we have a reason to.

• While you're an active customer: we retain everything so the product works.
• After cancellation: your organisation's data is permanently deleted 30 days after the cancellation date. During those 30 days, we can restore your account on request.
• On request: you can ask for immediate deletion of your account and all associated data at any time. Email support@moondesk.app. We will action the request within 30 days.
• Audit logs: retained for the lifetime of your account for accountability. Deleted with the rest of your data when you cancel.
• Backups: rolling 30-day backups for disaster recovery. Deleted records are purged from backups within 60 days.

07Your rights

Wherever you live, we honour the rights granted by GDPR, the Nigeria Data Protection Regulation (NDPR), and similar laws:

• Access. Request a copy of the data we hold about you.
• Rectification. Correct anything that's inaccurate.
• Deletion. Request permanent removal of your data.
• Portability. Receive your data in a machine-readable format you can take elsewhere.
• Restriction. Ask us to stop processing your data in certain ways.
• Objection. Object to processing on legitimate-interest grounds.
• Withdraw consent. For anything we do based on your consent (like the Google Workspace connection), withdraw at any time.

To exercise any of these, email support@moondesk.app. We will respond within 30 days. If you're not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

08International transfers

MoonDesk is operated from Nigeria. The primary database is hosted in the European Union (Ireland) via Supabase. Some subprocessors (Anthropic, Google) are in the United States. When your data moves between regions, we rely on:

• Standard Contractual Clauses (SCCs) for transfers from the EU/EEA to the US, as approved by the European Commission.
• Adequacy decisions where applicable.
• Provider-specific safeguards such as Google Cloud's Data Processing Addendum and Anthropic's commercial terms.

Data leaves the EU only when necessary to deliver AI features or fulfil specific connector operations.

09Security measures

We take security seriously without making promises we can't keep. What we actually do:

• Encryption at rest. All data in our database is encrypted using AES-256 via Supabase.
• Encryption in transit. All connections to and from MoonDesk use TLS 1.3.
• Token-level encryption. OAuth refresh tokens (Google) are individually encrypted at the application layer using AES-256-GCM with a key held outside the database.
• Row-level security. Every database query is scoped to the user's organisation. Cross-tenant data access is impossible at the database layer, not just the application layer.
• Audit logging. Every authentication, every connection, every write action is logged with timestamp, actor, and details.
• Least-privilege access. Engineering access to production data is restricted, logged, and reviewed.
• Dependency management. Automated security scanning of dependencies; high-severity issues patched promptly.

We do not currently hold SOC 2 or ISO 27001 certification. We will pursue these as we grow and customers require them.

10Children

MoonDesk is a business product. It is not intended for use by anyone under 18. We do not knowingly collect data from people under 18. If you believe a minor has created an account, please contact us and we'll delete it.

11Changes to this policy

We update this policy when our practices change, when we add or remove subprocessors, or when the law requires it. For material changes, we'll notify you by email and in-app notice at least 30 days before the change takes effect. For non-material clarifications, we'll update the "Last updated" date at the top of this page.

Previous versions of this policy are available on request.

12Contact us

For privacy questions, data requests, or anything else covered by this policy:

• Privacy & data requests: support@moondesk.app
• General & partnerships: impact@tekforall.org
• Mailing address: Technology for All Initiative (Tek4All), Lagos, Nigeria — full address available on request

We aim to respond within 5 business days.