Privacy Policy

This policy explains how Moremade, a Delaware company (“Moremade”, “we”, “us”), collects, uses and shares personal data when you visit moremade.ai or use the Moremade studio, publishing, domain and related services (the “Service”). It is part of our Terms of Service.

In short: we use your data to run the Service, bill you and keep it secure. We do not sell your personal data or share it for cross-context behavioural advertising. The only third-party tag on our site is Google Ads conversion measurement, which tells us which of our ads lead to sign-ups and purchases; it never personalises ads, and where the law requires it, it runs only after you accept it.

1. Who is responsible

Moremade is the controller for personal data about our account holders, visitors to moremade.ai, affiliates and people who contact us. For personal data of visitors to sites and apps that our customers build and publish with the Service, the customer who operates that site is the controller and Moremade processes that data on their behalf. If you are a visitor to such a site, please contact its operator first.

2. Data we collect

• Account data: name, email, profile image and account identifiers, including those received from Google, GitHub or Apple when you sign in with them; password credentials if used (stored hashed).
• Project content: prompts, chat history, uploaded files and images, generated source code, version snapshots, brand settings and readiness scans.
• Connections: access tokens for services you connect (such as GitHub and Supabase) and secret keys you enter for project connectors (such as Stripe, AI model or email providers), stored sealed on our servers and used only to perform the actions you request.
• Billing data: plan, Build Unit balance and history, invoices and the Stripe customer id. Card details are collected directly by Stripe and never reach our servers.
• Domain data: domain names and the registrant contact details the registrar and registry require (name, address, email, phone).
• Affiliate data: if you join the affiliate program, your partner profile, payout details (such as your PayPal email), referral clicks (landing page, referring page, channel tag) and commissions.
• Usage and technical data: IP address, browser and device information, pages and features used, generation records (model, tokens, cost, build results), error logs, security and audit logs, and rate limiting records.
• Communications: messages you send us, enterprise and support enquiries.

Please do not put sensitive personal data (such as health, financial account or government ID data) or other people’s personal data into prompts or project files unless you have a lawful basis to do so.

3. How and why we use it

We do not make decisions based solely on automated processing that produce legal or similarly significant effects about you. Automated checks are used for security and abuse prevention and can be reviewed by a person on request.

4. AI processing and subprocessors

Builder prompts and packed project context (related files, design invariants, diagnostics — not the whole repository) are processed by the AI inference infrastructure providers Moremade engages, under data processing terms and on our behalf only. Production uses pinned model versions. Visual QA may process screenshots or uploaded images. Zero Data Retention workspaces send code generation only to endpoints that honour ZDR. A short request-classification step may be processed under the provider's standard retention terms.

Standard workspaces may be served by any infrastructure provider hosting the selected model. Workspace data policy defaults to ZDR.

5. Who we share it with

• Service providers that process data for us under contract: hosting and infrastructure, AI inference, Cloudflare (CDN, DNS, TLS, security), Stripe (payments), email delivery, and build services used when you publish apps.
• Google (Google Ads), for advertising measurement as described in Cookies: whether you arrived from one of our ads, and whether that visit led to a sign-up, purchase or demo request.
• Domain registrars and registries, which receive registrant data to register and manage your domain and may publish it in registration databases as their policies require.
• Services you connect (such as GitHub, Supabase, Stripe, app stores or email providers), when you ask us to act on them. Their own privacy policies apply.
• Affiliates who referred you may see that a referred account signed up or paid, but not your project content.
• Legal and safety: authorities, courts or others where required by law, or where we believe in good faith it is needed to protect rights, safety or the Service, or to investigate fraud or abuse.
• Business transfers: a buyer, successor or advisers in a merger, acquisition, financing or sale of assets, subject to this policy.

We do not sell personal data, and we do not “share” it for cross-context behavioural advertising as those terms are defined in U.S. state privacy laws. Sites you publish are public; anything you put on them can be seen by anyone.

6. Cookies

We use only cookies that the Service needs or that you would expect from it:

• Sign-in and security cookies that keep you logged in and protect sign-in flows (strictly necessary).
• Referral cookies that remember which affiliate link or campaign brought you, for 60 days, so the right partner is credited.
• Preference storage in your browser, such as language and interface settings.
• Advertising measurement by Google Ads, which records whether you came from one of our ads so that a later sign-up, purchase or demo request can be counted for it. When you sign up, buy or request a demo, your email address is sent to Google as a one-way hash (SHA-256) to match that result to the ad click. In the EEA, the UK, Switzerland and Türkiye this runs only after you accept it in our cookie banner; elsewhere you can decline it there. Google does not use it to personalise ads or build advertising profiles.

We do not use cookies for ad personalisation or remarketing. You can change your choice at any time from Cookie settings at the bottom of our pages, and you can block or delete cookies in your browser; the studio will not work without the strictly necessary ones.

7. How long we keep it

We keep personal data for as long as your account is active and as needed to provide the Service. When you delete a project or your account, we delete or de-identify the related data within a reasonable period, typically 30 days, except where we need to keep it longer to comply with law (for example tax and accounting records), resolve disputes, prevent fraud and abuse, or enforce our agreements. Copies in backups and logs are removed on their normal rotation cycle. Domain registration records are kept as registrars and registries require.

8. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, sealed storage of connector secrets, isolated build workspaces, access controls and audit logging. No system is completely secure; we cannot guarantee the security of data transmitted to or stored in the Service. Keep your credentials safe and do not paste secrets into chat. If we learn of a breach that affects your personal data, we will notify you and authorities as the law requires.

9. International transfers

Moremade is based in the United States, and we and our providers process data in the United States and other countries. Where we transfer personal data from the EEA, UK or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK Addendum, or another lawful mechanism.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a portable copy of your personal data; to object to or restrict certain processing; to withdraw consent at any time (without affecting earlier processing); and to complain to your local data-protection authority. Residents of California and other U.S. states with privacy laws have rights to know, access, correct and delete personal data, to opt out of sale, sharing and targeted advertising (we do none of these), and not to be discriminated against for exercising their rights.

Many of these you can do yourself: edit your profile, export your code, and delete projects or your account in the app. For anything else, email [email protected] from your account email. We will verify your request, may ask for more information to do so, and respond within the time the law requires (generally 30 days in the EEA and UK, 45 days in California). You may use an authorised agent where the law allows; we may ask them for proof of authority. If we decline your request, you may appeal by replying to our decision, and we will respond to the appeal within the time the law requires.

11. Children

The Service is not directed to children and is only for people aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy. We will post the new version here with a new effective date and, for material changes, notify you by email or in the app before they take effect.

13. Contact

Moremade · Privacy questions and requests: [email protected]