Legal

Privacy Policy

Last updated 22 October 2026

Moonstaff AI LLC is a Florida limited liability company (document L26000012313). This page describes exactly what this website collects, why, how long it is kept, and how to have it removed. It is written to be read, not to be impenetrable.

What we collect

What you type into a form or the chat on our website, or tell our demo phone line, a few details about the submission itself, and two technical values your browser sends with any request:

Data	Why
Email address	To reply to you, and to send anything you asked for.
Mobile number	Only if you give us one, by phone or email.
The page you sent it from, and the time	To know which pages work, and to answer in order.
Referral code	Only if you arrived through a client’s referral link, so the business that introduced you is credited.
IP address	Abuse prevention and spam filtering. The website chat does not store it (see Website chat).
Browser user-agent	Debugging genuine form failures.
Calls to our demo line: your number, the recording and transcript, and anything you tell the assistant (such as your name and a callback number)	To answer and follow up on your call, and to improve the assistant. After each call we email a summary of it to our team inbox, with the number you called from, any message you left, and the answers you gave about your business.
Website chat: what you type to the assistant	To answer you. Kept 90 days, then it expires automatically.
Website chat: contact details and answers you choose to give it (name, email, phone, and about your business)	To follow up on your enquiry, and to book the call you asked for.

The form sends once, when you press Send. If you type your email and leave without sending, nothing is stored. When you do send it, an automatic reply goes to that address and we are notified so a person can follow up.

Analytics

We use Umami to count page views, where visits come from, and which buttons get clicked, so we can tell whether this page actually works. It is cookieless: no cookies, no cross-site tracking, and no profile of you. Like any web request, it receives your IP address, which it uses to work out your country; it does not store the address. Aggregate counts only — we cannot tell who you are from it, and there is nothing in it to sell. Umami stores this data on servers in the United States and the European Union and keeps it for six months.

Do Not Track

Some browsers send a Do Not Track signal. We do not change our behaviour when we receive one, because there is nothing here for it to turn off: this site sets no tracking cookies, runs no advertising pixels, and does not track you across other websites. Our analytics builds no profile of you whether the signal is present or not. We also do not honour any other opt-out protocol, for the same reason — there is no cross-site tracking to opt out of.

What we do not do

• No tracking or advertising cookies on this website — no advertising pixels, no ad-network tags. Our analytics (above) is cookieless by design, which is why it was chosen. Some cookies are strictly necessary, and those need no consent: the client portal sets a sign-in cookie that lasts about ten minutes and a session cookie that ends when you close your browser (both HttpOnly, so page scripts cannot read them), and the Amazon Cognito sign-in page may set its own; and the booking calendar is a Cal.com frame that may set its own functional cookies under Cal.com’s privacy policy.
• It keeps at most two small values in your browser’s local storage: your light or dark theme choice, which never leaves your device; and, only if you arrived through a client’s referral link, that referral code, kept for 30 days so the introduction can be credited if you send the form. The website chat also keeps a random conversation id in your browser’s session storage, so a conversation carries over between pages; your browser clears it when you close the tab.
• We do not sell, rent, or share your information with third parties for their marketing.
• We do not buy contact lists, and we do not cold-call numbers submitted here.
• We do not knowingly collect information from anyone under 18.

Text messages and consent

Signing in to the client portal

Clients sign in at portal.moonstaff.ai. You can choose how:

• Continue with Google. We ask Google only for your basic profile and email address (the openid, email and profile permissions). Google sends your name, email address, whether Google has verified that address, your Google account ID and, for a Google Workspace account, your organisation’s domain. We keep only your email address, the verified flag, the Workspace domain and the account ID. We use them for one purpose: to recognise you when you sign in and connect you to your business’s portal. We never ask for access to your Gmail, Drive, contacts or calendar.
• Continue with Microsoft. The same, for a Microsoft work, school or personal account: Microsoft sends your name, email address and account identifiers to a small sign-in service that runs in our own AWS account; we keep your email address, whether Microsoft vouches for it, and your Microsoft account identifier.
• Continue with email. We email you a one-time code through Amazon SES. We keep your email address.
• Passkeys. If you add one, we store only its public key. Your fingerprint, face or screen lock never leaves your device.

To keep bots from creating logins, the sign-in page runs a Cloudflare Turnstile check, which sees your IP address and browser details, as any such check does.

We do not sell, share or use any sign-in information for advertising, and nobody outside Moonstaff AI sees it except the services named on this page that run the sign-in for us, and as described in When we would share it. Moonstaff AI’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

A login is kept for as long as you use the portal. A login that was never connected to a business is deleted automatically after 30 days. To delete yours sooner, or to disconnect Google or Microsoft from it, email hello@moonstaff.ai. You can also remove Moonstaff AI from your Google account’s connections or your Microsoft account’s app permissions at any time.

Where it is stored

In our own Amazon Web Services account in the United States (region us-east-1), in an encrypted database that is not publicly reachable. Emails (the automatic reply to you, our own alerts, our booking notifications, call summaries and messages you leave by phone, and a daily list of unanswered questions) are sent through Amazon SES; our team inbox is hosted on Google Workspace. Calendar bookings are handled by Cal.com. The calendar loads from Cal.com when you scroll to a booking section, so at that point Cal.com receives your IP address and browser details, as any embedded service does, and then whatever you enter into the booking widget. When you book, we also tell Cal.com which of our services the booking is about. Cal.com is governed by its own privacy policy. Portal logins are kept in Amazon Cognito, in the same account and region.

If you pay us through the client portal, payment is handled by Stripe. Your card or bank details go to Stripe, not to us, and we never see your full card number.

We protect what we hold with encryption and restricted access, but no system is perfectly secure, and we cannot guarantee that it will never be breached.

Calls answered by AI

Our demo phone line is answered by an AI assistant, and it says so at the start of the call. Calls are recorded and transcribed. The audio and transcript pass through the providers that carry and run the call: Vapi, which runs the assistant, and the services it uses for speech and language — Deepgram, Anthropic, Google and ElevenLabs — plus the phone carrier. We do not train AI models on calls. We turn on each provider’s no-training setting, where one is offered, before client data reaches it; until then, calls to our demo line fall under those providers’ own policies.

If you book a call by phone, the answers you give about your business (business type, what you’d fix first, team size, website, how you heard of us) go to Cal.com with your name and email. The number you’re calling from does not. If our assistant can’t answer a question about Moonstaff, it records the question, without your name or number, so we can add the answer. Those are kept until we answer them and for 180 days after.

A receptionist we run for a business is covered by that business’s own notice and our agreement with it.

Talking to our AI on this website

You can also talk to our AI assistant out loud, in your browser, on this website. Your browser asks for the microphone, and we use it only after you press Start talking. Before you start, the page tells you that the conversation is recorded and transcribed and that you are talking to an AI. A Cloudflare Turnstile check runs first, to keep bots from starting calls. The audio and transcript pass through Vapi, which runs the assistant, through Deepgram, Anthropic, Google and ElevenLabs for speech and language, and through Daily, which carries the audio between your browser and the assistant.

The call is recorded and transcribed. The audio recording and the transcript are stored by Vapi, our voice provider, under its own retention policy. Moonstaff keeps the call summary with your lead record.

That summary is written by AI. We keep it, plus the name, email and business type you tell the assistant, in our leads records. We email you a recap only if you ask for one. Your IP address is not kept with the conversation. To limit how often the demo can be used, we keep a keyed hash of it, which expires within two days. Like every request to our API, the request that starts the call is logged with your IP address, and those logs are deleted after 14 days.

Website chat

The chat on our website is an AI assistant, and it says so on the chat panel. What you type is answered by an AI model on Amazon Bedrock, in our own AWS account. Bedrock may process a request in any of its US regions, so your messages stay in the United States but not always in us-east-1.

• Your messages are stored with the assistant’s replies and expire automatically 90 days after they were sent.
• A lead record is created for each conversation. The only personal details in it are the ones you choose to tell the assistant: your name, email address and phone number, and your answers about your business (your trade, revenue range, where your leads come from, and what you would fix first, and, if you tell it, your team size, your website and how you heard of us). It also notes whether you booked a call. It is kept like any other enquiry (see How long we keep it).
• Your IP address is not stored. To stop one visitor flooding the chat, a rate counter keeps a shortened hash of it instead, and the counter expires after three days.
• If you ask the assistant to book a call, it sends your name, email address, your phone number if you gave one, and the answers you gave about your business (business type, what you’d fix first, team size, website, how you heard of us) to Cal.com to make the booking. When you book, or leave a message, we receive an email with your details, the answers you gave about your business and the conversation. If it can’t answer a question about us, it records the question (without your name or contact details) so we can improve it; those are kept until we answer them and for 180 days after.

When we would share it

Only in these cases, beyond the services named on this page that run the site for us:

• when the law requires it, such as a valid subpoena or court order;
• to protect our rights, or the safety of you or anyone else;
• to a buyer or successor if Moonstaff AI is merged, acquired or sells its assets. They would still be bound by this policy for what you gave us under it.

Text-message opt-in data and consent are excluded from all of the above, except where the law requires.

How long we keep it

As a general rule, we keep information as long as we need it for the reason you gave it to us, plus any longer period that legal, accounting or tax rules require.

Enquiries are kept until you ask us to delete them, or until they are clearly no longer relevant. We do not run an automatic deletion timer, because a lead record is a business record. If you want yours removed, see below — there is no process to argue with.

Recordings and transcripts of calls (the demo phone line and the web demo) are stored by Vapi, our voice provider, under its own retention policy. Moonstaff keeps call summaries with the lead record.

Website chat messages expire automatically 90 days after they were sent. Contact details you gave the assistant are kept with your enquiry, as above. Questions the chat could not answer are stored without your name or contact details until we answer them, then for 180 days. Booking and message emails, and the call summaries we receive, stay in our team mailbox until we delete them. A message or call summary we could not email is kept for up to 14 days so we can resend it.

Your choices

Email hello@moonstaff.ai from the address you submitted and ask us to:

• send you a copy of what we hold about you;
• correct it;
• delete it entirely.

We will action deletion requests within 30 days and confirm when it is done. You do not need to give a reason.

Changes

If this policy changes materially, the date at the top changes with it. We do not revise it silently.

Contact

Moonstaff AI LLC
c/o Registered Agents Inc.
7901 4th Street N, Suite 300
St. Petersburg, FL 33702
United States
hello@moonstaff.ai