Privacy Policy

1. Who we are

MoltsHost is operated by [COMPANY LEGAL NAME], a Delaware company. Our address is [ADDRESS]. In this policy "we" and "us" mean that company.

This policy explains what personal data we collect, why, who we share it with and what choices you have. It covers moltshost.com, the dashboard, the API, the MCP server and our hosting services (the "Service").

For privacy questions or requests, write to [email protected].

2. Two different roles

• Your account data. When you sign up, pay and use the dashboard, we decide how that data is used. Under GDPR we are the "controller" of that data.
• Content you host. Your sites, apps and databases may contain personal data about your own visitors or users. You decide what happens with that data. We only store and process it to provide the Service to you. Under GDPR we are your "processor" and under CCPA your "service provider". Your own privacy policy, not this one, applies to your visitors.

3. Data we collect

Account data

• Name, email address and password (stored in hashed form) or login through a third-party sign-in.
• Company name and billing address, if you give them.
• Plan, projects, domains and account settings.
• API keys you create. We store keys in a protected form.

Billing data

• Payments are handled by our payment processors. Card numbers and PayPal credentials go directly to them. We do not store full card numbers.
• We receive and keep limited billing records: payment status, amount, date, card brand and last four digits, country, PayPal payer ID or email, and for USDC payments the transaction reference and wallet address.

Logs and technical data

• Dashboard, API and MCP request logs: IP address, time, user agent, the API key used (by identifier) and the action taken.
• Deploy and build logs, and runtime logs from your apps.
• Access logs for hosted sites and apps. These include the IP addresses of your visitors.
• Security and abuse signals, such as failed logins and unusual traffic.

Customer content

• The code, files, databases, environment variables and other material you or your AI agent upload to the Service.
• We do not look at this content except to run the Service, to provide support you ask for, to investigate suspected abuse or security problems, or where the law requires it.

Support messages

• Messages you send us, and any files or details you include.
• AI-powered support. We use AI systems to help answer support requests. Your support messages, and the account context needed to answer them, may be processed by an AI model run by us or by a service provider. Please do not put passwords, API keys or other secrets in support messages.

Website data

• Basic usage data from moltshost.com, such as pages viewed, referring page and approximate location derived from IP address.
• Cookies that are needed for login and security. See Section 9.
• If you arrive through an affiliate link, we record the referral so that the affiliate can be credited.

4. How we use data

• To create and run your account and to host your sites and apps.
• To take payments, send receipts and prevent fraud.
• To answer support requests.
• To keep the Service secure and to detect, investigate and stop abuse.
• To send service messages, such as renewal notices, security alerts and policy changes.
• To understand how the Service is used and to improve it.
• To comply with the law and to enforce our Terms and Acceptable Use Policy.

We do not use the content you host to train AI models.

We may send you product news by email. You can unsubscribe at any time. Service messages are not marketing and you cannot opt out of them while you have an account.

Legal bases (GDPR)

If GDPR applies to you, we rely on these legal bases:

• Contract: to provide the Service you signed up for.
• Legitimate interests: to secure and improve the Service, prevent abuse and fraud, and communicate with customers.
• Legal obligation: for tax, accounting and lawful requests from authorities.
• Consent: where we ask for it, for example for optional cookies or marketing. You can withdraw consent at any time.

5. Who we share data with

We do not sell personal data. We do not share it for cross-context behavioral advertising.

We share data with service providers that help us run the Service. They may use it only for that purpose.

Domain registration data may be published in public WHOIS or RDAP records, depending on the registry's rules and any privacy service that applies.

We may also share data:

• For legal reasons. If we believe it is required by law, a court order or another valid legal process, or needed to protect the rights, property or safety of MoltsHost, our customers or the public. This includes reports we are required to make to authorities, as described in the Acceptable Use Policy.
• In a business transfer. If we are involved in a merger, sale or reorganization, data may be transferred as part of it. The new owner must respect this policy or give you notice of changes.
• With your instruction. For example, when you connect a third-party service or an AI agent to your account. Those third parties handle data under their own terms.

6. Where data is processed

MoltsHost is based in the United States. Your data is processed in the United States and in other countries where our service providers operate.

If you are in the European Economic Area, the United Kingdom or Switzerland, your data will be transferred to countries that may not have the same data protection laws as yours. Where required, we rely on approved transfer tools such as Standard Contractual Clauses.

7. Backups and security

• We keep backups of hosted data to help recover from failures. Backups are stored separately from the live systems.
• Data deleted from the live Service may remain in backups until those backups expire. See Section 8.
• We use technical and organizational measures to protect data. These include encryption in transit, encryption of stored secrets, separation between customers and limited staff access.
• No system is perfectly secure. If we learn of a breach that affects your personal data, we will notify you as the law requires.
• You are responsible for the security of your own sites, apps and API keys.

8. How long we keep data

• Account data: while your account is open, and for [RETENTION PERIOD TBD] after it is closed.
• Customer content: while your plan is active, and for [RETENTION PERIOD TBD] after it ends, unless you delete it sooner.
• Backups: [RETENTION PERIOD TBD].
• Logs: [RETENTION PERIOD TBD].
• Support messages: [RETENTION PERIOD TBD].
• Billing records: as long as tax and accounting laws require.

We may keep data longer where the law requires it, or where we need it to resolve a dispute, enforce our agreements or investigate abuse.

9. Cookies

We use cookies that are necessary for the Service to work, such as keeping you logged in, protecting against attacks and remembering an affiliate referral. Cloudflare may set cookies for security purposes.

If we add optional analytics or marketing cookies, we will ask for your consent where the law requires it.

Our site does not currently respond to browser "Do Not Track" signals. [COOKIE AND ANALYTICS DETAILS TBD]

10. Your rights

You can see and update most account data in the dashboard. You can also write to [email protected]. We will not treat you differently for using your rights.

We may need to confirm your identity before we act on a request. You may use an authorized agent where the law allows it. We answer within the time the law requires.

If your request is about personal data held in a site or app hosted by one of our customers, please contact that customer. We will pass the request on where we can.

If you live in the EEA, UK or Switzerland (GDPR)

You have the right to:

• access your personal data and receive a copy;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time, where processing is based on consent;
• complain to your local data protection authority.

If you live in California (CCPA/CPRA)

You have the right to:

• know what categories of personal information we collect, use and disclose, and the specific pieces we hold about you;
• have your personal information deleted, with some legal exceptions;
• have inaccurate personal information corrected;
• opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined in the CCPA;
• limit the use of sensitive personal information. We do not use it for purposes that would trigger this right;
• not be discriminated against for using these rights.

The categories of personal information we collect are listed in Section 3: identifiers, commercial and billing information, internet and network activity, approximate location and the content of messages you send us. We collect it for the purposes in Section 4 and disclose it to the service providers in Section 5.

Residents of other US states with privacy laws may have similar rights. Send requests, and any appeal of our decision, to [email protected].

11. Children

The Service is for adults. It is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact [email protected] and we will delete it.

12. Changes to this policy

We may update this policy. If a change is material, we will give you notice by email or in the dashboard before it takes effect. The date at the top shows the latest version.

13. Governing law

This policy, like our Terms of Service, is governed by the laws of the State of Delaware, USA. This does not limit any rights you have under the privacy laws of the place where you live.

14. Contact

[COMPANY LEGAL NAME]
[ADDRESS]

• Privacy requests: [email protected]
• Legal questions: [email protected]
• Abuse reports: [email protected]