Privacy Policy

Last Updated: August 21, 2026

This Privacy Policy describes how Happy Melon Games Corp ("Moonnight", "we", "us", or "our") collects, uses, and protects your information when you use moonnightapp.com and its associated apps (collectively, the "Service").

By using the Service, you agree to the collection and use of your information as described in this policy.

---

1. Who We Are

Happy Melon Games Corp operates the Moonnight platform — a suite of SaaS productivity apps available at moonnightapp.com.

Contact: support@moonnightapp.com

---

2. Information We Collect

2.1 Information You Provide Directly

Note: We never see or store your full payment card number. Card details are handled exclusively by Stripe.

2.2 Information Collected Automatically

2.3 Information from Third Parties

• Google: When you sign in with Google, we receive your name, email address, and profile picture as permitted by Google OAuth.
• Stripe: We receive subscription status, payment success/failure events, and billing period information via Stripe webhooks.

2.4 What We Do NOT Collect

• Passwords (Google handles authentication — we never see your password)
• Sensitive personal data (health, biometric, financial account numbers)
• Location data beyond IP address
• Data from children under 13

2.5 Shopify Merchant Data (AOVBooster)

AOVBooster is different from the rest of the Moonnight suite: it's a Shopify app installed by merchants into their own Shopify stores, not a consumer product you sign into directly. For AOVBooster, the installing merchant is the data controller for their store's data (including their customers' data), and Happy Melon Games Corp acts as a data processor on the merchant's behalf, strictly for the purposes below, under Shopify's Partner Program Agreement.

What we deliberately do not read or store: shopper name, email, phone number, or shipping/billing address. Shopify's orders/paid webhook payload includes these fields by default, but AOVBooster's code only extracts the fields listed in the table above — shopper-identifying fields are never parsed, logged, or persisted, and the raw webhook payload itself is never stored (only the specific extracted fields).

Retention: revenue-attribution records (order ID, discount code, amount, currency — no shopper-identifying data) are kept for as long as the merchant has AOVBooster installed, to power the analytics dashboard, and are deleted on request or after the merchant uninstalls the app.

GDPR compliance webhooks: AOVBooster implements Shopify's mandatory customers/data_request, customers/redact, and shop/redact webhooks. Because AOVBooster never stores shopper-identifying data in the first place, these are acknowledged with no shopper data to return or delete.

If you're a shopper with a question about a specific store's use of AOVBooster, please contact that store directly — as the data controller, they're best positioned to answer. If you're a merchant with questions about AOVBooster's own data handling, email support@moonnightapp.com.

---

3. How We Use Your Information

We use your information to:

• Provide and operate the Service — authenticate your account, grant app access, track subscription status
• Process payments — create and manage your Stripe subscription, handle billing lifecycle events
• Send transactional emails — trial reminders, payment receipts, account notices (via Resend)
• Measure ad performance — match signups to Meta (Facebook) ad campaigns using UTM parameters and the Meta Pixel (PageView and Purchase events)
• Improve the Service — analyze aggregated, anonymized usage patterns
• Ensure security — detect fraud, prevent abuse, protect against unauthorized access
• Comply with legal obligations — respond to lawful requests, enforce our Terms of Service
• Attribute upsell revenue for merchant billing and analytics (AOVBooster) — match a Shopify order's discount code to an accepted upsell offer, solely to bill the merchant's usage-based subscription correctly and show them their own conversion analytics; see §2.5 for what this does and does not include
• Power AI-assisted features — process content you submit (e.g., uploaded photos/videos, call recordings) through third-party AI/ML providers solely to deliver the specific feature you're using. This currently includes FlowChef's recipe parsing, Swing 3D's motion analysis, and Customer Whisperer's call transcription, and applies the same way to any current or future app in the Moonnight suite that works on this pattern — we'll add the provider to the table in Section 5 as we adopt it, but the purpose stays the same: deliver the feature you asked for, never advertising, model training, or an unrelated purpose

We do not use your information to:

• Train AI or machine learning models — ours or any third-party provider's. Providers we use for AI-assisted features process your content solely to deliver that feature and are contractually prohibited from using it to train their own models.
• Sell to data brokers or advertisers
• Build advertising profiles for retargeting by third parties (beyond our own Meta ad campaigns)

---

4. Cookies and Tracking Technologies

4.1 Cookies We Set

4.2 Third-Party Scripts

You can disable cookies in your browser settings. Note that disabling session cookies will prevent you from staying logged in.

---

5. Information Sharing and Disclosure

We share your information only with the following parties:

We may also use other third-party AI/ML service providers to power app-specific features as our product suite evolves. Any such provider processes your content solely to deliver the feature it supports and does not use your content to train its own models.

We do not sell your personal information to any third party.

We may disclose your information if required by law, court order, or government authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Moonnight, our users, or the public.

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, with notice provided to you.

---

6. Data Retention

When you delete your account, we will delete your personal data within 30 days, except where retention is required by law. For AOVBooster, a merchant's revenue-attribution records are deleted on request or after the merchant uninstalls the app.

---

7. Data Security

We implement industry-standard security measures including:

• HTTPS/TLS encryption for all data in transit
• Encrypted database connections
• Authentication via Google OAuth (we never store passwords)
• Payment card data handled exclusively by Stripe (PCI DSS compliant)
• Access controls limiting employee access to user data
• Regular security updates to all dependencies

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security but are committed to protecting your data using reasonable measures.

In the event of a data breach that affects your rights and freedoms, we will notify affected users and relevant authorities as required by applicable law.

---

8. Your Rights and Choices

8.1 All Users

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your account and personal data.
• Opt-out of marketing: We do not send marketing emails. All emails are transactional (trial reminders, receipts). You may unsubscribe at any time via the link in any email.

8.2 Canadian Residents (PIPEDA / BC PIPA)

As a Canadian company based in British Columbia, we comply with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA BC).

Canadian residents have the right to:

• Access: Request access to your personal information we hold.
• Correction: Request correction of inaccurate or incomplete information.
• Withdrawal of consent: Withdraw consent to collection or use of your personal information (subject to legal or contractual restrictions), with reasonable notice.
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca or the BC Information and Privacy Commissioner at oipc.bc.ca.

We collect personal information only with your knowledge and consent, and only for the purposes identified in this policy. We do not sell personal information.

8.3 California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act:

• Right to Know: Request disclosure of what personal information we collect, use, disclose, and sell.
• Right to Delete: Request deletion of your personal information.
• Right to Opt-Out of Sale: We do not sell personal information. No opt-out required.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

Categories of personal information collected: Identifiers (name, email, IP address), commercial information (subscription and payment history), internet activity (pages visited, features used), geolocation data (IP-derived only).

8.4 EEA/UK Residents (GDPR/UK GDPR)

If you are located in the European Economic Area or United Kingdom, you have additional rights:

• Legal basis for processing: Contract performance (account and billing), legitimate interests (analytics, security, ad attribution), legal obligation (financial record retention).
• Right to portability: Request your data in a structured, machine-readable format.
• Right to restrict processing: Request that we limit how we use your data.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent.

To exercise any of these rights, email support@moonnightapp.com. We will respond within 30 days (PIPEDA/CCPA) or within 1 month (GDPR).

---

9. Children's Privacy

The Service is not directed to children under the age of 13 (or 16 in the EU/EEA). We do not knowingly collect personal information from children under these ages. If you believe we have inadvertently collected personal information from a child, please contact us immediately at support@moonnightapp.com and we will delete the information promptly.

---

10. International Data Transfers

Moonnight is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your country.

For users in the EEA/UK, transfers are made subject to appropriate safeguards including Standard Contractual Clauses where applicable, as provided by our data processors (Stripe, Vercel, Supabase, Resend).

---

11. Third-Party Links

The Service may contain links to third-party websites. This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party sites you visit.

---

12. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email or by posting a notice on the Service. The "Last Updated" date at the top of this page indicates when the most recent changes were made.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy.

---

13. Contact Us

For privacy-related requests, questions, or complaints:

Happy Melon Games Corp Doing business as: Moonnight Email: support@moonnightapp.com Website: https://moonnightapp.com

We will respond to all privacy requests within 30 days.

This Privacy Policy was last updated on August 21, 2026.