MoLoop AI Privacy Policy
Last updated: August 20, 2026
MoLoop AI ("MoLoop AI", "Moloop", "we", "us", or "our") respects your privacy. This Privacy Policy explains how we collect, use, retain, and share personal information when you use the Moloop AI model gateway, API platform, account portal, and related services available at https://moloop.io (the "Service"), as well as the rights available to you under applicable law.
Please read this Privacy Policy before using the Service. By using the Service, you acknowledge that you have read and understood it. We may update this Privacy Policy from time to time. For material changes, we will give notice as described in Section 13.
1. Data Controller
The data controller for the Service is MoLoop AI, an individual / sole trader operating in Hong Kong SAR.
- Privacy contact: [email protected]
2. Personal Information We Collect
2.1 Information you provide
We collect the following information when you use the Service:
- Account information: username, email address, authentication credentials, account preferences, and account-security settings. Password credentials are processed by our authentication systems and are not stored in readable form.
- Authentication-provider information: if you choose an enabled third-party or OpenID Connect sign-in method, we receive the identifier, email address, and basic profile information the provider is authorized to send to us.
- API and account information: API keys, key labels and restrictions, selected models, credit balance, account settings, and other data needed to administer your account. API keys are sensitive credentials and should not be shared.
- AI request and usage information: the model selected, request timestamps, token or usage quantities, request status, error data, and related operational logs. Inputs and files submitted through the Service may contain personal information if you include it; do not submit personal or confidential information unless you have a lawful basis and all necessary rights to do so.
- Payment information: purchase amount, currency, order or transaction identifier, payment status, subscription status, and refund status. We do not receive or store full payment-card numbers.
- Support communications: the content of support emails, tickets, feedback, and related correspondence.
2.2 Information collected automatically
When you access the Service, we and our infrastructure providers may collect:
- IP address, approximate location derived from IP address, browser type, operating system, device type, language, time zone, and request headers;
- session, authentication, and security information needed to maintain access and prevent abuse;
- pages and features accessed, account actions, API request metadata, request timing, error records, and performance data; and
- browser-stored preferences, such as language, display theme, and table-display preferences.
We do not collect precise geolocation data. We do not use third-party behavioural analytics or advertising pixels at this time.
3. How We Use Personal Information
We use personal information for the following purposes and legal bases, where the GDPR applies:
| Purpose | Legal basis |
|---|---|
| Provide, operate, and maintain the Service | Performance of a contract |
| Authenticate users and manage accounts, API keys, credits, and subscriptions | Performance of a contract |
| Process payments, refunds, and billing records | Performance of a contract and legal obligation |
| Provide customer support and respond to requests | Performance of a contract and legitimate interests |
| Send essential service notices, including billing, security, and policy updates | Legitimate interests and legal obligation |
| Detect fraud, abuse, security incidents, and violations of our Terms | Legitimate interests and legal obligation |
| Monitor reliability, troubleshoot errors, and improve the Service | Legitimate interests |
| Comply with legal, tax, accounting, and regulatory obligations | Legal obligation |
We may create aggregated or de-identified information for statistics, security, and Service improvement. Aggregated or de-identified information does not identify you personally.
4. Cookies and Similar Technologies
Moloop uses the following categories of browser technologies:
| Type | Purpose | Can be disabled |
|---|---|---|
| Strictly necessary | Authentication, session security, and core Service functions | No, where required for the Service |
| Functional | Language, display theme, and interface preferences | Yes, through browser storage settings; some preferences may reset |
We do not currently use third-party analytics, advertising, or marketing cookies. You can clear browser cookies and local storage through your browser settings; doing so may sign you out or reset preferences.
5. Sharing and Disclosure of Personal Information
We do not sell your personal information, including as "sale" is defined under applicable laws such as the CCPA. We disclose personal information only as follows:
- Authentication: enabled identity providers process authentication information to let you sign in and maintain your account session.
- Hosting, delivery, and security: cloud hosting, network-delivery, and security service providers process information necessary to operate and protect the Service.
- AI model providers: when you send an AI request, we transmit the Input, attached content, model selection, and technical information necessary to process that request to the selected third-party AI model provider. Such providers process the information under their own applicable terms and privacy practices.
- Payments: payment-card data is processed exclusively by our PCI-DSS-compliant payment processor, Waffo Pancake, and is not stored on Moloop servers. We receive payment and order status information needed to provide the Service and manage refunds.
- Customer support: email and customer-support service providers process communications sent to [email protected].
- Legal and business transfers: we may disclose information where required by law, valid legal process, or regulatory request, or in connection with a proposed or completed merger, acquisition, financing, or sale of assets, subject to appropriate safeguards.
- With your consent: we may make another disclosure when you have given clear prior consent.
Service providers may process personal information only as needed to provide their services to us, subject to applicable contractual, legal, or technical safeguards.
6. Data Security
We use reasonable technical and organizational measures designed to protect personal information, including:
- TLS/HTTPS encryption in transit;
- password hashing and protection of sensitive credentials;
- access controls based on least privilege;
- infrastructure access protection, authentication controls, and security monitoring; and
- security reviews and remediation of identified vulnerabilities as appropriate.
No method of transmission or storage is completely secure. If a personal-data breach creates a risk to your rights and freedoms, we will notify affected individuals and relevant regulators without undue delay and within applicable legal time limits, including within 72 hours where required by law.
7. Data Retention
We retain personal information only for as long as necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.
| Data type | Retention period | End-of-period treatment |
|---|---|---|
| Account information | While the account is active and for 90 days after cancellation or deletion | Deleted or anonymized, unless legal, fraud-prevention, dispute, or security needs require retention |
| Payment and transaction records | Up to 7 years where required for tax, accounting, or legal obligations | Deleted or securely archived as required by law |
| Support correspondence | Up to 2 years after the ticket or correspondence is closed | Secure deletion or anonymization |
| Security and operational logs | Up to 12 months | Secure deletion or anonymization |
| API request and usage logs | Up to 30 days, unless a longer period is needed to investigate abuse, security incidents, or a dispute | Secure deletion or anonymization |
8. Your Privacy Rights
Depending on your location and applicable law, you may have the right to request access to, correction of, deletion of, restriction of, or objection to our processing of your personal information. You may also have the right to data portability and to withdraw consent where processing is based on consent.
To make a request, contact [email protected] from the email address associated with your account. We may request information necessary to verify your identity and authority. We aim to respond within 30 calendar days, subject to any lawful extension or exception.
You may also have the right to complain to the data-protection authority in your habitual residence, place of work, or the place of an alleged infringement. Hong Kong users may contact the Office of the Privacy Commissioner for Personal Data where applicable.
9. Marketing Communications
Moloop does not currently send marketing emails, SMS messages, or targeted advertising. We may send essential operational communications, including account, payment, security, service, and policy notices. If we introduce optional marketing communications in the future, we will obtain consent where required and provide a clear unsubscribe method.
10. International Data Transfers
Moloop operates from Hong Kong SAR. Our service providers, including hosting, authentication, payment, email, security, and AI model providers, may process information in locations outside Hong Kong SAR and outside your country of residence.
Where applicable law requires it, we use appropriate safeguards for international transfers, which may include contractual commitments incorporating the European Commission's Standard Contractual Clauses, adequacy decisions, or other legally recognized transfer mechanisms. We limit transfers to information necessary to operate and secure the Service.
11. Children's Privacy
The Service is intended only for individuals aged 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us personal information, contact [email protected] and we will take appropriate steps to delete it.
12. Third-Party Links and Services
The Service may link to or integrate with third-party services. This Privacy Policy applies only to personal information that we directly collect. Third-party services, including identity providers, AI model providers, payment providers, and linked sites, have their own privacy practices. Review their privacy policies before using them.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make a material change, we will provide at least 15 days' advance notice through the Service or your registered email address, unless a shorter period is necessary for security, legal, or operational reasons. We will update the "Last updated" date at the top of this page when changes take effect.
14. Contact Us
For privacy questions or to exercise your rights, contact:
- Privacy and customer support: [email protected]
- Data controller: MoLoop AI, individual / sole trader operating in Hong Kong SAR
- Website: https://moloop.io
MoLoop AI · https://moloop.io