Privacy Policy

Last updated 26 July 2026

Moon is a recruiting workspace used by in-house talent teams. This policy explains what we collect, why, and what we do with it — including the specific commitments we make about data we access from your Google Account.

1. Who this covers

Two groups of people appear in Moon, and they are treated differently:

• Users — recruiters, hiring managers and interviewers at a customer company who sign in to Moon.
• Candidates — people a customer is considering for a role. Candidates do not sign in. Their information is held by Moon on behalf of the customer, who decides what is collected and how long it is kept.

For candidate data, the customer is the data controller and Moon is the processor. If you are a candidate and want your information corrected or deleted, contact the company that approached you, or write to us at services@moon.ac and we will route it to them.

2. Google user data

Moon requests only the Google scopes it needs to schedule interviews. Each one, and exactly what we do with it:

What we store

We store an encrypted OAuth refresh token so Moon can keep working without asking you to sign in repeatedly, plus the identifiers of events Moon itself created. We do not copy the contents of your calendar into our systems.

Limited Use commitment

Moon's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not:

• transfer or sell Google user data to third parties for advertising, market research or any similar purpose;
• use Google user data to serve advertisements;
• use Google user data to develop, improve or train generalized AI or machine-learning models;
• allow humans to read Google user data, except where you explicitly ask us to, where it is necessary for security or to comply with the law, or on data that has been aggregated and anonymized.

Revoking access

You can disconnect your calendar inside Moon at any time (Settings → Integrations), or revoke Moon's access directly at myaccount.google.com/permissions. Revoking stops all future access immediately; we delete the stored token.

3. Other information we process

• Account information — name, work email, company, role, and sign-in activity for users.
• Candidate information — the details a customer's team adds or imports: name, contact details, public professional profile, résumé, interview notes and scorecards, and the messages exchanged with that candidate.
• Messages — where a user connects a work mailbox or LinkedIn account, Moon reads and sends messages related to candidates so the conversation history lives in one place. This is done through our messaging provider, not through Google.
• Interview recordings and transcripts — only where the customer has turned this on and all participants have been notified as their local law requires.
• Product usage — logs and diagnostics used to keep the service running and to investigate faults.

4. How we use it

To operate the service the customer has asked for: finding and contacting candidates, scheduling interviews, keeping a record of the process, and reporting on it. We also use aggregated, non-identifying data to improve Moon.

Moon uses third-party AI models to draft messages and summarize interviews. Customer and candidate content sent to those providers is processed under agreements that prohibit using it to train their models. Google user data is never sent to them.

5. Who we share it with

We do not sell personal information. We share it only with service providers who help us run Moon, each bound by contract to protect it:

• cloud hosting and database providers;
• AI model providers, for drafting and summarization;
• email, calendar and messaging providers, to send and receive on your behalf;
• applicant tracking systems the customer has connected;
• meeting recording and transcription providers, where enabled;
• data enrichment providers, to find publicly available professional information about candidates.

A current list of sub-processors is available on request at services@moon.ac. We may also disclose information where the law requires it, or to protect the rights and safety of our users.

6. Security

Data is encrypted in transit and at rest. OAuth tokens are encrypted with a separate key. Access to production systems is limited to staff who need it, and every action taken on a candidate record is logged.

7. Retention

We keep customer and candidate data for as long as the customer's account is active, and delete or anonymize it within 90 days of account closure — sooner if the customer asks. Backups are purged on their own rolling schedule. Google OAuth tokens are deleted as soon as a calendar is disconnected.

8. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information, or to object to how it is used. Write to services@moon.ac and we will respond within the time your law allows. Candidates: see section 1 — we will pass your request to the company holding your data.

9. International transfers

Moon is operated from the United States, and our providers may process data in other countries. Where we transfer personal data out of the UK, EEA or Switzerland we rely on Standard Contractual Clauses or another approved safeguard.

10. Children

Moon is a workplace tool and is not directed at anyone under 16. We do not knowingly collect their information.

11. Changes

If we change this policy in a way that materially affects you, we will update the date at the top and notify account administrators before it takes effect.

12. Contact

Moon Labs Inc.
1990 N California Blvd, 8th Floor
Walnut Creek, CA 94596
United States
services@moon.ac