Privacy Policy

Effective date: [insert publication date]

This Privacy Policy explains how Mochi L.L.C-FZ (“Mochi,” “we,” “us,” or “our”) collects, uses, stores and shares Personal Data in connection with our services (“Services”).

1. Definitions

For the purposes of this Policy:

“Personal Data” means any information relating to an identified or identifiable natural person.

“Processing” means any operation performed on Personal Data, such as collection, storage, use, disclosure or deletion.

“User” means any individual accessing or using the Services, including authorized representatives of our business clients.

“Meta Data” means information obtained through integrations with Meta Platforms, including Instagram and Facebook account data and messaging data, as authorized by Users.

“YouTube Data” means information obtained through YouTube API Services, including channel details and video metadata.

2. Data Controller

The Data Controller responsible for Processing under this Policy is:

Mochi L.L.C-FZ
Meydan Grandstand, 6th floor
Meydan Road, Nad Al Sheba
Dubai, United Arab Emirates

License No: 2531534.01
Formation No: 2531534
Issued by: Meydan Free Zone, Dubai

Contact: hey@themochi.app

3. Categories of Personal Data Collected

We may collect and process the following categories of Personal Data, depending on the Services and integrations you use:

3.1 Account and Login Data — Email addresses, IP addresses and connected account identifiers, including Instagram and Facebook account identifiers obtained through Meta APIs.

3.2 Usage and Communication Data — Messages, chat interactions and related information submitted or processed through the Services.

3.3 Voice Data — Audio files and voice models uploaded or generated with explicit consent.

3.4 Analytics and Link-Tracking Data — Usage metrics, such as session logs and behavioral data collected through Google Analytics, and click data processed through our link-tracking services, including Dub. Depending on the service and configuration, click data may include timestamps, referring pages, device and browser information, approximate location and IP addresses.

3.5 Payment Data — Billing information processed by Stripe. Mochi does not store credit card details.

3.6 YouTube Integration Data — Channel details, video metadata and access and refresh tokens used to operate the YouTube integration, as described in section 7.2.

4. Legal Basis for Processing

Depending on the Processing activity and applicable law, we process Personal Data under one or more of the following lawful bases:

• Consent: for activities requiring express authorization, such as voice cloning and authorized actions through connected integrations.

• Contractual necessity: to provide the Services and perform our obligations under our Terms of Service.

• Legitimate interests: to secure, maintain and improve the Services, where those interests are not overridden by applicable individual rights.

• Legal obligation: to comply with statutory or regulatory requirements.

5. Purposes of Processing

We process Personal Data for the following purposes:

• Authenticating Users and connecting authorized third-party accounts.

• Providing CRM and unified inbox features.

• Generating AI-powered workflows and responses.

• Sending authorized voice messages on behalf of coaches.

• Displaying connected YouTube channel and video information.

• Replacing approved links in YouTube video descriptions with Mochi tracking links.

• Measuring clicks on tracked links and displaying link-performance information.

• Monitoring usage, performance and security.

• Administering subscriptions and billing.

YouTube Data is used only for the YouTube integration purposes described in section 7.2. It is not used for the general AI workflows or voice features described elsewhere in this Policy.

6. Data Retention

6.1 Chat Data — Retained for the duration of account activity and deleted after 90 days of inactivity.

6.2 Voice Data — Retained for the lifetime of the account unless earlier deletion is requested or consent is withdrawn.

6.3 Billing Data — Retained only as necessary for billing administration, audit, tax and compliance obligations.

6.4 Analytics and Link-Tracking Data — Retained only for as long as necessary to provide the relevant analytics and link-tracking features and meet applicable legal obligations. Link configuration data may be retained while a tracking link remains active, subject to the YouTube Data deletion requirements in section 7.2.

6.5 Integration Data — Meta Data and YouTube Data are subject to the integration-specific deletion provisions in section 7.

6.6 Legally Required Retention — Where applicable law requires retention of particular information, we retain only the information necessary for that requirement and only for the required period.

7. Third-Party Integrations and Data Deletion

7.1 Meta: Instagram and Facebook

We process Meta Data in accordance with the permissions granted by Users and applicable Meta Platform Policies.

When you revoke consent or disconnect an Instagram or Facebook account, we delete the related Meta Data from Mochi’s systems. We also process deletion requests received through Meta’s Data Deletion Callback.

You may contact hey@themochi.app with questions or requests concerning Meta Data deletion.

7.2 YouTube and Google User Data

Mochi uses YouTube API Services.

When you use Mochi’s YouTube integration, you agree to be bound by the YouTube Terms of Service. Google’s handling of your data is described in the Google Privacy Policy.

What we access

With your permission, Mochi accesses information from the YouTube channel you connect, including:

• Channel details: channel ID, name, handle, profile picture and subscriber count.

• Video metadata: video ID, title, description, publish date, duration, thumbnail and view count, together with metadata needed to preserve existing video settings when updating descriptions.

• Authorization tokens: access and refresh tokens that allow our servers to call the YouTube API on your behalf.

The YouTube integration does not read your Gmail messages, Google Drive files, YouTube comments, private messages or YouTube Analytics reports. Account and login information collected separately by Mochi is described in section 3.1.

How we use it

We use this information to:

• Display your connected channel and videos inside Mochi.

• Show clicks recorded through Mochi tracking links associated with your videos.

• Replace links you approve with Mochi tracking links in your video descriptions.

Approving a link for automatic replacement authorizes Mochi to replace matching links in existing videos and videos you upload later while the integration remains connected. Mochi only replaces approved links within the description field and preserves your video’s title, tags and category.

You can stop future automatic replacements by disconnecting the channel.

Click statistics are generated through Mochi’s link-tracking service and Dub. They are separate from YouTube view counts and YouTube Analytics reports.

We use YouTube Data only to provide these integration features. We do not use it for advertising, sell it or use it to train AI models.

Who processes or receives it

Google Cloud and Firebase provide infrastructure and storage used to operate the Services and may process YouTube Data on Mochi’s behalf for those purposes.

We share the minimum information needed to operate tracked links with our link provider, Dub: the destination URL of each tracked link and an internal Mochi ID for the video it belongs to.

When someone clicks a tracked link, Dub may also process click information described in section 3.4. Further information about Dub’s processing is available in the Dub Privacy Policy.

Other disclosures of YouTube Data are limited to those required by law and must comply with applicable Google and YouTube data-use requirements.

Storage and security

YouTube Data is stored in our database, which is encrypted at rest.

Access and refresh tokens are encrypted separately and are used only by our servers to call the YouTube API on your behalf. Data transmitted between Mochi and these services uses HTTPS.

Retention and deletion

We refresh or delete stored YouTube channel and video data within each 30-day period.

When you disconnect a channel in Mochi, we immediately revoke the authorization token and delete the channel’s stored YouTube Data and associated authorization tokens.

If you revoke Mochi’s access through your Google account instead, we delete the associated stored YouTube Data and authorization tokens within seven calendar days.

You may also request deletion of your stored YouTube Data by contacting hey@themochi.app. We process these requests as soon as possible and within seven calendar days. The same deadline applies to deletion of stored YouTube Data following deletion of your Mochi account.

Deleting data held by Mochi does not delete your YouTube channel, videos or other information stored by YouTube.

What happens to existing tracking links

Disconnecting does not automatically restore the original links in your video descriptions.

Tracking links may remain active where they can operate without retaining YouTube Data. Active links may continue to redirect visitors and record click data as described in this Policy. This does not extend the retention periods for YouTube Data stated above.

You can remove or replace links directly in your YouTube video descriptions. To request that a tracking link be disabled or its associated data deleted, contact hey@themochi.app.

How to revoke access

You can disconnect a channel at any time under:

Dashboard → Links → YouTube

You can also remove Mochi’s access through your Google account connections page or Google security permissions page.

Limited Use

Mochi’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Voice Messaging and Cloning

Authorized Users, such as appointment setters and closers, may send voice messages to prospects and leads on behalf of coaches. These messages may use a voice model pre-approved by the coach with explicit consent.

• Voice cloning is used solely for business communication purposes.

• Audio messages are delivered only through supported messaging APIs, such as Instagram.

• Voice Data is not used for advertising, profiling or resale.

• Coaches may withdraw consent at any time, triggering deletion of their Voice Data.

9. Data Subject Rights

Subject to applicable laws, individuals whose Personal Data we process may have the right to:

• Request access to their Personal Data.

• Request correction or deletion of their Personal Data.

• Restrict or object to Processing.

• Exercise data portability rights.

• Withdraw consent at any time.

• Lodge a complaint with a competent data protection authority.

Requests may be submitted to hey@themochi.app and will be addressed within applicable statutory timeframes.

Requests concerning YouTube Data are also subject to the deletion deadlines in section 7.2.

10. Children’s Privacy

The Services are not directed at children under 13 years of age, or under 16 where applicable.

Mochi does not knowingly collect Personal Data from children below the applicable minimum age. If we learn that we have collected such data, we will promptly delete it.

11. Security Measures

We implement appropriate technical and organizational measures to protect Personal Data, including:

• Hosting on Google Cloud with encryption at rest.

• TLS/HTTPS encryption for data transmissions.

• Role-based access controls.

• Logging and monitoring of access to sensitive systems.

• Additional protection for integration authorization tokens, as described in section 7.2.

12. Third-Party Service Providers

Depending on the features you use, Mochi works with the following third-party service providers and platforms:

• Meta — Facebook and Instagram: account linking and messaging APIs.

• Google — YouTube API Services: authorized channel access, video metadata retrieval and video description updates.

• ElevenLabs: voice cloning and audio generation.

• Google Cloud and Firebase: infrastructure and storage.

• Google Analytics: usage analytics.

• Stripe: payment processing.

• Dub: short links and click tracking for links sent in direct messages and published in YouTube descriptions.

We do not sell or rent Personal Data to third parties.

Processing and transfers of information received through Google APIs remain subject to the restrictions in section 7.2.

13. International Data Transfers

Personal Data may be transferred to and stored in jurisdictions outside an individual’s country of residence, including the United States and countries in Europe.

We conduct these transfers in accordance with applicable data protection laws and use the safeguards those laws require.

14. Cookies and Tracking Technologies

We use cookies and similar technologies for functionality and analytics. We do not deploy third-party advertising cookies.

We also use link-tracking technologies to measure clicks on Mochi tracking links, including links published in YouTube descriptions. The information processed for these purposes is described in sections 3.4 and 7.2.

Users can manage cookies through their browser settings. Cookie settings may not prevent all processing associated with clicking a tracked link.

15. Policy Updates

Mochi may update this Policy periodically. We will communicate material changes and update the Effective Date.

If we propose to use information received through Google APIs in a new way or for a purpose not covered by the consent previously provided, we will notify affected Users and obtain any required consent before making that change.

16. Contact Information

For privacy inquiries or to exercise your data rights:

Mochi L.L.C-FZ
Email: hey@themochi.app
Website: themochi.app