Privacy policy for merchants

Who we are

"Moonbase", "we" and "us" mean Moonbase AS, a Norwegian company (registration number 931 730 258, Utsikten 6, 3718 Skien, Norway), and, for some sales in the United States, its subsidiary Moonbase LLC (30 N Gould St, STE R, Sheridan, WY 82801, United States).

You can reach us about anything in this policy at privacy@moonbase.sh.

Our role

Under data protection law, the "controller" decides why and how personal data is used. Moonbase is the controller of the personal data in this policy: your user account, your business's account with us, verification, and visits to our websites and apps. For your customers' data we have two roles, set out in our terms: we are the controller of what we need as the seller, such as orders and payments, and your processor for everything else, apart from a few purposes of our own, such as security and fraud prevention, that the Data Processing Addendum sets out.

Where your data comes from

Most of the data we process comes from you. The rest comes from:

• The business you work for, which may add you to its Moonbase account, or name you in its verification as someone who represents, owns or controls it.
• Our identity provider, which tells us the result of your identity check.
• Public sources, such as company and VAT registers and sanctions lists.
• Your device, which sends us your IP address, approximate location and browser details automatically when you use our services.

You need to give us the details asked for in verification for a business to be approved, and its payout details for it to be paid. Anything else is up to you.

Your account and your business

• Your user account: your name, email address, password (stored only as a hash), which accounts you can access, and when you were last active.
• Your business: its name, address, tax and VAT numbers, contact details, payout bank account, sales, fees and payouts, and the invoices we issue.
• Your agreement with us: which version of our terms was accepted, by whom, when, and from which IP address and approximate location.
• How you use our apps: the pages you visit and the actions you take, and error reports, so we can support you and improve the apps.
• Your conversations with us: support chats and emails.

We use this to provide our services and pay you (legal basis: our contract with your business, or with you if you sell as an individual, Article 6(1)(b), and otherwise our legitimate interest in serving the business you work for, Article 6(1)(f)), to keep the accounts and tax records the law requires (Article 6(1)(c)), to keep our services secure and prevent fraud, to improve our services, and to manage our customer relationships (Article 6(1)(f)).

We send you news about Moonbase's products and features by email, because you use our services. You can unsubscribe with the link in each email, or by contacting us, at any time.

If we verify you

Before a merchant can take real payments, and at times after that, we may verify it. If you sell as an individual, or represent, own 25% or more of, or control a business that does, we process:

• your name, date of birth, email address, role, share of ownership, and your home address if you sell as an individual;
• if you sell as an individual, your national tax number, which we store encrypted, and your VAT number;
• the result of an identity check, the name on your identity document, whether your date of birth matched it, and the document's type, issuing country and expiry date;
• documents you or the business send us, such as proof of address, bank statements and registration extracts; and
• our reviewers' notes, our decision, and a record of each time our staff opened a document.

The identity check is carried out by our identity provider, Stripe. It compares a photo of your identity document with a photo of your face taken at the time, which is biometric data. Stripe asks for your explicit consent before the check (GDPR Article 9(2)(a)) and keeps the images; we receive the result and the details listed above. Our reviewers also search public sanctions lists for your name.

We do this to know who we work with and pay, to prevent fraud, money laundering and breaches of sanctions, and to meet the requirements of our payment and banking partners (legal bases: complying with legal obligations, Article 6(1)(c), where a law requires it, and otherwise our legitimate interests, Article 6(1)(f)). If you do not take part, we cannot approve the business, or pay it.

If you visit our websites

When you visit moonbase.sh or our apps, our servers and our hosting provider record technical information such as your IP address, approximate location, browser, and the pages requested, to deliver the site, keep it secure and prevent abuse (Article 6(1)(f)). We keep these logs for up to 90 days. Cookies and similar technologies are described below.

If you contact us, book a call or download a report on moonbase.sh, we process the name, email address, company and message you give us, and the details of the call you book, to reply, hold the call and follow up on what you asked about (Article 6(1)(f)).

Automated decisions

We cannot accept businesses based in some countries, or businesses that mainly sell products we cannot support. If you tell us one of those when you sign up or apply, our system refuses the application automatically. Every other verification decision is made by a person. If you think an automatic refusal is wrong, contact us and a person will look at it.

Who we share data with

We do not sell personal data. We share it only as described in this policy:

• Payment and banking partners: Stripe (identity checks in verification), Wise (payouts) and the banks involved in a payout.
• Service providers that work for us under contract: Amazon Web Services (hosting, storage and email sending), Vercel (hosting moonbase.sh), Google (data warehouse, address autocomplete, bot protection on sign-up, and fonts), Cloudflare (bot protection on our contact form), Cal.com (booking calls with us), Tinybird (analytics), Sentry (error monitoring), PostHog (product analytics in our apps and on moonbase.sh), Featurebase (support inbox, chat and help centre), Attio (customer relationship management), Mailchimp (our emails to merchants), Slack (internal notifications to our staff about merchant accounts), and Tripletex (accounting).
• Moonbase AS and Moonbase LLC, between themselves.
• Authorities, courts, auditors and advisers, where the law requires it or to establish or defend legal claims.
• A buyer of our business, if all or part of Moonbase is sold or merged, under this policy.

Where your data is processed

We store our data with Amazon Web Services in the EU (Ireland), and our data warehouse with Google in the EU (Belgium). Some of our service providers, such as Stripe, Google, Vercel, Cal.com, Mailchimp and Slack, are based in the United States or process data there. When personal data leaves the European Economic Area, we rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or on the European Commission's standard contractual clauses. Contact us for a copy of the safeguards.

How long we keep data

We may keep data longer where we need it for a legal claim, an investigation or a dispute that is still open.

How we protect data

Data is encrypted in transit and at rest, access to it is limited to the staff who need it, changes to it are recorded, passwords are stored only as hashes, and the most sensitive identifiers are encrypted with separately managed keys. No system is perfectly secure; if a breach puts you at high risk, we will tell you.

Your rights

You have the right to:

• get a copy of the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data deleted, where we no longer need it or have no other legal basis to keep it;
• restrict our use of your data, or object to it, where we rely on our legitimate interests;
• receive data you gave us in a portable format, or have it sent to someone else;
• withdraw a consent you have given, at any time, without affecting what was done before; and
• ask a person to review an automated decision.

Write to privacy@moonbase.sh. We answer within one month, free of charge, and may ask you to confirm your identity first. We cannot delete the records the law requires us to keep, such as invoices and the records of payouts.

You can complain to the Norwegian Data Protection Authority (Datatilsynet, www.datatilsynet.no), or to the data protection authority where you live or work. We would appreciate the chance to deal with your concern first.

Cookies and similar technologies

Cookies and browser storage let a site remember things between pages and visits. We use:

• Sign-in: a cookie that keeps you signed in to our apps for up to 14 days after your last visit. This is needed for the service you ask for.
• Preferences: browser storage that remembers choices such as a dismissed message or a display setting.
• Error monitoring: Sentry records errors and how fast pages load, and, in visits where something goes wrong, a replay of the page with all text and images hidden, so we can fix problems. Error reports include your name and email address. It does not set cookies.
• Analytics in our apps and on moonbase.sh: PostHog uses a cookie and browser storage to understand how our apps and website are used. We use it only with your consent where the law requires it.
• Third-party features: Google Maps, to complete addresses as you type; Google reCAPTCHA on sign-up and Cloudflare Turnstile on our contact form, to tell people from bots; Google Fonts; Gravatar profile pictures; the support chat and help centre of Featurebase; and, on moonbase.sh, the Cal.com booking calendar, images and live content updates from Sanity, our status badge from Better Stack, and YouTube videos in some articles. Each can receive your IP address and may set its own cookies.
• Where you came from: on moonbase.sh, a cookie that remembers the source that brought you to us, such as a campaign or partner, so we know where sign-ups come from.

You can block or delete cookies in your browser, but signing in may then stop working.

If you live in the United States

We do not sell personal information, and we do not share it for cross-context behavioral advertising. Depending on the state you live in, you may have the right to know what personal information we collect and how we use it, and to access, correct or delete it. Write to privacy@moonbase.sh to use these rights; we will not treat you differently for doing so.

Children

Our services are not directed at children under 16, and everyone we verify must be at least 18.

Changes to this policy

We update this policy when what we do changes, and show the date of the latest version at the top. If a change matters to you, we will also tell you by email before it applies.