Privacy Policy

1. Overview

This Privacy Policy explains how Spatial Regal Digital Ltd ("Spatial Regal", "MoonKart", "we", "us") collects, uses, shares, and protects information when you use moonkart.online, the MoonKart platform, our site builder, AI features, storefronts, APIs, and related services (collectively, the "Services").

MoonKart is a multi-tenant platform: merchants build stores and websites on MoonKart, and their customers visit storefronts powered by MoonKart. This Policy covers both roles. Where we process data purely on a merchant's instructions (for example, their customers' order records), the merchant is the data controller and their own privacy terms also apply.

2. Information we collect

• Account data — name, email address, password hash, organization membership, role, and authentication metadata.
• Profile and workspace data — store names, domains, theme settings, pages, products, media, and content you create in the builder.
• Transaction data — orders, carts, discounts, shipping addresses, and payment status. Full card numbers never touch MoonKart servers; they are tokenized by our payment processors.
• Usage data — pages visited, features used, device and browser information, IP address, approximate location, referrers, and timestamps.
• AI input — text and voice instructions you submit to MoonAI, plus the prompts and context required to generate responses.
• Communications — support tickets, feedback, survey responses, and emails you send us.

3. How we use information

• Provide, operate, and improve the Services, including the visual builder, commerce features, and analytics.
• Authenticate you, prevent fraud, enforce limits, and keep accounts secure.
• Run AI features: your instructions are processed to generate pages, copy, and code. We do not use your private content to train third-party foundation models.
• Send transactional messages (sign-in, password resets, order updates) and, with your consent, product news.
• Comply with law, respond to lawful requests, and enforce our Terms.
• Aggregate de-identified statistics to understand platform performance.

4. Legal bases (EEA/UK users)

We process personal data under: performance of a contract (providing the Services you signed up for); legitimate interests (securing the platform, improving features, direct marketing); consent (optional cookies, marketing emails); and legal obligation (tax, accounting, lawful orders).

5. Payments

Payments are handled by PCI-DSS compliant processors. MoonKart stores a tokenized reference and limited metadata (last four digits, brand, expiry) — never the full card number, CVV, or magnetic data. Merchant payouts are managed by the processor's connected-account facilities.

6. Sharing and disclosure

• Infrastructure and service providers — vetted hosting, content delivery, object storage, database, and authentication providers, and their sub-processors, each bound by data-processing agreements.
• Payment processors — to authorize charges and payouts.
• Analytics and error monitoring — in aggregated or pseudonymous form, to keep the platform fast and reliable.
• Merchants — when you shop at a merchant's storefront, that merchant receives your order details to fulfil it.
• Legal and safety — when required by law, or to protect users, merchants, and the public from harm.
• Business transfers — as part of a merger, acquisition, or asset sale, with notice to you.

We never sell your personal data.

7. Data retention

We keep account data while your account is active and for up to 90 days after closure, then delete or irreversibly anonymize it unless a longer period is required by law. Backups rotate on a rolling 35-day schedule. Merchants control retention of their storefront records through export and deletion tools.

8. Security

• Encryption in transit (TLS 1.3) and at rest for databases and object storage.
• Row-level permissions that isolate every organization's data at the query layer.
• Role-based access control, audit logging, and least-privilege staff access.
• Rate limiting, bot protection, and continuous edge monitoring across the MoonKart network.
• Prompt incident response — we notify affected users and regulators where legally required.

9. Your rights

Depending on your location, you may have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. Use the in-app data export, the account deletion flow, or email privacy@moonkart.online. You may withdraw consent at any time and may lodge a complaint with your supervisory authority.

10. International transfers

Data may be processed in countries other than your own. Where we transfer EEA/UK personal data internationally, we rely on Standard Contractual Clauses and equivalent safeguards with our processors.

11. Children

The Services are not directed to children under 16, and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

12. Changes and contact

We will post any changes here and, for material changes, notify you by email or in-product notice before they take effect. Questions? Write to privacy@moonkart.online or legal@moonkart.online.