Privacy Policy

Effective date: [pending owner approval]

This Privacy Policy explains what information the Moxy Business Solutions customer site (moxybusinesssolutions.com, "the hub") collects, why, who helps us handle it, how long we keep it, and how to ask us to see or delete it.

Who we are. Moxy Business Solutions and Moxy Web Studio are trade names of Moxy Solutions, a sole proprietorship in North Carolina. [CONFIRM: entity wording, and whether the Moxy Business Solutions DBA filing is complete]

Moxy Solutions
#2044, 207 W Millbrook Road, Suite 210, Raleigh, NC 27609
hello@moxywebstudio.com · (984) 205-9904

This policy covers the hub and the tools it runs. Our website-building service at moxywebstudio.com has its own Privacy Notice, which still applies to your website order.

1. Two kinds of people, two roles

Our customers are the businesses that sign up with us and the people who sign in to the hub for them. For their information, we decide how it is used, as described here.

Our customers' visitors and customers are the people who use a tool on a business's website (for example, a photo quote form or the chat box), or who get a review-request email from a business. For their information, we act as a service provider to that business: we collect, store and deliver it only to run the tool for that business and to keep the service working and safe. The business decides what to ask for and what to do with what it receives, and its own privacy policy applies to how it uses that information. If you are a visitor and want your information deleted, you can ask the business or ask us (see section 9).

2. Information we collect

From business customers

• Account details: your email address, name, business name, account number, and the website address on your account.
• Sign-in records: a one-time sign-in code (we store only a scrambled version of it, and it works for 15 minutes) and a session record so you stay signed in for up to 30 days. Your browser keeps one sign-in cookie; we store only a scrambled version of its value.
• Billing records: your plan, payment status, invoices and related records. Card details are entered on Stripe's secure form and are not stored on our servers.
• Requests you send us: change requests, support tickets, and anything you write in them.
• AI chat: the messages you send in the "Ask us" chat in the hub and the replies, plus usage records (date, time, number of messages, which AI model answered, and the size of each request). See section 4.
• Tool settings and content: for example, which tools are on, the email address that should get notifications, your Google review link, price rules for the quote calculator, key-drop instructions, and photos and captions you upload to the before-and-after gallery.
• Customer lists you give us: names and email addresses of your customers, if you use review requests.

From visitors to a business's website (through the tools)

The one line of code a business adds to its website loads only the tools that business has turned on. Depending on the tool, a visitor may send:

• Photo quote requests: name, phone, email, a message, and up to 5 photos.
• After-hours drop-off form: name, phone, email, vehicle details (such as make, model, plate and mileage), what's wrong, where the keys were left, whether the shop may start diagnostics, the drop-off time, and up to 3 photos.
• Quote calculator: the answers to the calculator's questions and, if the visitor chooses to send the estimate, their name, phone, email, area or address, and preferred date.
• Chat box (only on sites where it is switched on): the messages typed and the replies, and any name, contact details and message the visitor leaves for the business.
• Before-and-after gallery: visitors only view photos; nothing is collected from them by the gallery.

With every form submission we also record the date and time, the web page it was sent from, and the visitor's IP address, which we use to limit abuse and spam. [CONFIRM: we store the IP address as-is today; decide whether to hash it, as our outreach tracking already does, or keep it for a set period]

Photos. We remove location (GPS) data from photos sent through the photo quote and drop-off forms. Gallery photos uploaded by a business have all hidden photo data (metadata) removed, including location, and are resized for the web.

Cookies and tracking on business websites. The tools on a business's website set no cookies and include no advertising or analytics tracking. The chat box keeps a random conversation number in the browser tab so the conversation can continue while the page is open.

From people who get a review-request email

When a business uses review requests, we receive the customer's name and email address from that business. We record whether the email was sent, whether the person opened the review page (not the email itself), whether they clicked the Google review button, any private note they chose to send the business through that page (with its date, time and IP address), and unsubscribe requests.

3. How we use information

We use information to:

• sign you in and keep your account secure;
• run the tools you turn on and deliver what visitors send to the right business;
• send the emails the service needs (sign-in codes, notifications to businesses, review requests the business asked us to send);
• handle billing, change requests and support;
• answer questions in the AI chat and pass questions to a person when needed;
• check whether the one line of code is installed on your website (we visit the website address on your account and look for it);
• prevent spam, fraud and abuse, and keep the service running; and
• keep business, tax and accounting records.

We do not sell personal information, and we do not use visitors' or review recipients' information for our own marketing or advertising.

4. The AI chat

The hub's "Ask us" chat, and the chat box on websites where it is switched on, are answered by an AI model. Messages are sent to Anthropic (Claude) and, if Anthropic does not answer, to OpenAI as a backup, through their business APIs. The AI sees the conversation and the account details it needs to help (such as your business name, plan and billing status, open change requests, and which tools are on). It does not see card details.

We keep chat transcripts and usage records so we can follow up on requests, fix problems and show you a monthly summary (for example, how many chats were answered and how many were passed to the team). When the AI hands a question to a person, we create a support ticket and send a short alert to our team's phones.

[CONFIRM: Anthropic and OpenAI API data terms (retention, no training on API data) to be checked and summarized here]

5. Instagram (Meta) data: Instagram portfolio tool

*This section applies only if you choose to connect Instagram. The Instagram portfolio tool is not available yet; this section describes how it will work when it launches.*

If you choose to connect your business's Instagram professional account to show your recent posts on your website, you sign in with Instagram and approve access. We then receive, through Meta's official Instagram API: your Instagram username and account ID, and your recent posts' captions, photos and videos (links to them), post type, date, and link. We use this only to show your own recent posts on your website and in your account on this site. We do not read your messages, comments, followers or insights, we do not post on your behalf, and we do not use this data for advertising, sell it, or share it with anyone except as needed to host your website.

We store your Instagram access token encrypted, and we refresh it automatically so your feed keeps working. We keep a short cache of your recent posts so your website loads quickly. Posts you delete on Instagram disappear from your site at the next refresh (normally within an hour).

Disconnecting and deletion. You can disconnect Instagram at any time in your account (Tools, then Instagram portfolio, then Disconnect), or remove our app in Instagram (Settings, then Website permissions or Apps and websites). Either way, we delete your access token and cached posts within 24 hours. You can also email hello@moxywebstudio.com to ask for deletion. If Meta sends us a deletion request on your behalf, we delete the data and give you a confirmation code you can check at moxybusinesssolutions.com/meta/deletion-status. Full steps are on our Data deletion page. Your use of Instagram is also covered by Meta's own terms and privacy policy.

6. Who helps us (service providers)

We share information only with companies that help us run the service, and only what each one needs:

• Stripe: payments and billing.
• Resend: sending email (sign-in codes, notifications, review requests).
• Anthropic and OpenAI: answering the AI chat (see section 4).
• Pushover: short alerts to our own team's phones when a request needs a person.
• Google: when you use review requests, the review button sends your customer to your business's Google review page. We do not send Google any personal information; your customer deals with Google directly from there. [CONFIRM: the hub itself loads no Google fonts, maps or analytics; the business's Google place ID comes from our Web Studio records]
• Meta Platforms (Instagram API): only if you connect Instagram (see section 5).
• Hosting, backup and security providers that run our servers and keep backups. [CONFIRM: name the hosting provider and the off-site backup provider]
• Advisers and authorities: our accountants or lawyers when needed, and authorities when the law requires it or to protect people, our customers or the service.

7. How long we keep information

• Account, billing and support records: while your account is open, and afterwards for as long as we need them for tax, accounting and dispute records. [CONFIRM: a set number of years]
• Sign-in codes: until used or 15 minutes, whichever comes first. Sessions: up to 30 days, or until you sign out.
• Tool submissions and photos (photo quotes, drop-offs, quote requests, messages left in the chat box): while the business's account is open, or until the business or the person asks us to delete them. [CONFIRM: there is no automatic deletion yet; set a period, for example 12 months, and build it]
• Chat transcripts and usage records: while the account is open. [CONFIRM: set a period]
• Review-request records: while the account is open. Unsubscribe and bounce records are kept so we never email that address again for that business.
• Gallery photos: until the business deletes them or closes its account.
• Instagram data: see section 5.

When a business closes its account, we delete its tool data and photos within 30 days unless the law requires us to keep something. [CONFIRM: 30 days, and the process to do it]

8. Security

We protect information with reasonable safeguards for a small business: encrypted connections (HTTPS), sign-in by one-time email code (no passwords to steal), scrambled storage of codes and session tokens, a form check on every change, photos sent through the forms shown only to the signed-in account they belong to, and limited access to our servers. No internet service is perfectly secure. Please do not send card numbers, passwords, government ID numbers, health details or other sensitive information through the hub, the chat or the tools.

9. Your choices: seeing, fixing or deleting information

• Business customers can ask us to see, correct, export or delete their information by emailing hello@moxywebstudio.com or calling (984) 205-9904. Some records (for example, billing and tax records) we must keep for a time.
• Visitors and review recipients can ask the business they dealt with, or email us. We will tell the business and delete the information unless the business or the law needs us to keep it. Every review-request email has an unsubscribe link that works right away.
• Instagram: see section 5 and the Data deletion page.

We will answer within 30 days. [CONFIRM: response time]

10. Children

The hub and its tools are for businesses and their adult customers. They are not meant for children under 13, and we do not knowingly collect information from them. If you think a child has sent us information, contact us and we will delete it.

11. Where this applies

We are based in North Carolina and serve businesses in the United States. Information is stored and handled in the United States. [CONFIRM: server and provider locations; state privacy laws (most do not apply to a business our size, but check)]

12. Changes to this policy

We may update this policy. The date at the top shows when it last changed. If a change is important, we will tell business customers by email or in the hub before it takes effect.

13. Contact

Moxy Solutions (Moxy Business Solutions)
#2044, 207 W Millbrook Road, Suite 210, Raleigh, NC 27609
hello@moxywebstudio.com · (984) 205-9904