GDPR Compliance

1. Our Commitment

Moffu is committed to complying with the General Data Protection Regulation (GDPR) for users in the European Economic Area (EEA) and the United Kingdom. This page explains your rights and how we handle your personal data under GDPR.

2. Data Controller

Moffu acts as the data controller for personal data you provide when creating an account and using the platform. For data processed on behalf of your customers (such as Google review content), Moffu acts as a data processor under your instructions.

3. Legal Basis for Processing

We process your personal data on the following legal bases:

• Contract performance — to provide the Moffu service you have subscribed to
• Legitimate interests — to improve the platform, prevent fraud, and ensure security
• Legal obligation — to comply with applicable laws and regulations
• Consent — for optional communications such as marketing emails (you may withdraw at any time)

4. Your Rights Under GDPR

If you are located in the EEA or UK, you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your personal data ("right to be forgotten")
• Right to restriction — request that we limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Rights related to automated decision-making — not to be subject to solely automated decisions that significantly affect you

To exercise any of these rights, contact us at privacy@moffu.com. We will respond within 30 days.

5. Data Transfers

Moffu uses infrastructure providers (including Supabase and Vercel) that may process data in countries outside the EEA. Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service. Upon account deletion, we will delete or anonymise your personal data within 90 days, unless we are required to retain it by law.

7. Supervisory Authority

You have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not complied with GDPR. In the UK, this is the Information Commissioner's Office (ICO).

8. Contact

For GDPR-related enquiries, contact our data protection team at privacy@moffu.com.