Privacy Notice

Contact details

MOOCHA APP LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
Email: privacy@moocha-app.com

What information we collect, use, and why

To provide our service:

• Contact details (email address)
• Account information (username, password, profile picture, bio)
• The content you post (photographs, videos, captions, garment information)
• How you use the website, including cookie tracking

For the operation and security of user accounts:

• Registration details and a record of your acceptance of our terms
• Technical security information (session tokens, IP address)

For dealing with queries, complaints or claims:

• Contact details and account information
• Content relevant to a reported post

For platform administration and accountability:

• Records of administrative and moderation actions

For website analytics (Google Analytics):

• How you use the website (pages visited and IP address)

For aggregate site statistics (Vercel Web Analytics):

• Anonymous, cookie-free page-view counts (page visited, referrer, country, device type) that cannot identify you

From people who express interest in joining Moocha (waitlist, creator, and brand sign-up forms):

• Contact details, social handles, and the other information you enter in the form, with a record of your consent

If you have a creator or brand account, additional processing applies — see our Creator & Brand Privacy Notice.

Lawful bases and data protection rights

Under UK data protection law, we must have a lawful basis for collecting and using your personal information. Your rights:

• Right of access — you can ask us for copies of your personal information, including details about where we get it from and who we share it with.
• Right to rectification — you can ask us to correct or delete personal information you think is inaccurate or incomplete.
• Right to erasure — you can ask us to delete your personal information. You can also delete your account directly from the Settings page, which immediately and permanently deletes your account, profile, posts, and media. A small number of records are retained or take longer to clear — see "What happens when you close your account" below.
• Right to restriction of processing — you can ask us to limit how we use your personal information.
• Right to object to processing — you can object to us processing your personal information in certain circumstances.
• Right to data portability — you can ask us to transfer your personal information to another organisation or to you directly.
• Right to withdraw consent — where we rely on consent as our lawful basis, you can withdraw it at any time without affecting the lawfulness of prior processing.

We must respond to any request within one month. To make a request, contact us using the details at the top of this notice with the subject line [PRIVACY REQUEST].

You can also exercise your data subject rights via our Trust Center: https://app.prighter.com/portal/19933741352

Our lawful bases

• For providing our service: Contract — we need this information to enter into or carry out our contract with you.
• For the operation and security of user accounts: Contract — we need this information to enter into or carry out our contract with you.
• For dealing with queries, complaints or claims: Contract and Legitimate interests — we retain records of content reports to investigate abuse, protect users from harmful content, and maintain a safe platform.
• For records of terms acceptance and administrative actions: Legitimate interests — evidencing that our terms were accepted, and keeping administrative actions accountable.
• For promoting Moocha: Legitimate interests — we may feature content posted on the platform in our marketing materials and social channels.
• For website analytics (Google Analytics): Consent — no analytics cookies are set and no analytics measurement takes place unless you accept via our cookie banner. You can withdraw consent at any time using the "Manage cookies" link in the footer of our homepage or in Settings — the banner will reappear so you can choose again.
• For aggregate site statistics (Vercel Web Analytics): Legitimate interests — anonymous, cookie-free page-view counts. Nothing is stored on your device and the data cannot identify you, so no consent is required.
• For waitlist, creator, and brand sign-up forms: Consent — we collect this information only after you have given your explicit consent by ticking the checkbox on the relevant form. You can withdraw consent and request deletion of your data at any time by contacting us at privacy@moocha-app.com.

Cookies

We use cookies to operate our service and, with your consent, to analyse how it is used.

Strictly necessary cookies cannot be disabled as they are required for the service to function. Analytics cookies are set only if you accept via our cookie banner. To change your choice at any time, use the "Manage cookies" link in the footer of our homepage or in Settings — the banner will reappear so you can choose again.

Where we get personal information from

Directly from you. For creator and brand accounts, see also our Creator & Brand Privacy Notice.

How long we keep information

• Account data (email, username, password, profile): deleted immediately when you close your account
• Posts, photos, videos, captions: deleted when you close your account
• Terms acceptance records: kept for the life of your account
• Report records: retained for 3 years, with your identity removed on account deletion
• Admin audit log: retained for 3 years, then deleted automatically
• Session cookies: deleted when your session ends
• Google Analytics data: 2 months
• Vercel Web Analytics: aggregated statistics kept for 12 months; the anonymous visitor identifier is discarded within 24 hours
• Email delivery logs: retained by Resend per their data retention policy
• Server logs (IP address): 30 days (retained by Vercel)
• Supabase platform logs (IP address): 7 days (retained by Supabase)
• Encrypted database backups: created daily and kept for 7 days, with older backups deleted automatically
• Waitlist data: retained until you are invited to the platform or withdraw consent
• Creator and brand form data: retained until you are contacted and invited, or withdraw consent

What happens when you close your account

Closing your account immediately deletes your profile, posts, photos, and videos. A few things are retained or take slightly longer:

• Residual copies in our daily encrypted backups are deleted automatically within 7 days
• Report records are kept for 3 years with your identity removed
• Garment information you submitted to the catalogue is kept, with your identity removed
• Colour swatches derived from posts for the garment catalogue are kept (they do not identify you)
• Admin audit log entries referencing your account ID are kept for accountability (up to 3 years)
• For creator and brand accounts, see our Creator & Brand Privacy Notice

Who we share information with

Data processors — organisations that process personal data on our behalf:

• Supabase — provides our database, user authentication, and file storage
• Google (Google Analytics 4) — provides website analytics
• Resend — provides transactional email delivery
• Vercel — provides website hosting, infrastructure, and cookie-free aggregate site statistics

We may also share information with relevant regulatory authorities (such as the ICO) where required by law. We do not sell your personal data. We do not share your data with advertisers.

Sharing information outside the UK

Where necessary, we transfer personal information outside the UK. When doing so, we comply with UK GDPR, ensuring appropriate safeguards are in place.

EU/EEA Representative

We have appointed Prighter Group with its local partners as our privacy representative and your point of contact for the European Union (EU). To exercise your privacy-related rights, visit: https://app.prighter.com/portal/19933741352

DSA Representative

MOOCHA APP LTD has designated Prighter DSA as its legal representative according to Art 13 Digital Service Act (DSA). Prighter DSA serves as the addressee for competent authorities in the Member States and in the European Union on all matters related to the DSA.

Security

We take appropriate technical measures to protect your personal data, including encryption in transit and at rest, access controls, row-level security, and daily encrypted backups. No system is completely secure. If we become aware of a data breach that affects your rights, we will notify you and the relevant supervisory authority as required by law.

Children

Our service is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with their data, please contact us and we will delete it.

How to complain

If you have concerns about how we use your personal data, contact us using the details at the top of this notice. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome. If you remain unhappy after raising a complaint with us, you can complain to the ICO:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint

If you are based in the EU/EEA, you can also complain to your local data protection authority or contact our EU representative Prighter using the details above.