Privacy policy.

1. Data controller

2. Data collected

We collect the following categories of data, in line with the data minimization principle (GDPR art. 5.1.c):

Moon CLI, Moon Desktop, Code and mobile apps

What Moon CLI, Moon Desktop and the Code page process, and what they keep on your computer, is described in article 4 septies; the mobile apps, notifications and in-app purchases, in article 4 nonies.

Data processed by the developer API (api.realmoon.ai)

The developer API (documentation: /docs/api) follows a strict rule of not retaining content:

• No storage of request content. Prompts and responses sent to the API are neither kept nor logged, and no conversation record is created for an API call. Responses carry the header X-Moon-Prompt-Storage: none.
• Moon Blur before sending to the model. Masking of the sensitive data Moon Blur detects (email addresses, IBANs, social security numbers, SIREN numbers, etc.) is applied before the request leaves Moon AI for the inference provider, unless you turn it off for a key, then the values are restored in the response returned to the caller (see section 4). Files, images and audio sent to the API go as they are.
• Billing metadata only. For billing and abuse prevention, we keep metadata without the content, per workspace: model, number of tokens, cost, processing time, request identifier and timestamp. No IP address is recorded for an API call. These per-request rows are currently kept with no time limit; a total per day, per workspace and per model (amount consumed, number of requests and tokens), with no request identifier, is also kept. Accounting entries (top-ups, invoices) follow the statutory retention periods (see section 6).
• Upstream inference providers. API requests pass through OpenRouter and the provider of the chosen model, or through our compute server for the models we run ourselves, which receive them (with the detected sensitive data masked by Moon Blur) under their own policies (see the subprocessors section). For this reason, the API is not presented as “Zero Data Retention” or as “100% processed in France”.

3. Purposes and legal bases of processing

4. Moon Blur: AI data protection

Moon AI includes Moon Blur, a proprietary reversible masking system that automatically spots and replaces the personal data it detects in the text of your messages, before it is sent to third-party AI models.

1. 1

   Detection

   Spotting of more than 150 categories of personal data and secrets (email address, phone number, IBAN, social security number, API keys…) in the text of your messages and documents

2. 2

   Reversible replacement

   Replacement with placeholders ([EMAIL_1], [PHONE_1], etc.) that allow the real values to be put back in the response

3. 3

   Encrypted sending to the model

   Encrypted transmission (TLS) of the masked message to the model you chose, or that Moon Auto chose

4. 4

   Restoration

   The real values are put back in the response, on our servers, before it is shown to you.

4 bis. Personalized memory (if you turn it on)

Moon AI can remember short notes about you (your response preferences, your job, your ongoing projects) to personalize your later conversations, and find what you talked about in your previous conversations. These features are off by default and only turn on with your consent, which you can withdraw at any time in Settings, Personalization.

Only the messages you write after giving your consent are analyzed, never your files, the web pages you viewed or tool results. The analysis is done by the background-task AI model (see subprocessors), after masking by Moon Blur. Moon AI never automatically remembers your health data, political opinions, religious beliefs, sexual orientation or other sensitive data, nor your passwords, card numbers or ID numbers. Sensitive information is only remembered if you expressly ask for it and confirm.

Your memories are personal: they are visible only to you, in the workspace where they were created, never to other members or to the workspace administrators. Each memory shows the conversation it comes from; you can edit or delete it, or erase everything. Deleting a conversation does not delete the memories drawn from it: delete them in Settings. Confidential Chats neither use nor create any memories.

Legal basis: your consent for automatic memory and for searching your past conversations; performance of the service for the memories you add yourself; your explicit consent for sensitive information remembered at your request.

4 ter. Pages published through a public link

From an artifact’s panel (web page, small app, document, SVG image or code), you can publish it: it becomes readable, without an account, by anyone who has the link, on the pages.realmoon.ai site. Only a frozen copy of the artifact is published, never the conversation; it only changes if you update it. Moon AI adds neither your name nor your email address to the page. We ask search engines not to index it, but anyone who has the link can pass it on.

Before publication, Moon AI spots in the page the personal data it recognizes (email address, phone number, IBAN…) and asks you to confirm. This check is done on our servers by the Moon Blur analyzer, without sending anything to an AI model; it does not read text contained in images. If you allow copying, a person signed in to Moon AI can copy the page to their own account: that copy stays with them if you later remove the page.

The published pages site does not sign you in to any account and sets no Moon AI cookie. A published page, like an artifact shown in the app, can load fonts or libraries from public services (Google Fonts, Cloudflare’s cdnjs, cdn.tailwindcss.com): your browser then sends them your IP address. To count views, a hash of your IP address (an IPv6 address counts per /64 block) and of the page, computed with a secret key, is kept for 10 minutes, then erased; only the number of views is kept. Any visitor can report a page, without an account (“⋯” menu, Report): we keep the reason chosen, the optional details (500 characters at most; do not write personal data there) and the date. Your IP address is not recorded with the report: only a hash computed with a secret key is used to limit the number of reports and to count only one per address and per page.

Our moderation team sees the reports and the reported page. After several distinct reports, the page is hidden while it is reviewed. A page hidden or removed by moderation is hidden or removed with a reason that its author sees in their settings; its content remains stored, without being public, until the author stops publishing it or deletes the conversation.

You can stop publishing at any time in Settings, Data and privacy, Published pages: the link stops working and the published copy is erased immediately. The page is also removed when you delete the conversation, your account or the workspace, when you leave the workspace from which you published it, or when a rule of your organization forbids public sharing. A record of the page without its content (address, dates, number of views and reports) and the reports received are kept for 90 days after removal, then deleted (sooner if you delete the conversation, your account or the workspace). If a published page concerns you, report it from the page or write to contact@stellarrstudio.com.

Legal basis: performance of the service, at your request, for publication; our legitimate interest (platform security, handling of reports of illegal content) for the view counter, reports and moderation.

4 quater. Locked conversations

You can lock a conversation from its “⋯” menu: it leaves your history and your search, and only opens with a personal 6-digit code or a passkey (Face ID, Touch ID, Windows Hello). This is not encryption: the conversation stays stored like the others and readable by our systems; the lock protects against someone who would use your unlocked device.

Your code is never stored in clear text: we only keep a hash (bcrypt, computed with a secret server key) and the list of passkeys allowed to unlock. Attempts are counted: after 5 errors in 15 minutes, unlocking is blocked for 15 minutes; these counters, tied to your account and to a hash of your IP address, clear themselves after 15 minutes. If you forget your code and your account has no password, a reset code is sent to you by email; we only keep a hash of it, for 15 minutes at most.

Creating, changing and resetting the code, locking, removing the lock and blocking after too many attempts are recorded in your account’s security log (with the IP address and browser, kept for 2 years), never in your workspace’s log. We send you an email, with the IP address of the request, when a passkey is added to your account and when your code is changed or reset.

A locked conversation does not feed personalized memory: memories already drawn from that conversation are deleted, even if you unlock it later. Locking it removes its shares (share link, team sharing, published pages). Your data export only contains it if your locked conversations are open (code entered) at the time of the export; otherwise, it only shows how many there are. Legal basis: performance of the service, at your request; our legitimate interest (security of your account) for the log and alerts.

4 quinquies. Moon AI for Chrome (browser extension)

Moon AI for Chrome is Moon AI’s extension for Google Chrome; it also works in Microsoft Edge. It shows Moon, Moon AI’s assistant, in the browser’s side panel. With your Moon AI account, Moon answers your questions about the tabs you share with it and, when you ask it to and if this feature is open to your account, acts in the tabs you hand over to it: it clicks, types text or opens a page, after your approval on a card before each action that changes something on the page or opens an address. This section describes what is specific to the extension; the rest of this policy also applies. Its user guide is in the Moon AI for Chrome documentation.

What the extension reads, and when

The extension only reads a tab after you act. To share it, you click its icon (or Alt+Shift+M) while you are on that tab, then “Share this tab”, and you confirm in the card that appears. To hand it over to Moon, you click “Let Moon act on this tab” and accept the site card: the tab joins the “Moon” tab group, which Moon reads during the tasks you ask it to do, on the sites you have allowed. The extension does not read your other tabs or your browsing history.

On a page you share or hand over to Moon, the extension reads:

• the visible text of the page and its structure (headings, links, tables, buttons, fields and their names), its title and its address, without its parameters;
• the text you have selected on it, if it is visible;
• the text of a document being edited in an online editor (word processor, wiki…), handled like the rest of the page;
• screenshots of the visible part of the tab, when the chosen model reads images (see below);
• on a site on your computer or your local network, if Moon needs them during a task, the page’s console messages.

It never reads the value of form fields, passwords included. Some pages are never read: browser pages, files opened from your computer, extension stores, password vaults known to the extension and Moon AI’s pages. Sensitive sites on its list (banking, health, government, messaging, accounts, online documents and calendars) ask for your approval at each share and before each action.

What Moon does in your tabs

When you ask it for a task, Moon can click, type text, choose from a list, check a box, press a key, scroll the page, open a page, go back, open or close a tab in its group and answer a dialog box, only in the tabs of its “Moon” group and on the sites you have allowed. Each new site asks for your approval on a card (“For this conversation” or “Always on this site”), then, the first time, Chrome’s approval. Before each action that changes something on the page or opens an address (click, typing, choice from a list, checkbox, Enter, opening a page), a card shows it to you in the panel: what will be clicked, the full text that will be typed, the full address that will be opened, with a thumbnail of the page that stays on your computer. Moon waits for you to click “Allow”. Scrolling the page, hovering over an element, pressing Tab or an arrow key outside a choice list, going back, reloading the page and waiting do not require a card.

Moon refuses the actions it recognizes as a payment, an order, a subscription, a donation, a financial instruction, creating an account, signing in, a CAPTCHA, downloading a program, or entering a password, a code, a bank card, an IBAN, a social security number or an official identifier, and hands control back to you (“Your turn”). It recognizes them from what the page shows: any other click goes through your approval on a card. Submitting a form, publishing, deleting, accepting terms or a dialog box, granting a permission and carrying data read on one page over to another page always require a card.

To act, the extension uses Chrome’s debugging tool, attached only to the tabs of the “Moon” group during a task; Chrome then shows its own banner, “… started debugging this browser”. This limit to the group and to the allowed sites is a rule of the extension: the permission to debug applies to the whole browser, hence Chrome’s warning at installation. During a task, the extension examines, on your computer, the navigations and submissions of these tabs to hold back what you have not allowed, and it does not download files. On the sites you have allowed, it adds a small script that receives your click on “Stop” and your Esc key before the page does, when it can; it reads nothing from the page.

“Stop” in the panel and Alt+Shift+X stop Moon at any time; so do the “Stop” button of the page banner and the Esc key, unless the page intercepts them. Closing Chrome’s banner also stops Moon. An outline around the tab, Moon’s cursor and a banner on the page show when it is acting.

Screenshots at each step

When the chosen model reads images, the extension attaches a screenshot of the visible part of the tab at each step where Moon acts, so that the model sees the page as you do; on a sensitive site, a screenshot is only sent after your approval on a card. For a shared page, the “With a capture” box is checked by default; if you uncheck it, that choice is remembered. On each screenshot, fields, editable areas and frames embedded in the page (content from another site, video, advertising) are covered before sending, as are the text blocks where Moon Blur detects a piece of data; text drawn in the page’s images is not masked. Screenshots are sent with the conversation, like the text of the pages; the extension does not save them on your computer, and only the last three are sent back to the model.

What is sent, and where

Nothing leaves a shared page before you send your message; the “See what gets sent” button shows the exact content. During a task, each step sends Moon AI what Moon has read, the step’s screenshot and what it is about to do, including the text it will type. Before sending, Moon Blur masks on your computer the secrets and identifiers it detects in the pages, their titles, their addresses and your messages (keys, tokens, email addresses, phone numbers, IBANs, card numbers, social security number…); at this step, it does not detect names, postal addresses or health data. Moon AI then applies its own Moon Blur chain, as for any message (see section 4).

Once masked, the content is sent over an encrypted connection to Moon AI, on our servers in France, which forwards it to the provider of the model you have chosen, most often through OpenRouter (see section 5). That provider processes it under its own terms, like any message sent from Moon AI.

The extension creates no conversation in your account: these exchanges do not appear in your Moon AI history. The conversation stays in the panel, on your computer, until you close the panel or click “New chat”; with each message and each step, it is sent back to Moon AI with the pages read and the last three screenshots. As for any message, Moon AI records usage (model and volume processed) to apply your plan’s limits.

Moon AI’s guard and the task model

For some accounts, Moon AI adds a guard to the extension’s tasks. A third-party model chosen by Moon AI, the one that also writes conversation titles and summaries, called through OpenRouter (its provider may differ from your model’s, see section 5), then receives the text of the pages and the screenshots Moon has seen since your last message, to look for hidden instructions that would try to divert it. For each action Moon is about to take, it also reads your request, the page’s address and the action, to say whether the action matches the request. This check can only add approval cards, never remove any.

The texts it receives have been masked by Moon Blur on your computer, and Moon AI further masks email addresses, IBANs and long numbers in them; the screenshots are sent to it with the same masks as for your model, and text drawn in images is not masked there. To avoid checking the same content twice, Moon AI keeps in memory, for two hours at most, a hash of the checked content and the verdict. The guard’s calls do not count toward your plan’s limits and do not enter your history.

Signing in to your account

To sign in, the extension opens a Moon AI authorization page: there you choose the workspace it will use, then click “Authorize”. The extension never sees your password. Moon AI records the extension’s sign-in (browser, workspace, dates of sign-in, last use and expiry, hash of the refresh token) and sends you a “New Moon AI for Chrome sign-in” email, with the browser, the workspace, the time and a partially masked IP address. Opening and closing a sign-in are recorded in your account’s security log, with the IP address and browser (kept for 2 years). If an already used refresh token is presented again, a possible sign that the sign-in was copied, Moon AI closes the sign-in and alerts you by email. Your data export lists the extension’s sign-ins (browser and dates).

What stays on your computer

The local log keeps facts: the date, the site, the title and the address without parameters (passed through Moon Blur: the detected values become “[masked]” there), the size of the text, Moon’s actions with the names of the elements it acts on, the cards and your answers, the model used, the links opened and the refusals. It never keeps the text of pages, what Moon types or a token. It does not leave your computer unless you export it; you can clear it from the panel. The log and the allowed sites are also erased when another account signs in to the extension.

Limited Use of data

What the extension reads and does is used only to answer the questions you ask in its panel and to do the tasks you request there. Stellarr Studio does not sell it, does not use it for advertising, profiling or creditworthiness assessment, and only transfers it to the provider of the model that produces the answer and, when the guard is in place, to the guard’s third-party model, called through OpenRouter, under the conditions described above, or when the law requires it. No one at Stellarr Studio reads it, except at your request (support), for the security of the service (abuse, fraud) or under a legal obligation.

The use of information received by Moon AI for Chrome adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.

Legal basis: performance of the service you request (GDPR article 6.1.b); our legitimate interest (security of your account and of the tasks) for the guard, the security log and alert emails.

Stopping everything

• “Stop”, in the panel, or Alt+Shift+X, at any time: the current task stops and the debugging tool is detached. The “Stop” button of the page banner and the Esc key do the same, unless the page intercepts them. Closing the “Moon” group, moving a tab out of it or closing the panel also stops Moon.
• “Sites where Moon acts”, in the panel: “Remove” takes a site off the list and gives the extension’s access to that site back to Chrome.
• “Sign out”, in the extension’s panel: the sign-in is closed at Moon AI, and the extension erases from your computer its tokens, its log, the sites allowed for reading and for actions, and your choices.
• Settings › Account and security, on chat.realmoon.ai: the “Moon AI for Chrome” section lists the signed-in browsers; “Disconnect” closes a sign-in right away, even remotely, and “Sign out from all devices” closes them all.
• Uninstalling the extension (the browser’s extensions page, “Remove”) erases what it kept on your computer. Its sign-in stays listed in Settings › Account and security until it expires: you can close it there.

Your rights of access, rectification, erasure and objection are exercised as set out in section 13.

4 sexies. Ad measurement

On your first visit, an “Ad measurement” banner asks whether we may measure how well our ads work. “Accept” and “Decline” have the same size and style; until you answer, nothing is loaded or sent, and scrolling the page does not count as consent. Your answer is valid for 13 months (moon-ad-consent, see the cookie policy); it contains no identifier.

If you accept, every page of the site loads the Google tag (Google Ads). From your browser, it sends its ad network directly the address of the pages you view and of the page you came from, your IP address, information about your browser and device, the identifiers in its cookies (list and durations in the cookie policy) and, when you follow a sign-up link to the chat.realmoon.ai app, a signal of that sign-up. The network uses this to measure our ads and to show you our ads on its services. We do not send it your name, your email address or the content of your conversations.

Recipient: Google Ireland Limited (Ireland), with Google LLC (United States). This data may be processed outside the European Union, notably in the United States: these transfers rely on the EU-U.S. Data Privacy Framework, which the U.S. company has joined, and on the European Commission’s standard contractual clauses. What the network then does with this data is governed by its own policy: Google Privacy Policy.

Click identifier of a Google ad. When you arrive on realmoon.ai through a Google ad, Google adds a click identifier to the page address (gclid, gbraid or wbraid). If you accept, the identifier is only added to a link at the moment you follow it, to another page of the site or to the chat.realmoon.ai app: a copied link address does not carry it. The app keeps it with the origin of your sign-up; on its sign-in page, a line reminds you of this choice and the “Do not share” button removes it before the account is created. Google then reads this information on our servers, once a day: the click identifier, the name of the conversion (sign-up activated or first payment), its date and, for the first payment, its amount excluding tax. Never your name, your email address or your IP address. If you refuse, or if you do not answer, the identifier is neither passed to the app nor kept; after a refusal, it is also removed from the address bar. Recipient: Google Ireland Limited; Google LLC may process this data in the United States, under the EU-U.S. Data Privacy Framework and the European Commission’s standard contractual clauses.

Legal basis: your consent (GDPR article 6.1.a and article 82 of the French Data Protection Act).

Retention: your answer to the banner, 13 months; the tags’ cookies, the durations given in the cookie policy; the Google click identifier is erased from our database 90 days after your arrival, and backup copies disappear within 30 days. The date and version of your consent stay with your account, as proof. What the ad networks have received follows their own retention rules.

You can change your mind at any time: “Appearance and privacy”, at the bottom of each page, then “Ad measurement” shows your answer and lets you accept or refuse. After a refusal, no tag is loaded on the following pages, the site deletes, as far as it can, the cookies they had set on realmoon.ai and the click identifier is no longer passed on; cookies on the ad networks’ domains are managed with them or in your browser. In the app, Settings › Data and privacy › “Ad measurement” erases the identifier already kept: Google’s next reads no longer contain it. What has already been sent stays with the ad networks, under their rules. To exercise your rights over this data (access, erasure, objection), write to us (section 13) and contact the ad networks as well.

4 septies. Moon CLI, Moon Desktop and Code

Moon CLI is Moon AI’s coding agent: it works in your computer’s terminal, on the folders you open for it. Moon Desktop is Moon AI’s app for Windows, macOS and Linux; its Code part runs Moon CLI on your computer. The Code page of chat.realmoon.ai remotely controls Moon CLI (moon rc) or Moon Desktop: the messages and permission requests then go through our servers. What Moon can do on your computer, and what it asks you before acting, is described in the documentation of Moon CLI and of Code in Moon Desktop.

What leaves your computer

To work, Moon CLI sends Moon AI your messages, the session history and what it reads for the task: the content of the files it opens and the output of the commands it runs. Moon AI forwards this to the provider of the chosen model (see article 5). Before sending, Moon Blur masks on your computer the secrets it spots (keys, tokens, passwords, connection strings, lines of .env files, IBANs, card numbers); the “redact” level adds email addresses, phone numbers, ID numbers, SIREN numbers and postal addresses. You can lower this level for a folder, down to turning it off; detection is not exhaustive.

When you sign in, Moon CLI sends your computer’s name and operating system, so that you can recognize the session in your settings. Neither Moon CLI nor Moon Desktop sends telemetry or crash reports.

What stays on your computer

• Moon CLI’s sign-in tokens (an access token valid for 24 hours and a refresh token), stored in the system keychain or, failing that, in a file only your user account can read; a session lasts 90 days at most and is closed with moon logout, moon sessions or your settings.
• The history of sessions and of the messages you typed, and the agent’s log, until you delete them.
• Snapshots of your files, to undo a change: 7 days in Moon CLI; in Moon Desktop’s Code, a copy of the non-ignored files of a trusted folder, excluding recognized secret files and files over 50 MiB, kept 14 days after last use.
• Your settings: trusted folders, mode kept per folder, Moon Blur level, updates.
• In Moon Desktop: the chat.realmoon.ai session (its cookies and storage), a technical log without content (1 MB at most) and, for each Code folder, the last search and the draft commit message.

Services reached outside Moon AI

• Updates: Moon CLI checks for its updates once a day, and Moon Desktop at launch and then every 6 hours, on realmoon.ai; you can turn this check off.
• If the ripgrep search tool is missing from your computer, Moon CLI downloads it from GitHub.
• When Moon reads a web page for a task, the site serves it to your computer: it receives your IP address.
• Moon Desktop can install Git at your request, through your system’s tools (winget on Windows, xcode-select on macOS).

Screenshots, clipboard and meeting notes (Moon Desktop)

A screenshot is only taken when you ask for it. Since Moon Desktop 2.3 on Windows and Linux, and 2.5 on Mac, it first opens in an editing window: the text of the image is read on your computer, without going through Moon AI, to offer to mask the email addresses, phone numbers, IBANs and card numbers it spots; masked areas are erased from the pixels. “Moon with what I copied” reads the clipboard only once, when you ask, and never an item that your password manager has marked as secret. Meeting notes with the computer’s sound (Windows) start after your consent, with an indicator the whole time; the sound is transcribed and then erased (see article 6).

Legal basis: performance of the service you request (GDPR article 6.1.b); our legitimate interest (security of your account) for the computer name and sign-in alerts.

4 octies. Connectors, agents, routines and messaging apps

When you connect a service to Moon AI, Moon can read it and act in it for you: send an email, create an event, post a message. Connectors mostly go through Composio, which keeps the access tokens of the connected accounts, receives the parameters of each action with their real values and returns the results; Composio keeps the logs of these actions, with their content, for up to one year. Your MCP servers, your mailbox (IMAP and SMTP) and the services connected directly (GitHub, Figma…) receive what your actions send them, under their own terms; their credentials are encrypted in our database. Moon Blur does not mask what goes to these services: otherwise the action would make no sense.

Agents, scheduled routines, triggers (an event from a connected service) and webhooks can make Moon work when you are not in front of the screen. We keep their settings, their history and the actions waiting for your approval in the “To approve” box (see article 6). The morning briefing is a ready-made routine: if you connected them, it reads your calendar and your emails, and it looks up the weather and the news on the topics you chose through web search.

If you connect Telegram, your messages with Moon go through Telegram, under its own terms; we keep your Telegram account identifier and the events received, for 30 days (90 days in case of failure). If you connect Discord, we pass your Discord identifier and username, and the fact that your subscription is paid, to our bot on the Moon AI Discord server, to give you the subscriber role, which Discord then shows on that server.

The isolated computer, where Moon runs code and prepares files, runs on our servers, in France, without internet access. Its content is destroyed after a period of inactivity that depends on your plan, or with the conversation.

Legal basis: performance of the service you request (GDPR article 6.1.b).

4 nonies. Mobile apps, notifications and in-app purchases

The iPhone and Android apps display chat.realmoon.ai with your account; they add no advertising or audience measurement tracker. They keep a few settings on the phone (theme, notification request, identifier of a subscription taken in the app) and check for their updates with Expo at each launch. They ask for your permission before using the camera, photos, microphone and notifications.

Notifications: we keep the notification token of each device, linked to the session that registered it and removed when you sign out. A notification only contains fixed text (for example “Your answer is ready.”) or the name of a routine, never the content of your conversations; it goes through Apple (APNs) on iPhone, through Google (Firebase Cloud Messaging) on Android, and through your browser’s notification service on the web, if you turn them on. Changelog announcements are only sent to you with your consent, which you can withdraw in Settings › Notifications.

In-app purchases: a subscription taken in the iPhone or Android app is paid to Apple (App Store) or to Google (Google Play), which process the payment under their own terms. RevenueCat passes us the status of that subscription: we give it your Moon AI account identifier, never your email address. Legal basis: performance of the contract (GDPR article 6.1.b); your consent for changelog announcements (article 6.1.a).

4 decies. Emails

Our emails are sent through Brevo. The emails your account needs (codes, security alerts, information about your subscription and its payments, notice before an annual subscription renews, card expiring before a payment) are always sent to you. As long as you have not refused them, Moon AI may also send you emails about its services or similar services: reminders (unfinished payment, limit reached, plan ending), offers and the newsletter. Each email contains an unsubscribe link, and you can turn them off at any time in Settings › Notifications (“Promotional emails” and “Newsletter”). You receive no more than two reminders in 14 days.

5. Recipients and subprocessors

With your consent, the ad networks whose tags are loaded on the site also receive data directly from your browser: they are named in section 4 sexies.

Video AI models and some inference tasks run on our own GPU servers at OVHcloud. No data is transferred to third parties for this processing.

The services you connect yourself (MCP servers, mailbox, GitHub, Telegram…) receive what your actions send them and process it under their own terms. Apple and Google process the payment of a subscription taken in their store under their own terms.

No personal data is sold to third parties. Transfers outside the European Union to the United States are governed by the European Commission’s standard contractual clauses (SCCs, decision 2021/914) and supplemented by the technical masking measures described above.

6. Retention periods

Data aggregated irreversibly so that no one can be identified (overall usage statistics, performance metrics, request volumes) does not constitute personal data within the meaning of the GDPR (recital 26) and may be kept and used without time limit for service improvement, research, trend analysis and reporting purposes.

7. Data security

STELLARR STUDIO implements the following technical and organizational measures to protect your data:

• Encryption in transit

  TLS on all connections (1.2 at least, 1.3 when your browser allows it)

• Encryption of secrets

  Tokens of connectors, sign-ins and messaging apps encrypted in the database

• Moon Blur

  Reversible masking of the detected sensitive data before sending to the model

• Hosting in France

  OVHcloud servers in France

• Access control

  RBAC, MFA, principle of least privilege

• Logging

  Audit log of administrative actions, kept 2 years

• DRP / BCP

  Disaster recovery and business continuity plans overseen by experts (30+ years of experience)

Business continuity and disaster recovery

STELLARR STUDIO has put in place a disaster recovery and business continuity plan. It relies on the following measures:

• Several instances of the application run at the same time.
• The platform’s database is backed up every day, and its transaction logs are archived continuously, to a second server located in another OVHcloud data center, in Roubaix.
• Your files are stored on that second server, on mirrored disks.
• A standby replica of the application’s sessions and settings runs on that same server.
• The recovery procedures are documented: emergency restart of the servers, restoration of backups, return to the previous version of the application.
• The backups of STELLARR STUDIO’s internal file server are test-restored twice a month, and their integrity is checked every week.

8. Automated decision-making and profiling

Under article 22 of the GDPR, you have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you.

Moon AI uses the following automated processing:

• Moon Auto (smart routing)

  Automatic selection of the AI model best suited to your request based on technical criteria (content type, language, complexity). This processing produces no legal effects and does not significantly affect users.

• Moon Blur (reversible masking)

  Automatic detection of personal data in your messages and reversible replacement with placeholders before sending to AI models. This processing is aimed solely at protecting your data.

• Model recommendations

  Suggestions of AI models based on your usage history. These recommendations are purely indicative and have no legal effect.

• Personalized memory (if you turn it on)

  Selection of notes you have chosen to have remembered, to tailor the answers. This processing produces no legal effect and can be turned off in Settings, Personalization (see section 4 bis).

None of this processing constitutes an automated decision within the meaning of article 22 of the GDPR. However, you can at any time request human intervention, express your point of view or contest a processing operation by contacting us at contact@stellarrstudio.com.

9. International data transfers

Certain data is transmitted to recipients located outside the European Union, in particular in the United States: AI API providers (OpenAI, Anthropic, OpenRouter, Fireworks AI), Venice, as well as the other recipients that article 5 places outside the EU. These transfers are governed by:

• Standard contractual clauses (SCCs)

  Of the European Commission (Implementing Decision 2021/914 of June 4, 2021)

• Data Processing Agreements (DPA)

  Being negotiated and signed with each subprocessor. In the meantime, Moon Blur replaces, in the text sent to AI models, the personal data it detects.

• Supplementary measures (technical and organizational)

  Moon Blur masking of the sensitive data detected in the text sent to the models (more than 150 categories), TLS encryption in transit, minimization of the data transmitted with each API call, deletion of your account from your settings.

For Google (Gemini), data may be processed within the EU under Google Cloud’s Data Processing Addendum.

Primary hosting (OVHcloud) is located in France: your account, your conversations and your files are stored there.

Your messages, however, go to the provider of the AI model you choose (or that Moon Auto chooses for you), and that provider may be located outside the European Union, in particular in the United States. Before sending, Moon Blur masks the sensitive data it detects; its detection is not exhaustive (a name on its own, for example, is not spotted) and some content does not go through it (see the limits of Moon Blur).

The following go without this masking, because the service requires it or because Moon Blur does not read them: images and photos (their metadata is removed), the audio of dictation and voice calls, web search queries, descriptions of images and videos to create, the actions of your connectors (Composio, MCP servers, mailbox), the messages exchanged through your messaging apps (Telegram), the text drawn in the images of the pages read by Moon AI for Chrome and, with your consent, the click identifier of a Google ad and what the ad networks’ tags send from your browser (see section 4 sexies). The recipients and their location are listed in article 5.

You can obtain a copy of the appropriate safeguards by contacting us.

10. Data breach notification

Under articles 33 and 34 of the GDPR, in the event of a personal data breach likely to result in a risk to your rights and freedoms, STELLARR STUDIO undertakes to:

• Notification to the CNIL, France’s data protection authority (art. 33)

  Within 72 hours of becoming aware of the breach

• Informing the people concerned (art. 34)

  Inform you as soon as possible if the breach is likely to result in a high risk to your rights and freedoms

• Breach register (art. 33.5)

  Document any breach in an internal register, as required by article 33.5

• Corrective measures

  Implement the corrective measures needed to remedy the breach and mitigate its effects

11. Protection of minors’ data

Moon AI is not intended for children under 16. We do not knowingly collect personal data from people under 16.

For minors aged 16 to 18, the consent of a holder of parental authority is required to use the platform, in accordance with our internal policy on the protection of minors and with the spirit of article 8 of the GDPR.

If we learn that personal data of a child under 16 has been collected, we will take the necessary steps to delete it as soon as possible. If you are a parent or guardian and believe that your child has provided us with personal data, contact us at contact@stellarrstudio.com.

12. Impact assessment (DPIA)

Under article 35 of the GDPR, STELLARR STUDIO carries out data protection impact assessments (AIPD/DPIA) for processing likely to result in a high risk to the rights and freedoms of individuals.

These assessments are being formalized, in particular for:

• AI conversations

  The processing of AI conversations and their masking by Moon Blur

• Automated routing

  The automated routing of requests by Moon Auto

• Third-party provider APIs

  The processing of data through third-party provider APIs (OpenAI, Anthropic, Google, OpenRouter, Fireworks AI, Venice)

They will be available to the CNIL on request.

13. Your rights

Under the GDPR (articles 15 to 22) and the French Data Protection Act (loi Informatique et Libertés), you have the following rights:

• Right of access (art. 15)

  Obtain a copy of all your personal data

• Right to rectification (art. 16)

  Correct inaccurate or incomplete data

• Right to erasure (art. 17)

  Obtain the deletion of your data (“right to be forgotten”)

• Right to data portability (art. 20)

  Retrieve your data in a structured, readable format

• Right to object (art. 21)

  Object to processing based on legitimate interest

• Right to restriction (art. 18)

  Suspend the processing of your data

• Right to withdraw your consent

  At any time, without affecting the lawfulness of processing carried out before the withdrawal

• Post-mortem directives (art. 85 of the French Data Protection Act)

  Set directives about what happens to your data after your death

14. Cookies

To learn more about our use of cookies and trackers, see our cookie policy.

15. Changes

This privacy policy may be updated at any time to reflect changes in our practices or in legal requirements. In the event of a substantial change, Users will be informed by email and/or by a notification on the Platform at least 30 days before it takes effect.

16. Contact