MOBLE PRIVACY POLICY

Definitions

Personal information (or “personal data”) means information about an identifiable individual.
Services means our websites, platform, APIs, and modules that together form the MOBLE ecosystem.
Customer means the business that contracts with MOBLE.
End user means a visitor, shopper, or other individual interacting with a Customer’s experience powered by MOBLE.
API (Application Programming Interface) means any programmatic interface, endpoint, SDK, or developer tool that allows a Customer or authorised partner to interact with MOBLE systems or automate workflows.
API key / token means a unique credential used to authenticate or connect to MOBLE or third-party integrations. API keys are encrypted, access-controlled, and used only as instructed by the Customer.
Integration / connector means a link between MOBLE and a third-party service (for example, n8n, Make, Zapier, Twilio, Google Sheets, HubSpot, or Slack) that transfers data under the Customer’s control.
AI model provider means an external artificial-intelligence or machine-learning service (for example, OpenAI, Anthropic Claude, Google Gemini, Perplexity, Deepseek, Leonardo, Runway, or successors such as Sora 2 or Veo 3) that MOBLE may use to deliver generative or analytical features within the platform.

1. Purpose & scope

This Privacy Policy applies to:

• Visitors to our websites and help centre.
• Customers and their teams who use the MOBLE platform and modules.
• End users of customer websites, stores, chatbots or forms that run on our platform (where we process data on behalf of a customer).
• Prospective customers who receive MOBLE marketing (subject to opt-out at any time).

2. Our role (controller vs. processor)

Controller. We act as a controller when we decide why/how to process personal information (e.g., account details, billing, platform telemetry, MOBLE marketing lists).

Processor / service provider. We act as a processor when we process personal information strictly on a Customer’s documented instructions (e.g., orders, contact forms, chatbot transcripts, CRM records). For these activities our Data Processing Addendum (DPA) applies in addition to this notice.

3. Personal information we collect

No special categories by default Please do not upload health, biometric or other sensitive categories unless permitted by law and covered by written terms with us.

4. How & why we use data (and legal bases)

• Provide & improve the Services. Operate the platform, APIs, and modules; host content; process orders; provide chat and chatbot functions; maintain security; fix bugs; and ship new features. This includes processing limited API telemetry (such as request volume, response times, and error codes) to ensure reliability and scalability. Legal basis (EEA/UK/CH): contract; legitimate interests.
• Support & communications. Respond to tickets, provide integration or API setup assistance, notify about changes, and send transactional emails or in-product alerts. Basis: contract; legitimate interests.
• Security & fraud prevention. Detect abuse, investigate incidents, and protect accounts, API keys, and platform infrastructure. This includes rate-limiting and credential validation to prevent unauthorised or automated misuse. Basis: legitimate interests; legal obligations.
• Analytics & optimisation. Understand aggregate usage across our websites, APIs, and integrations to improve reliability, security, and user experience (often using de-identified or pseudonymised data). Basis: legitimate interests; consent where required.
• AI and automation features. Where Customers enable AI-related or automated workflows, MOBLE processes limited content through model providers (e.g., OpenAI, Anthropic, Google Gemini, Perplexity, Deepseek, Leonardo, and successors such as Sora 2 or Veo 3) solely to deliver those requested outputs. MOBLE does not use Customer Personal Data to train foundation models, and model inputs are handled per our Sub-Processor List. Basis: contract; legitimate interests; consent where required.
• Marketing (opt-out any time). Send product news and offers to business contacts. Basis: consent or legitimate interests as permitted.
• Compliance. Meet legal, tax, and regulatory obligations; respond to lawful requests. Basis: legal obligations; public interest.

5. Cookies & similar technologies

We use cookies, pixels and local storage to keep you signed in, remember preferences, measure audience and performance, and—if enabled—support attribution and advertising on our sites. You can manage preferences via our cookie banner and browser settings. For vendor detail and retention, see our Cookie Policy.

Do Not Track: there is no industry consensus; we currently do not respond to DNT signals.

6) How we share information

• Service providers (sub-processors). Hosting, storage, security, email, logging, analytics, support, automation, and optional AI model providers—each engaged under contract and limited to their specific task. Sub-processors are listed at moble.com/terms-sub-processor-list.
• Integrations and API connections you enable. When you connect third-party platforms or provide API keys (for example, n8n, Twilio, Google Sheets, Slack, HubSpot, or similar), MOBLE uses those credentials only to perform the integration you configure. API keys and tokens are encrypted in transit and at rest and are never shared with third parties except as required to execute the authorised connection. You may revoke or delete them at any time from your account settings.
• AI model interactions. If you enable AI-driven features, limited data may be transmitted to the relevant model provider (for example, OpenAI, Anthropic Claude, Google Gemini, Perplexity, Deepseek, Leonardo, or successors such as Sora 2 or Veo 3) solely to generate responses or perform the task you request. Customer Personal Data is not used to train third-party foundation models, and outputs are retained only as needed for service performance, security, or debugging.
• Legal & safety. To comply with law, protect rights, prevent fraud or abuse, and respond to lawful requests.
• Business transfers. As part of a merger, acquisition, or restructuring, subject to this policy or equivalent safeguards.

We do not sell personal information. Where our use of advertising partners on MOBLE-owned sites could be deemed “sharing” for targeted advertising, you can opt out via our cookie banner or the Your Privacy Choices section.

7. International transfers

We may process data in Australia and other countries. Where laws require, we use valid transfer mechanisms—such as the EU Standard Contractual Clauses and the UK Addendum—and conduct transfer risk assessments. For US vendors that participate in the Data Privacy Framework, we may rely on their certification as part of our safeguards.

8. How we secure information

• Encryption. All data is encrypted in transit (TLS) and at rest (where applicable). API keys, tokens, and credentials are stored using strong encryption and are accessible only to authorised systems for the purpose of executing the Customer’s configured integrations.
• Access controls. We apply least-privilege access, multi-factor authentication (MFA) for staff, and strict role-based permissions for systems and environments.
• Application & network security. Network segmentation, continuous logging and monitoring, vulnerability management, penetration testing, and a secure software development lifecycle (SDLC) are all implemented across the MOBLE platform and APIs.
• Integration & automation safeguards. Webhook payloads and automation triggers (e.g., n8n, Make, Zapier) use signature verification and authentication to prevent unauthorised access. Credentials and connection data exchanged with third-party systems are transmitted securely via encrypted channels.
• AI & sub-processor due diligence. We conduct vendor and model-provider assessments before onboarding, including review of security, confidentiality, and data handling practices for AI model providers such as OpenAI, Anthropic, Google, and others listed in our Sub-Processor List.
• Incident response. We maintain incident detection and response processes, with breach notification provided to affected Customers consistent with applicable data protection laws and our Data Processing Addendum.

9. Data retention

We retain personal information only as long as needed for the purposes above, to operate the Services, to defend or establish legal claims, and to meet legal obligations. Certain records (e.g., tax and accounting documents) may be retained for up to seven (7) years or as required by law.

10. Your rights & choices

Australia (APPs)

You can request access to and correction of your personal information. If you have concerns, see Contact & complaints.

EEA/UK/Switzerland (GDPR)

Depending on context: access, rectification, erasure, restriction, portability, and objection to processing (including profiling) based on legitimate interests; withdrawal of consent at any time (without affecting prior processing). You can lodge a complaint with your supervisory authority.

United States (state privacy laws)

Residents of certain US states may have rights to know/access, correct, delete, portability, and to opt-out of “sale”/“share” or targeted advertising. We do not sell personal information. Where our use of advertising partners on MOBLE-owned sites may constitute “sharing,” you can opt-out via cookie preferences and by contacting team@moble.com.au. Appeals processes are available where required by law.

Appendix — Data Processing Addendum (overview)

When MOBLE processes personal information on your behalf, our Data Processing Addendum (DPA) applies (roles, instructions, security, sub-processors, international transfers, assistance, breach notice, deletion/return, and audits). To obtain the current DPA, contact team@moble.com.au. Our current sub-processors are listed at www.moble.com/terms-sub-processor-list.