Information MoonHold processes
- Account and profile identifiers, including Discord or Telegram identifiers and display information.
- Public wallet addresses, message-signature verification results, holdings, eligibility results, and community access state. MoonHold does not request seed phrases or custody assets.
- Business workspace configuration, members, rules, integration destinations, marketplace events, and delivery status.
- Stripe customer, subscription, invoice, tax-location, and tax-ID references. Complete card details are handled by Stripe and are not stored by MoonHold.
- Security, audit, availability, and provider-failure records. MoonHold prohibits secrets, raw wallet signatures, and complete webhook credentials in operational logs.
- Aggregated, cookie-free Vercel Web Analytics events in production.
Purposes and legal grounds
MoonHold uses information to provide authentication, prove wallet control, evaluate holder rules, deliver managed Discord or Telegram access, operate marketplace feeds, administer subscriptions, prevent abuse, maintain security, and comply with accounting or legal obligations.
Depending on the relationship and applicable law, processing is based on performing a contract, legitimate interests in operating and securing the service, legal obligations, or consent where required. Business customers are responsible for identifying their own lawful basis for data they direct MoonHold to process.
Providers and disclosures
MoonHold uses service providers listed in the subprocessor list, including Supabase, Vercel, Stripe, Discord, Telegram, Helius or other Solana RPC providers, Upstash, Better Stack, and GitHub. Information may also be disclosed when required by law, to protect users or the service, in a business transaction, or at a customer's direction. MoonHold does not sell personal information or use it for targeted advertising.
Retention and deletion
- Expired login challenges and OAuth state: purged within 24 hours.
- Active identity links, memberships, and current holdings: while the relationship remains active and as needed to provide the service.
- Verification history: 90 days.
- Raw provider and webhook payload fields: redacted or purged after 30 days.
- Security, delivery, activity, and administrator audit logs: 12 months.
- Required billing and accounting facts: up to seven years, subject to qualified accounting confirmation.
- Eligible account data after a valid deletion request: access disabled promptly and deletion scheduled within 30 days.
Legal holds, fraud investigations, unresolved disputes, required accounting records, and documented backup cycles can delay deletion of limited information. A deletion receipt records completion and any retained categories without retaining a directly identifying account ID.
Choices and rights
Signed-in users can export account data, unlink wallets and social accounts, revoke sessions, and request deletion from Settings. Depending on location, a person may also have rights to access, correct, delete, restrict, object, or receive a portable copy of information. Requests can be sent to moonstersweb3@gmail.com. MoonHold may verify identity before acting on a request.
International transfers and children
Providers may process information in the United States and other countries. International transfer mechanisms and supported launch countries require qualified review before international availability. MoonHold is intended for adults and is not knowingly offered to anyone under 18.
Security and changes
MoonHold uses access controls, row-level tenant boundaries, encrypted provider transport, minimized secrets, monitoring, and audit records. No system is perfectly secure. Material changes to this notice will be dated and, where required, communicated before they take effect.