Privacy Policy

1. Who we are and what this policy covers

This policy explains how Moyai handles personal data when you visit our website, contact us, sign up for or use our platform as an account user, or do business with us. Moyai is an AI agent monitoring platform: we analyse observability traces from AI agents to detect and flag issues.

Controller. Moyai Operations B.V., registered with the Dutch Chamber of Commerce (KvK) under number 96031034, with its registered office at Herengracht 471, 1017BS Amsterdam (“Moyai”, “we”, “us”), is the controller for the personal data described in this policy.

Customer Data has two roles. Our customers send us agent traces, logs, prompts, outputs and related telemetry (“Customer Data”), which may contain personal data.

• Providing the service: we are a processor. When we monitor a customer’s agents and deliver their results, we act on behalf of that customer, who is the controller. We follow the customer’s documented instructions under our Terms of Service and Data Processing Agreement (DPA) with that customer.
• Improving our detection: we are a controller. As our agreements with customers allow, we also use Customer Data to improve the detection and root cause analysis that all customers rely on. For that limited purpose we decide how the data is used, so we are the controller. Section 4 explains how, and the safeguards we apply.

If your personal data appears in a customer’s agent traces, contact that customer for anything about how their agents use it. For our own use described in section 4, you can contact us directly (see section 9).

2. Personal data we collect

Category	Examples	Source
Account data	Name, work email, company, role, login credentials (hashed), workspace settings	You or your organisation’s admin
Usage data	Features used, pages viewed, actions in the dashboard, timestamps, error reports	Collected automatically when you use the platform
Device and technical data	IP address, browser type, operating system, device identifiers	Collected automatically
Business contact data	Name, email, company, job title, notes from calls and emails	You, events, or public professional sources
Billing data	Billing contact, company address, VAT number, invoice history (card details are handled by our payment provider, not stored by us)	You
Communications	Support requests, feedback, call recordings or notes (only with notice)	You
Website data	Pages visited, referrer, cookie identifiers	Our website, see Cookies below
Customer Data used for detection improvement	De-identified agent traces, behavioural patterns, detected anomalies and their root causes (see section 4)	Our customers’ agent telemetry

We do not intentionally collect special categories of personal data (such as health or political opinions). Where they appear in Customer Data, we aim to remove them before using it to improve detection.

3. Why we use your data and our legal basis

Purpose	Data used	Legal basis (GDPR Art. 6)
Provide the platform, create and manage accounts, authenticate users	Account, usage, technical	Performance of a contract (6(1)(b)); for users invited by their employer, our legitimate interest in providing the service our customer bought (6(1)(f))
Support and service communications	Account, communications	Performance of a contract (6(1)(b))
Security, fraud and abuse prevention, debugging	Usage, technical	Legitimate interest in keeping the platform secure (6(1)(f))
Improve and develop our product	Usage, technical (aggregated or pseudonymised where possible)	Legitimate interest in improving our service (6(1)(f))
Improve our anomaly detection and root cause analysis	De-identified Customer Data (section 4)	Legitimate interest in making detection more accurate for all customers (6(1)(f)), assessed as compatible with the original purpose (Art. 6(4)) and permitted by our customer agreements
Sales and B2B marketing to business contacts	Business contact data	Legitimate interest in growing our business (6(1)(f)); consent where the law requires it, such as some email marketing
Billing, accounting and tax	Billing, account	Legal obligation (6(1)(c)) and contract (6(1)(b))
Website analytics and non-essential cookies	Website data	Consent (6(1)(a))
Comply with law and enforce our agreements	Any relevant data	Legal obligation (6(1)(c)); legitimate interest (6(1)(f))

Where we rely on legitimate interest, we have balanced our interest against your rights, and you can object at any time (see section 9). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. How we use traces to improve detection

We learn from the agent behaviour we observe with customers to catch more issues, with fewer false alarms, for everyone. This includes refining detection algorithms, selection criteria, internal evaluation and benchmark sets.

Safeguards we apply.

• De-identification first. Before traces are used for this purpose, we remove or mask direct identifiers, such as names, email addresses and phone numbers, as well as secrets such as API keys and credentials.
• No special categories. We aim to exclude special categories of personal data, and data about children, from this use.
• Patterns, not people. We are interested in how agents behave, not in the individuals in the traces. We do not try to re-identify anyone and do not build profiles of individuals.
• No cross-customer exposure. What we learn improves detection for all customers, but we never show one customer’s data to another, and our detection outputs are designed not to reproduce trace content.
• Restricted access. Only authorised Moyai staff who work on detection can access this data, under confidentiality obligations.
• Limited retention. We keep de-identified data used for this purpose for up to 6 months, unless it has been fully anonymised.
• No third-party training. We do not sell Customer Data or let third parties, including our AI model providers, use it to train their own models.

Opting out. Customers can opt out of this use in their agreement. After an opt-out, we stop using their new Customer Data to improve detection.

Customers’ responsibilities. Our customers decide what their agents send to Moyai. They are responsible for informing their own users, including about this use, and for having a lawful basis to share the data with us.

5. Who we share data with

We do not sell personal data. We share it only with the recipients below, each bound by a contract that limits their use to providing services to us.

Service providers (sub-processors).

Provider	Purpose	Data involved
AWS	Hosting and storage	All platform data
Nebius, Anthropic, OpenAI, Google (LLM providers)	Anomaly detection and root cause analysis	Customer Data sent for analysis
Nebius (ML training)	Improving detection models	De-identified Customer Data
WorkOS	Login and identity	Account data
Google, Slack	Transactional and service email	Account data
Attio, Google, Harmonic	Sales and customer relationships	Business contact data
Sentry	Usage analytics	Usage and technical data
Logfire	Debugging	Technical data
Polar	Billing	Billing data
Linear, Slack	Customer support	Communications

Other recipients. Professional advisers (lawyers, accountants, auditors) under confidentiality; authorities where the law requires it; and a buyer or successor in a merger, acquisition or sale of assets, who will be bound by this policy.

6. International transfers

We store and process personal data primarily in the European Economic Area (EEA). Some service providers may process data outside the EEA. When they do, we protect the transfer with an adequacy decision (including the EU-US Data Privacy Framework for certified US companies) or the European Commission’s Standard Contractual Clauses, plus additional measures where needed. You can ask us for a copy of the relevant safeguards.

7. How long we keep data

We keep personal data only as long as needed for the purposes above.

Data	Retention
Account and usage data	For the life of the account, then deleted or anonymised within 90 days of closure
Business contact data	Up to 2 years after our last meaningful contact
Billing and accounting records	7 years, as required by Dutch tax law
Support communications	2 years after the request is closed
Security and server logs	12 months
Customer Data used to provide the service	As set out in the customer’s agreement and DPA
De-identified Customer Data used to improve detection	Up to 6 months, unless fully anonymised

8. Security

We use appropriate technical and organisational measures to protect personal data. These include encryption in transit and at rest, role-based access controls, least-privilege access for staff, logging and monitoring, and vetting of service providers. Data used to improve detection is kept apart from production customer environments. No system is fully secure. If a personal data breach occurs, we will notify the competent authority and affected individuals where the GDPR requires it.

9. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you and get a copy
• Rectify inaccurate or incomplete data
• Erase your data in certain cases
• Restrict our processing in certain cases
• Data portability: receive data you gave us in a structured, machine-readable format
• Object to processing based on legitimate interest, including our use of Customer Data to improve detection, and to direct marketing at any time
• Withdraw consent at any time, without affecting earlier processing

To exercise a right, email [email protected]. We respond within one month and may need to verify your identity. Because data used to improve detection is de-identified, we may not be able to find your data in it; if so, we will tell you why. For how a customer’s agents use your data, contact that customer.

You can also lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You may also contact the authority in the EU country where you live or work.

10. Cookies

We use strictly necessary cookies to run the website and platform, such as for login sessions and security. We use analytics or marketing cookies only with your consent, which you can give or withdraw at any time through our cookie banner.

11. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new “last updated” date. If we make material changes, we will notify account users by email or in the platform.

12. Contact

Moyai Operations B.V.
Herengracht 471, 1017BS Amsterdam
Email: [email protected]