Privacy Policy

1. Introduction

At Mochi ("we", "our", or "us"), we value and respect your privacy. This Privacy Policy describes how we collect, use, store, and protect your information when you access or use our web application, the Mochi Digital Workforce mobile application, and related services (collectively, the "Services").

2. Information We Collect

We collect information necessary to provide autonomous helper workflows:

• Account Information: Name, email address, password hash, and organization identifiers when you register or authenticate.
• Helper Configurations & Soul Files: Names, roles, instructions, and daily responsibilities you configure for your helpers.
• Communications & Turn Data: Chat messages exchanged between you and your helpers, email triage summaries, and task records.
• Connected Tools & OAuth Data: Authentication tokens and account identifiers for tools you explicitly grant access to via Composio (such as Gmail, Google Calendar, GitHub, Slack, Notion, or Google Drive).

3. How We Use Information

Your information is used strictly to deliver and execute your workflows:

• To execute AI model reasoning turns using Claude / NVIDIA NIM inside your strictly scoped workspace.
• To facilitate approved tool actions (e.g., drafting emails, monitoring repository issues, or checking calendar availability).
• To enforce your designated approval policies (e.g., requiring explicit approval before sending emails or taking irreversible actions).
• We do not sell your personal data, and we never use your proprietary data to train generalized third-party machine learning models without consent.

4. Third-Party Service Providers

We work with trusted enterprise providers who adhere to strict confidentiality and security standards:

• Supabase: Encrypted database and user authentication.
• Anthropic & NVIDIA: Cloud model execution for helper conversational turns.
• Composio: Managed-OAuth connection infrastructure.
• Vapi: Voice bridge and telephony endpoints.

5. Data Security

All data in transit is encrypted using Transport Layer Security (TLS 1.3 / HTTPS). Database storage utilizes AES-256 encryption at rest. Multi-tenant row-level security (RLS) guarantees that only authorized users within your organization can access your helpers, events, and credentials.

6. Data Deletion & Your Rights

You have the right to review, update, export, or completely delete your account and all associated helper data at any time.

You can initiate account deletion inside the app settings or by visiting our public deletion page: Account & Data Deletion.