This Privacy Policy explains how Kimu Labs SL, trading as MOO Content (“we”, “us”, or “our”), collects, uses, and protects your personal data when you visit our website (moocontent.com) or use our platform. We are committed to handling your data responsibly and in compliance with the GDPR and applicable Spanish and EU data protection law.

1. Who We Are (Data Controller)

Kimu Labs SL (trading as MOO Content) is the data controller responsible for your personal data.

Contact: support@moocontent.com | Phone: +34 628 887 303 | Location: Basque Country, Spain

2. The Data We Collect

From Organizations (brands), we collect:

• Name, company name, job title, email address, and phone number

• Campaign briefs, requirements, and uploaded files

• Billing information (processed via Stripe — we do not store card details)

• Communications sent via the platform (messages, feedback, approvals)

From Creators, we collect:

• Name, contact details, address, and profile information

• Tax identification number (Steuernummer, USt-IdNr, NIF, or equivalent)

• Invoices uploaded to the platform (containing name, address, tax ID, and bank details)

• Niche, style, content samples, and past brand experience

• Pricing and availability information

• Payment and bank details (for payout via Stripe)

• Content files and video submissions

• Communications sent via the platform

From all visitors, we collect:

• IP address and browser/device information

• Pages visited, time on site, and navigation patterns (via analytics)

• Data submitted through forms (demo requests, contact messages, newsletter sign-ups)

• Cookie data (see Cookie Policy)

3. How We Use Your Data

To operate the platform:

• Matching brands with appropriate creators — Legal basis: Contract performance

• Facilitating briefing, messaging, feedback, and content delivery — Legal basis: Contract performance

• Processing payments, holding escrow, and triggering payouts — Legal basis: Contract performance

• Receiving, validating, and storing creator invoices for payment processing and tax compliance — Legal basis: Contract performance / Legal obligation

• Issuing invoices to Organizations for the full Order value — Legal basis: Contract performance / Legal obligation

• Providing AI-powered features (creator matching, script generation, pricing benchmarks) — Legal basis: Contract performance / Legitimate interest

To comply with legal obligations:

• DAC-7 reporting of Creator transaction data to tax authorities — Legal basis: Legal obligation

• Retention of invoices and transaction records for tax compliance — Legal basis: Legal obligation

• Cooperation with competent authorities where required — Legal basis: Legal obligation

To communicate with you:

• Responding to enquiries and providing support — Legal basis: Legitimate interest / Consent

• Sending platform updates and marketing emails (where opted in) — Legal basis: Consent

To improve our service:

• Analysing usage patterns — Legal basis: Legitimate interest

• Using anonymised analytics — Legal basis: Legitimate interest

4. AI-Powered Features and Automated Processing

Kimu Labs SL uses artificial intelligence — powered by Anthropic’s Claude API — to power several features including creator matching, script generation, pricing benchmarks, and video enhancement. No fully automated decision-making with legal or similarly significant effects takes place without human involvement. You have the right to request human review of any AI-assisted process that affects you. Contact us at support@moocontent.com to do so.

5. Who We Share Your Data With

We do not sell your personal data. We may share it with:

• Stripe (payment processor): to securely handle transactions.

• Invopop (invoicing & tax compliance): to process invoices through TicketBAI/BATUZ compliance system.

• Google Analytics (analytics): to understand website usage.

• Anthropic (AI provider): to power AI features.

• Cal.com (scheduling): to manage demo bookings.

• Framer (website hosting): to serve the website.

• [Email service provider]: for transactional and onboarding emails.

All third-party providers are contractually required to process your data only as instructed and in compliance with GDPR. Where data is transferred outside the EEA, we ensure appropriate safeguards are in place.

6. How Long We Keep Your Data

• Account and profile data: retained for the duration of your relationship with us, plus up to 6 years after account closure (to comply with Spanish commercial and tax law, Art. 30 Código de Comercio).

• Invoices and transaction records: retained for 6 years to meet legal and financial obligations.

• Creator invoices uploaded to the platform: retained for 6 years regardless of account closure or deletion requests.

• Marketing consent records: retained until you unsubscribe, then for a further 2 years as proof of consent.

• Website analytics data: retained in aggregated form for up to 26 months.

• Support and contact messages: retained for up to 2 years after your last communication.

When data is no longer needed, it is securely deleted or anonymised.

7. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access: request a copy of the personal data we hold about you.

• Right to rectification: ask us to correct inaccurate or incomplete data.

• Right to erasure: request deletion of your data, subject to legal retention obligations (e.g. invoices must be retained for 6 years).

• Right to restrict processing: ask us to limit how we use your data in certain circumstances.

• Right to data portability: request your data in a structured, machine-readable format.

• Right to object: object to processing based on legitimate interests or for direct marketing.

• Right to withdraw consent: withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at hello@moocontent.com. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD) at www.aepd.es.

8. DAC-7 Tax Reporting

In compliance with EU Directive 2021/514 (DAC-7), we are required to collect and report certain information about Creators and their transactions to the relevant tax authorities annually. This includes: the Creator’s identity, address, tax identification number, bank account details, and total consideration received through the Platform during the reporting period. By using the Platform as a Creator, you acknowledge this reporting obligation.

9. Cookies

Our website uses cookies. For detailed information on the types of cookies used and how to manage your preferences, please refer to our separate Cookie Policy at www.moocontent.com/cookies.

10. Data Security

We implement appropriate technical and organisational measures to protect your data, including encrypted data transmission (HTTPS), access controls, and secure hosting infrastructure. In the event of a personal data breach that is likely to affect your rights and freedoms, we will notify you and the relevant supervisory authority as required by GDPR.

11. International Data Transfers

Some of our third-party providers are based outside the EEA: Anthropic (USA), Google Analytics (USA), Stripe (USA), Cal.com (USA). In each case, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or transfers to countries covered by an EU adequacy decision.

12. Children’s Privacy

Our platform is intended for use by businesses and adult content creators. We do not knowingly collect personal data from anyone under the age of 18.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will update the ‘Last updated’ date and, where appropriate, notify you by email or via the platform.