Privacy Policy and Personal Data Processing Policy

1. TERMS

• 1.1. Service — a web platform located on the Internet at: https://mooonai.com. All exclusive property rights to the Service, its software code, interface elements, design, algorithms, as well as other results of intellectual activity included in the Service, belong to the limited liability partnership 'MoonAI tech' on the basis of the legislation of the Republic of Kazakhstan. The Service is used by the User under the terms of a simple (non-exclusive) license. Transfer of exclusive rights to the Service, its components, and elements to the User is not carried out. The Service is a SaaS platform for creating and operating AI agents, including, but not limited to, the following capabilities:
• 1.1.1. Processing of incoming and outgoing messages in various digital communication channels, including messengers (WhatsApp, Telegram, Instagram Direct, etc.), web chats, email, SMS, and push notifications;
• 1.1.2. Recognition and interpretation of natural language using natural language processing and understanding technologies (NLU/NLP), including morphological and syntactic analysis, entity extraction, meaning determination, and multilingual support;
• 1.1.3. Integration with external artificial intelligence and machine learning platforms, including OpenAI, enabling the use of generative AI models for auto-generation of responses, dialogue building, intelligent automation, and advanced natural language processing;
• 1.1.4. Integration with voice channels and telephony systems, including SIP/VoIP technologies, WebRTC, as well as support for speech recognition and synthesis (ASR/TTS);
• 1.1.5. Integration with external information systems, including CRM, Helpdesk, ERP platforms and other software solutions, as well as interaction with external APIs and services to ensure end-to-end automation of business processes, data processing, and implementation of individual agent functioning logic;
• 1.1.6. Provision of monitoring, statistics collection, and analytics tools, including built-in dashboards, visualization of key performance indicators (KPIs), and the ability to integrate with BI systems.

• 1.2. User — a person using the Service or gaining access to the Operator's services.
• 1.3. Legislation — the current legislation of the Republic of Kazakhstan.
• 1.4. Personal Data — personal data of the User that the User provides independently during registration or in the process of using the Service's functionality, allowing to identify their identity.
• 1.5. Data — other data about the User (not included in the concept of Personal Data).
• 1.6. Registration — filling out the Registration form by the User, by specifying the necessary information.
• 1.7. Service(s) — provision of a paid right to use the 'MoonAI' Service and other related services.

2. COLLECTION AND PROCESSING OF PERSONAL DATA. PURPOSES OF PERSONAL DATA PROCESSING

• 2.1. The Operator collects and stores only those Personal Data that are necessary for the provision of Services by the Operator and interaction with the User.

• 2.2. Personal Data may be used for the following purposes:
• 2.2.1 provision of Services to the User;
• 2.2.2 identification of the User, including during registration and authorization;
• 2.2.3 interaction with the User, including but not limited to sending notifications, messages, and information regarding the functioning of the Service;
• 2.2.4 sending the User advertising materials, informational materials, offers, surveys, notifications, and requests regarding the Service's functionality;
• 2.2.5 conducting statistical and other research aimed at improving the quality of the Service;
• 2.2.6. providing technical support and maintenance to the User;
• 2.2.7. fulfilling the requirements of the legislation of the Republic of Kazakhstan, including data storage and provision of information upon requests from state bodies;
• 2.2.8. preventing fraud, unauthorized access, and other security violations of the Service;
• 2.2.9. providing access to platform functions requiring personalized settings;
• 2.2.11. processing payments and issuing invoices;
• 2.2.12. administering the Service and managing the User's account;
• 2.2.13. storing and backing up User data, if necessary for the operation of the Service.
• 2.2.14. for other purposes provided for by the Legislation of the Republic of Kazakhstan.

• 2.3. The Operator also processes the following data:
• 2.3.1 mobile phone number;
• 2.3.2 email address.

• 2.4. The User undertakes to provide accurate personal data and not to post data of third parties without appropriate permission.
• 2.5. The User independently ensures the existence of proper legal grounds for transferring data of third parties, including obtaining prior consent of personal data subjects for the collection, processing, transfer, and storage of their personal data using the Operator's Service in accordance with the Law of the Republic of Kazakhstan 'On Personal Data and Their Protection'.

3. PROCEDURE FOR PROCESSING PERSONAL AND OTHER DATA

• 3.1. The Operator undertakes to use Personal Data in accordance with the Law 'On Personal Data' of the Republic of Kazakhstan and the Operator's internal documents.
• 3.2. Confidentiality of the User's Personal Data and other Data is maintained, except when such data is publicly available.
• 3.3. The User gives consent to the processing of personal data without limitation of term.

• 3.4. The Operator has the right to transfer the User's Personal Data and Data without the User's consent to the following persons:
• 3.4.1 to state bodies, including bodies of inquiry and investigation, and local self-government bodies upon their reasoned request;
• 3.4.2 in other cases directly provided for by the current legislation of the Republic of Kazakhstan.

• 3.5. The Operator has the right to transfer Personal Data and Data to third parties, as well as for cross-border transfer of personal data and for transfer of personal data to third parties not specified in clause 3.4. of this Privacy Policy, in the following cases:
• 3.5.1 the User has expressed their consent to such actions;
• 3.5.2 the transfer is necessary within the framework of the User's use of the Service or provision of Services to the User;

• 3.6. The Operator carries out automated processing of Personal Data.
• 3.7. The Operator provides proper protection of Personal and other Data in accordance with the Legislation and takes necessary and sufficient organizational and technical measures to protect Personal Data.
• 3.8. The protection measures applied, among other things, allow protecting Personal Data from unlawful or accidental access, destruction, modification, blocking, copying, distribution, as well as from other unlawful actions with them by third parties.

4. RIGHTS AND OBLIGATIONS OF SERVICE USERS DURING THE PROCESSING OF THEIR PERSONAL DATA

• 4.1. The Service User has the right to:
• 4.1.1. use their personal data for any lawful purposes, including for the purpose of using the Operator's Service;
• 4.1.2. withdraw their consent to the collection and processing of data by drawing up an appropriate written document, which can be sent to the Operator. In case of withdrawal of consent to the processing of personal data, the Operator has the right to continue processing personal data without consent when the personal data has been made publicly available and in the presence of grounds specified in Article 9 of the Law of the Republic of Kazakhstan 'On Personal Data and Their Protection'.

• 4.2. The Service User is obliged to:
• 4.2.1. possess all necessary rights and written consents allowing them to register, authorize, and use the Operator's Service services for their intended purpose;
• 4.2.2. provide accurate information about themselves to the extent necessary for using the Operator's Service;
• 4.2.3. be familiar with this Policy;
• 4.2.4. update the personal data processed in the Service in case of changes, if automatic updating of said data is not possible;
• 4.2.5. fulfill other obligations in the field of personal data when such obligations arise for the personal data subject during the processing of their personal data.
• 4.2.6. prevent violations of the rights and legitimate interests of personal data subjects and bear full responsibility to such third parties, as well as to state bodies, for the legality of processing the relevant personal data.
• 4.2.7. independently ensure obtaining proper consents from third parties, personal data subjects, for the processing, transfer, and use of their personal data within the framework of using the Service. The User confirms that they have all necessary legal grounds and/or consents of third parties, personal data subjects, for transferring such data to the Operator and processing it using the Service. The User bears full responsibility for the legality of collecting, using, and transferring personal data in accordance with the legislation of the Republic of Kazakhstan, including the Law of the Republic of Kazakhstan 'On Personal Data and Their Protection'.

5. OTHER PROVISIONS

• 5.1. The law of the Republic of Kazakhstan shall apply to this Privacy Policy and the relations between the User and the Operator arising in connection with the application of the Privacy Policy.
• 5.2. All possible disputes arising from this Agreement are subject to resolution in accordance with the current legislation at the place of registration of the Operator. Before going to court, the User must comply with the mandatory pre-trial procedure and send the Operator an appropriate written claim. The response period for the claim is 30 (thirty) working days.
• 5.3. If for any reason one or more provisions of the Privacy Policy are held to be invalid or unenforceable, this does not affect the validity or applicability of the remaining provisions of the Privacy Policy.
• 5.4. The Operator has the right to change the Privacy Policy (in whole or in part) at any time unilaterally without prior agreement with the User. All changes come into force from the moment they are posted at: /docs/privacy-policy.
• 5.5. The User undertakes to independently monitor changes to the Privacy Policy by reviewing the current version.
• 5.6. All suggestions or questions regarding this Privacy Policy should be reported by email support@mooonai.com or in writing to the address: RK, Almaty, st. Masanchi 98B, 100.
• 5.7. In the event of claims, demands, or lawsuits being brought against the Operator related to the unlawful transfer and/or processing of personal data of third parties, the User undertakes to compensate the Operator for all losses caused by such appeals.

6. CONSENT TO THE PROCESSING OF PERSONAL DATA

• 6.1. By accepting the terms of this Policy, the User gives their informed consent to the collection, storage, processing, use, and transfer to the Operator of their personal data, as well as to the cross-border transfer of their personal data and to the transfer of personal data to third parties to the extent and for the purposes provided for by this Policy, in accordance with the legislation of the Republic of Kazakhstan.
• 6.2. The User hereby confirms consent to the processing and cross-border transfer of their personal data throughout the entire period of using the Operator's Service.
• 6.3. After termination of use of the Service, the consent to the processing of personal data remains in force for 3 (three) years from the date of termination of use of the Service — solely for the purposes of storing personal data, within the limits established by the current legislation of the Republic of Kazakhstan.

7. ACCESS OF THIRD PARTIES TO PERSONAL DATA

• 7.1. The user's personal data may be transferred via cross-border transfer to a third party in the following cases:
• 7.1.1. if the cross-border transfer of personal data is necessary for the provision of the Operator's Service;
• 7.1.2. if the user has given consent for the cross-border transfer of their data to a third party;
• 7.1.3. if the transfer is provided for by current legislation.

8. STORAGE AND DELETION OF USER DATA

• 8.1. User data is stored for the duration of the Service use and may be deleted in the following cases:
• 8.1.1. upon the user's request to delete data;
• 8.1.2. upon deletion of the user's account;
• 8.1.3. upon expiration of the data storage period established by law.
• 8.2. To delete their account and all associated data, the user can follow the instructions provided on the page Delete Account.
• 8.3. When deleting an account, all user data, including data obtained through third-party integrations, will be permanently deleted within 30 days from the date of the deletion request.