Privacy notice

This notice covers this website, moonflower.social. The app is not released yet; when it is, it will have its own notice covering everything it handles, and this page will link to it.

Who is the controller

Alsanthea Ltd, a company registered in England and Wales (company number 17419177), registered office 124 City Road, London, United Kingdom, EC1V 2NX, is the controller for the personal data described here. Moonflower is one of its products.

Data protection enquiries: privacy@moonflower.social.

What we collect

This site sets no cookies, runs no JavaScript, embeds no third-party content and uses no analytics service. Nothing follows you from this site to anywhere else, and we have not asked you to consent to anything because there is nothing to consent to.

Our content delivery network records a standard server log entry for each request. It contains your IP address, the time, the page requested, the response, your browser's user-agent string, and the page you arrived from if your browser sent one.

If you write to one of the addresses on the support page, we hold that message and your email address so we can answer it.

If you join the waitlist, we hold what you typed into that form: your email address, the country and city you gave, the experiences you ticked, and your mobile number if you chose to give one. We also record which of the permissions below you agreed to, when you agreed, and the exact wording you were shown — because a permission we cannot evidence is one we cannot rely on. Nothing else is collected, and no account is created.

Why we collect it, and on what basis

Logs exist to keep the site available, diagnose faults, and identify abuse such as denial-of-service traffic. The lawful basis is our legitimate interest in running a secure and functioning website. We do not use them to build a profile of you and we do not attempt to identify visitors.

Correspondence is held on the basis of our legitimate interest in answering the person who wrote to us.

The waitlist runs on your consent, and we ask for it in two separate parts because they are two different things: telling you when something you picked is available, and sending you occasional news in the meantime. You can hold either without the other. If you gave us a mobile number and ticked the box, the same two permissions apply by text as well as by email — a permission to email is not a permission to text, so we ask for that separately too.

Every message we send carries a link that deletes you from the list, and your mail app will show its own unsubscribe button beside our name. Either one removes your email address, your number, where you are and what you picked — immediately, in full, and without writing to us. You can also withdraw consent by writing to privacy@moonflower.social.

How long we keep it

Logs are deleted automatically after 90 days. Correspondence is kept while it is relevant and then deleted.

A waitlist entry is kept until it has done its job. If you asked only to be told about a launch, we delete your entry once that launch has been sent and any bounces dealt with — we keep the count, not you. If you also asked for news, the entry stays until you stop it or delete yourself. A signup that is never confirmed is deleted after seven days.

Who else sees it

Our hosting and content delivery is Amazon Web Services, and our email is Google Workspace. The emails the waitlist sends you are delivered by Postmark, a service of ActiveCampaign, LLC. All three process this data on our instructions. The waitlist itself is held in our own systems, not a mailing-list provider: Postmark receives your email address and the message we are sending you, and keeps both, with a record of the delivery, for a limited time so that problems can be traced. We do not sell personal data, share it for advertising, or pass it to anyone else except where the law requires it.

Where it is held

Logs and the waitlist are stored in the United Kingdom. Our content delivery network serves pages from locations worldwide, so a request may be logged at an edge location outside the UK before the record is consolidated. Email is processed by Google under their standard terms.

Postmark delivers from the United States, so your email address leaves the UK each time we write to you. ActiveCampaign is certified under the UK Extension to the EU–US Data Privacy Framework, which UK law recognises as protecting personal data to the standard it requires, and that is the basis on which we send it there.

Your rights

You can ask us for a copy of the personal data we hold about you, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Write to privacy@moonflower.social and we will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you gave us the chance to put it right first.

Changes

If we change how this site handles personal data, we will update this notice and the date below. This notice was last updated on 10 September 2026.