Privacy policy
What Moat.page collects, why, who it's shared with, and the controls you have. Written to be read, not skimmed past.
The short version
- You decide what's on your page and who can see each part of it.
- Your page is shared only with partner apps you connect, and only at the visibility you've chosen.
- Email and phone are never shown on public cards. Only approved partner servers can request them.
- We don't sell personal data and we don't run ads.
- Delete your page any time. We delete it and tell every connected app to delete what it holds.
Who we are
Moat.page ("Moat", "we") is operated by TheWORKCompany. We decide how and why your personal data is processed on Moat, which makes us the controller of that data. Questions go to [email protected].
What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Email address, sign-in times, session identifiers | You, through Werify email-code sign-in |
| Page content | Name, photo, headline, about, experience, education, skills, certifications, projects, links | You, or a LinkedIn import you start |
| Status signals | Open to work, can mentor, need funding and similar, with any details you add | You |
| Contact details | Contact email, phone number, birthday | You. Visible only to you unless stated below |
| Network | Follows, connection requests, connections, blocks, messages | You and people you interact with |
| Connected apps | Which partner apps you've connected, their addresses and your keys for them | You and the partner apps you use |
| Company and service pages | Company or service details you publish, and who created them | You |
| Technical | IP address, browser type, pages viewed, cookies | Your browser and our servers |
When you import from LinkedIn, you choose which sections to bring in. We don't keep the rest of the export.
How we use it
| Purpose | Legal basis (UK and EU) |
|---|---|
| Create, host and show your page | Performing our contract with you |
| Share your page with partner apps you connect | Performing our contract with you, at your direction |
| Follows, connections and messages | Performing our contract with you |
| Service emails such as sign-in codes and connection requests | Performing our contract. You can turn off non-essential emails in settings |
| Security, fraud and abuse prevention, rate limiting | Our legitimate interest in keeping Moat safe |
| Understanding how the site is used (analytics) | Consent, where the law requires it |
| Complying with the law | Legal obligation |
We don't make decisions about you that have legal or similarly significant effects using automated processing. The HAPI score is not live. If it launches, it will be off by default and described on the HAPI method page.
What partner apps receive
Partner apps are other products that show Moat pages, currently Club, Dium, joq and ewent. A partner app receives your data only after you connect it, usually by signing in to it with the same email.
| What | Who can see it |
|---|---|
| Card: photo, name, title, company, location, follower counts | Anyone viewing a Moat card, if your page is public |
| Public: headline, about, skills, status signals, social links | Anyone viewing a public-level card, if your page is public |
| Full: experience, education, certifications, projects and more | Partner apps and viewers allowed by your visibility settings |
| Email and phone | Only approved partner servers using their private key, never browsers |
| Updates, deletion and unlinking notices | Partner apps you've connected |
Each partner app is responsible for what it does with your data once received, under its own privacy policy. Our partner terms require them to respect your visibility settings, keep keys secure, and delete your Moat data when you delete your page.
Service providers
We use a small number of providers who process data on our behalf, under contract:
- Werify, for email-code sign-in, and for payments when paid plans launch.
- Hosting and content delivery, including Cloudflare for cached files.
- Email delivery, for sign-in codes and notifications.
- Google Analytics, for aggregate site usage.
- LinkedIn, only when you choose to connect it for an import.
Your controls
- Set your profile, activity and connections to everyone, connections only, or only you.
- Choose who can message you, and which emails you receive.
- Remove a connected app from your page. It's notified straight away.
- Download your page as a résumé PDF.
- Delete your account from your settings.
How long we keep it
We keep your data while your account is active. When you delete your account, we delete your page from Moat, notify every connected app, and remove remaining copies from backups on our regular backup cycle. We may keep limited records longer where the law requires it, such as records of abuse reports.
Your rights
Depending on where you live, you can ask us to:
- give you a copy of your data, or send it to another service;
- correct data that's wrong, or delete it;
- restrict or object to how we use it;
- withdraw consent you've given, such as for analytics.
California residents have the right to know, delete and correct personal information and to opt out of its sale or sharing. We don't sell or share personal information for cross-context behavioural advertising. We won't treat you differently for using your rights.
To make a request, contact us. We'll confirm it's you, then respond within one month, or sooner where the law requires. When you ask us to correct or delete data, we pass that on to each connected app. You can also complain to your local data protection authority.
International transfers
Our providers may process data outside your country. Where the law requires it, we use recognised safeguards such as standard contractual clauses.
Security
Connections use HTTPS. Session cookies are Secure and SameSite, and session identifiers can't be read by page scripts. Partner keys are server-only, webhooks are signed, and public endpoints are rate-limited. No system is perfect. If a breach affects you, we'll tell you and the relevant authorities as the law requires.
Children
Moat is for people aged 16 and over. If you believe a younger person has created a page, tell us and we'll remove it.
Changes
If we make meaningful changes, we'll update the date above and let account holders know before the change takes effect.
Contact
Email [email protected] with "Privacy request" in the subject, or use the contact page. See also our cookie notice and terms of service.