Privacy Policy

DRAFT — this document is pending attorney review and is provided as a good-faith summary of how MoldDesk operates. It is not yet a final legal agreement.

Effective date: September 24, 2026

1. Who we are

MoldDesk (“MoldDesk”, “we”, “us”) is software for mold inspection businesses, operated by [ENTITY], [ADDRESS]. This policy explains what we collect, why, and the choices you have. Questions: hello@molddesk.com.

2. Data we collect

Account data. Name, email address, password (stored as a hash by our authentication provider), company name, and role within your company.

Inspection and report data. Content your company enters to produce inspection and clearance reports: client names and contact details, property addresses, observations, sample records, photos, lab result documents, and voice dictation you choose to record (transcribed to text). This data typically describes your company’s clients and their properties; your company controls it and is responsible for having the right to enter it. When you type a property address, the text you have typed is sent to Google Places to suggest matching addresses; choosing one fetches that address’s details.

Billing data. Subscription plan, seat counts, and invoice history. Card numbers are collected and processed by Stripe — they never touch MoldDesk servers.

Usage and diagnostics. Product analytics events (pages used, features exercised) and error reports, associated with your account identifier.

Technical data and cookies. We use essential cookies to keep you signed in and secure your session; our analytics and error tools may set their own identifiers. We do not use advertising cookies. Our hosting and security providers record standard technical logs (such as IP address and browser type) to operate and protect the service.

3. Google sign-in

You can sign in with your Google account. When you do, Google sends us your name, email address, and profile picture so we can create or sign you into your MoldDesk account — that is all we receive. We do not get access to your Google contacts, files, or calendar, and we never post to Google on your behalf. Our use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements. What Google does with your data is covered by Google’s own privacy policy.

4. How we use data

  • Provide the service: reports, PDFs, scheduling, team management, client share links.
  • Process voice dictation into text and, when you request it, AI-polish that text.
  • Bill subscriptions and, where your company enables it, process client payments.
  • Send transactional email (invites, report delivery, billing notices).
  • Diagnose errors, measure product usage, and improve the service.

We do not sell personal information, and we do not use your report data for advertising.

5. Service providers (subprocessors)

We rely on the following providers to run MoldDesk:

  • Supabase — database, file storage (photos, PDFs), and authentication
  • Vercel — application hosting
  • Stripe — subscription billing and, for companies that enable it, client payments
  • Resend — transactional email delivery
  • Deepgram — voice-to-text transcription of dictation you record
  • Anthropic — AI text polish of dictated notes, when you request it
  • Google — sign-in with your Google account, when you choose it, and address suggestions (Google Places) when you type a property address
  • Cloudflare — bot protection (Turnstile) on our sign-in, sign-up, and password-reset forms
  • Sentry — error monitoring
  • PostHog — product analytics

6. Sharing

Report data is shared outside your company only when your company shares it — for example, a report link your company sends to its client. We disclose data if required by law, or as part of a merger/acquisition with notice to you.

7. Retention and deletion

Account and report data are retained while your subscription is active. When your account closes, or when you ask us to delete data, it is kept for up to 90 days and then purged, including from our backups, except records we must keep (for example, billing records). To request deletion, email hello@molddesk.com.

8. Security

Data is encrypted in transit and at rest; tenant data is isolated per company at the database layer; access to production systems is limited. No system is perfectly secure — report concerns to hello@molddesk.com.

9. Your rights

Depending on where you live (including California under the CCPA/CPRA), you may have rights to access, correct, delete, or export personal information, and to not be discriminated against for exercising them. Contact us and we will respond as required by applicable law. If your data was entered by a mold inspection company using MoldDesk, we may direct your request to that company, which controls it.

10. Children

MoldDesk is a business tool, not directed to children under 13, and we do not knowingly collect their data.

11. Changes

We will post changes here and, for material changes, notify account owners by email before they take effect.

See also our Terms of Service.