Privacy policy

Version 1.2. Last updated 31 October 2026.

This policy says what data Mozee keeps, why, who helps us run Mozee, and how long data stays. It covers app.mozee.co, the booking pages on it and the emails Mozee sends.

Who we are

Mozee is run by MOZEE LLC, a Delaware limited liability company in the United States. In this policy, “we” means MOZEE LLC.

Write to us at support@mozee.co about anything in this policy.

Our two roles

Mozee has two kinds of users. A pro signs up and shares a booking link. A client books time with a pro.

For pro accounts, we are the controller. We decide what we keep and why.
For the data a client enters to book, we are a processor. We keep it for the pro, and the pro is the controller. Our data processing agreement covers this.
For the counts that stop fake bookings, we are the controller. We keep them only as one-way codes, never as an email or IP address.

What we keep about pros

Your email address and your name.
Your handle (the name in your booking link), your time zone, and your language and region setting.
Your working hours and your booking types.
Your bookings, with the client details listed in the next section.
Your sign-in sessions. A session holds no IP address and no browser details.
When you ask for a sign-in code, a record with your email address. The code expires after 5 minutes and is stored only as a hash. An unused record can stay until you ask for a new code.
If you sign in with Microsoft: Microsoft's access and refresh tokens, encrypted, and the sign-in token Microsoft sends (an ID token). The ID token holds your name, your email address and your Microsoft account ids. It is not encrypted, and it gives no access to your calendar.

At Microsoft sign-in, Microsoft asks you to let Mozee read and write your calendar. We do not read your calendar yet. Once calendar sync ships, we will use your tokens to see when you are busy and to add your Mozee bookings to your calendar.

What we keep about clients

When a client books a pro, we keep:

The client's name and email address.
The client's time zone, and their language and region setting, so times and emails make sense to them.
The booking: its time, its booking type, and any later move or cancel.

The booking form asks for a name and an email address and nothing else. We store no IP address with a booking.

How we stop fake bookings

To stop spam, we count bookings and sign-in code requests per email address, per IP address and per pro. We store each count under a one-way code (an HMAC), never the email or IP address itself. A count is deleted a day or two after its last use.

What we do not collect

No tracking and no ads.
No analytics cookies.
Our pages load nothing from other websites: no outside fonts, scripts or images.

To check page speed, your browser tells us how fast a public page loaded. We keep the speed, the kind of page, how the page was opened (for example a new visit, a reload, or back or forward), phone or computer, and a broad region (EU, US or rest of the world) worked out from your time zone. We keep no IP address, web address or browser details with it.

Why we may use this data

To run your account, sign you in and take bookings for you. We need this to give you the service you signed up for (GDPR Art. 6(1)(b)).
To stop spam and keep Mozee safe and fast. This is our legitimate interest in a working, safe service (GDPR Art. 6(1)(f)).
Client booking data: the pro decides why it is used. We use it only as the pro's instructions and our data processing agreement allow.

A client must give a name and an email address to book, and a pro must give an email address to sign in. Without them, we cannot take the booking or make the account.

We do not sell data. We share it only with the companies listed below, and when the law makes us.

Cookies

We use only the cookies Mozee needs to work. None of them track you, so there is no cookie banner.

Cookies
Cookie	What it does	How long
Session	Keeps a pro signed in	7 days after last use, or until you sign out
Sign-in	Remembers your email address between asking for a code and typing it	10 minutes
Microsoft sign-in check	Checks that a Microsoft sign-in comes back to the browser that started it	10 minutes or less
Form	Brings back what you typed when a form shows an error	60 seconds
Time zone	Remembers your time zone on booking pages	1 year

Who helps us run Mozee

These companies process data for us. Each keeps it where the list says.

Render
What it does
Runs the Mozee app and its database, with short-term backups and request logs.
Where
Frankfurt, Germany
Data
All Mozee data.
Resend
What it does
Sends Mozee emails: sign-in codes and booking emails.
Where
Sends from Ireland. Stores account data, email records and logs in the United States.
Data
Each email: the address it goes to, the names in it and the booking details.
Better Stack
What it does
Keeps our logs and checks that Mozee is up.
Where
EU
Data
Log lines with account and booking ids. Mozee masks email addresses and leaves out names, IP addresses and tokens before a line is written.
Scaleway
What it does
Stores the nightly backup of the database.
Where
Amsterdam, the Netherlands
Data
A full copy of the database.
Microsoft
What it does
Sign-in with Microsoft. Later, the calendar sync you turn on.
Where
Where Microsoft keeps your Microsoft account
Data
Your Microsoft account details. Once calendar sync ships: when you are busy, and the events for your Mozee bookings.
Cloudflare
What it does
Runs DNS for mozee.co and passes on emails sent to support@mozee.co.
Where
Global network
Data
Emails you send to support@mozee.co, on their way to us.
GitHub
What it does
Stores the source code of Mozee.
Where
United States
Data
No personal data.

How long we keep data

How long we keep data
Data	How long
Your account, bookings and client details	While your account exists
Sign-in sessions	They stop working 7 days after last use. The record can stay until your account is deleted.
Database backups	Up to 30 days
Logs	Up to 30 days
Emails at Resend	30 days, plus 7 days in Resend's backups
Background job records	7 days
Spam counts	A day or two after last use

When we erase data, copies in our backups and logs age out within 30 days, and copies at Resend within 37 days.

Deleting data

Pros: a button to delete your account comes in a later version of Mozee. Until then, email support@mozee.co from the address you sign in with, and we delete your account.
Clients: ask the pro you booked with. You can also write to support@mozee.co. We pass your request to the pro and help them answer it.

Your rights

If the GDPR covers you, you can ask us to:

show you the data we keep about you (access),
fix it (correction),
delete it (erasure),
limit how we use it (restriction),
give it to you in a file you can take to another service (portability),
stop using it for a purpose you object to (objection).

Write to support@mozee.co. We may ask you to show the data is yours before we act. If we hold the data for a pro, we pass your request to that pro.

You can also complain to a data protection authority, for example where you live or work. The EU authorities are listed at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

Where data is stored

We keep Mozee's database, backups and logs in the EU. The database runs in Frankfurt, Germany, the nightly backup sits in Amsterdam, the Netherlands, and Better Stack keeps our logs in the EU.

Emails are different. Resend sends them from Ireland, but stores our account, its record of each email and its logs in the United States. That record holds the address the email went to, the names in it and the booking details.

MOZEE LLC is a US company. When we reach the data from outside the EU, that counts as a transfer. The European Commission's Standard Contractual Clauses cover it. You can get a copy of these clauses from support@mozee.co.

Resend's data processing agreement covers its transfers with the Standard Contractual Clauses, and says Resend follows the EU-US Data Privacy Framework. Some of the other companies listed above are US companies too, and their own terms cover their transfers.

Google user data

Google sign-in and Google Calendar are not live in Mozee yet. This section says what Mozee will do with Google data once they ship.

Sign in with Google: we use your name, your email address and your Google account id to create your account and sign you in.
Connect Google Calendar: Mozee asks for two permissions. calendar.calendarlist.readonly lets Mozee see the list of your calendars, so you can pick which ones block booking times. calendar.events.owned lets Mozee read the events on calendars you own, to see when you are busy, and add, move and remove the events for your Mozee bookings.
From your events we keep only each event's id and its start and end time. We do not keep event titles, descriptions, places or guests.
Google tokens are stored encrypted.
When your account is deleted, your Google data is deleted with it.

Mozee's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

So we use Google data only to run the calendar features you see in Mozee. We do not sell it, use it for ads, or use it to train AI models. People at Mozee do not read it, unless you ask us to, security needs it, or the law requires it.

Changes

When we change this policy, we change the version and date at the top.