How we handle your data

What we collect

When you use Moonshot Travel, we collect:

• Phone number or work email — your sign-in identifier, managed through Clerk
• Email address — also collected at booking, because the hotel needs it to fulfill your reservation
• Traveler details — names, dates of birth, and passport details where a supplier requires them to complete a booking
• Booking history — hotels you book through us, and the flights and hotels you ask us to watch
• Travel preferences and past trips — preferences you state, and trips you've taken that you share with Percy (our AI assistant); view and delete them anytime at msos.ai/memory
• Chat messages — conversations with Percy
• Device information — platform and push notification tokens for price and disruption alerts
• Corporate data — if your organization enables it: calendar data (via Google) and CRM data (Salesforce or HubSpot, via Nango). We only access these with your organization's consent

How we use it

• Search and book hotels on your behalf
• Monitor prices on your bookings after you book, and on flights and hotels you booked elsewhere and asked us to watch
• Ask you when we find a meaningful price drop — rebooking happens only with your explicit confirmation, and only on bookings made through Moonshot
• Monitor booked flights for delays and cancellations
• Personalize suggestions based on your history and stated preferences
• Power corporate dashboards for organizations you've joined
• Improve our price prediction models using anonymized, aggregated data

Who we share it with

We share data with these services to operate Moonshot Travel:

• Duffel — fare checks on flights you ask us to watch (receives routes and travel dates, not your identity)
• LiteAPI and Hotelbeds (HBX Group) — hotel search, booking, and rebooking (receive guest details and stay dates)
• Hotels — receive the guest details and email address needed to fulfill your reservation
• Stripe — payment processing (receives payment details; we never store card numbers; charges appear as "MOONSHOT TRAVEL")
• Clerk — authentication (manages your phone-number sign-in)
• Nango — CRM connections for corporate accounts (Salesforce, HubSpot), only with your organization's consent
• FlightAware (AeroAPI) — flight disruption monitoring (receives flight numbers and dates, not your identity)
• AI providers — process your Percy conversations to generate responses, and read the booking confirmations you upload or let Percy find in Gmail
• ElevenLabs — Percy's voice, if you talk to him (receives the audio of that conversation)
• Resend — sends our emails (receives your email address and the message)
• PostHog — product analytics (receives the pages you view and features you use, tied to an account ID, never your name, email or phone number; honours Do Not Track)
• RevenueCat — manages Pro subscriptions (receives your account ID and subscription status)
• Mapbox — maps (receives the map area you view and your IP address)
• Twilio — delivers our SMS and WhatsApp messages, if you turn either channel on (receives your mobile number and the messages)
• Meta — operates WhatsApp and processes your WhatsApp account information and messages when you connect Percy on WhatsApp
• Vercel, Neon and Railway — the hosting and databases the service runs on, where your data is stored

We do not sell your data. We do not serve ads. We do not share your information with data brokers.

Text messages

If you turn on texts from Percy, we use your mobile number to text you about your trips: a requested code to verify your number, then only the categories you separately selected. Informational updates include requested Percy replies, cancellation deadlines, flight status and arrival reminders; marketing alerts cover price drops and other savings opportunities for trips you are watching. When you text Percy, he may answer after either category is active because the reply was requested by you. Message frequency varies, usually a few messages per trip. Message and data rates may apply. Reply STOP to stop all texts, START to resume previously selected categories, or HELP for help, or turn texts off at msos.ai/texts.

We keep the selected category, number, disclosure version and wording, source and time of each consent change, plus number verification and opt-out records and the texts we send and receive. We do not sell your mobile number, and we do not share it or your consent to receive texts with third parties or affiliates for their marketing. We share it only with the service that delivers our texts (Twilio), to deliver them.

WhatsApp messages

WhatsApp consent is separate from SMS consent. We do not copy your SMS choices into WhatsApp. You select the WhatsApp message categories you want, then activate the channel by sending START PERCY from your WhatsApp account. Within WhatsApp's customer-service window, Percy can answer messages you send. Outside that window, Moonshot can initiate only message types allowed by your choices and by an approved WhatsApp template.

We retain your selected categories, consent wording and version, activation and opt-out events, message delivery metadata, and the WhatsApp messages we send and receive. Reply STOP in WhatsApp to disconnect it. This does not change your separate SMS preferences. Twilio and Meta process the number and messages to deliver WhatsApp service.

Past trips and Gmail

You can teach Percy from trips you've already taken, by uploading old confirmations or by letting him read your Gmail at msos.ai/learn. For each past trip we keep one line (the hotel or route, the dates, and what you paid) with your preferences at msos.ai/memory, where you can remove it.

If you connect Gmail, we ask Google for read-only access, search only for hotel and flight confirmations from the last three years, and read them once while you watch. The emails themselves are not stored. Their text is sent to our AI provider to read the booking details, and is not used to train AI models. We never send, change or delete email, we don't keep ongoing access (Gmail is disconnected when the scan ends, and you can also remove access in your Google Account), and we don't use Gmail data for advertising or share it with anyone else.

Moonshot Travel's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Corporate visibility

If you join an organization on Moonshot, its admins can see your travel spend, trips, expenses, and revenue matched from the organization's CRM. Calendar and CRM data are accessed only with the organization's consent. If you leave the organization, admins lose access to your future activity.

Data retention

We keep your data for as long as your account is active. Booking records are kept for 7 years (tax and legal compliance). Chat history is retained for 12 months. Preferences and past trips you delete at msos.ai/memory are removed immediately.

Deleting your account

To delete your account, email support@msos.ai with the phone number or email you sign in with. This removes your profile, preferences, and chat history. Two things to know:

• Existing reservations remain valid — deleting your account does not cancel your flights or hotel stays. Cancel those separately first if you want to
• Booking records we're legally required to keep are retained for 7 years in anonymized form

Your rights

Regardless of where you live, you can:

• Access all data we hold about you
• Correct inaccurate information
• Delete your account and associated data
• Export your data in a portable format
• Opt out of non-essential data processing

GDPR (EU/EEA): You have the right to data portability, restriction of processing, and to lodge a complaint with your local supervisory authority.

CCPA (California): You have the right to know what data we collect, request deletion, and opt out of data sales (we don't sell data).

Security

All data is encrypted in transit (TLS) and at rest. Authentication is handled by Clerk with industry-standard security practices. Payment data is processed by Stripe and never touches our servers. Database access is limited to the people who run the service.

Contact

Questions about your data? Email support@msos.ai. Legal questions? Email legal@msos.ai.

Moonshot OS, Inc.
717 N Highland Ave, Suite 12
Los Angeles, CA 90038