Privacy Policy

molted.cloud is operated by Mathieu Colmon, sole proprietor trading as Third Layer, 31 Boulevard Dubouchage, 06000 Nice, France (SIREN 920 931 623), referred to as "Molted", "we" or "us". This policy explains what personal data we process when you visit our website, create an account and work with your AI agents, why we process it, where it is stored and which rights you have.

For any privacy question, or to exercise your rights, write to support@molted.cloud.

We are the data controller for the data we need to run your account: your identity, billing, support, the security of the service and our website.

For the content you entrust to your agents (instructions, conversations, files, memory, connected accounts, and any personal data about other people they contain), we act as a processor on your behalf. We process it only to provide the service and according to your instructions. You remain responsible for having a lawful basis to share that data with your agent. Business customers can request our data processing agreement.

• Account: email address, name, language, passkeys if you add one, and the name you give your agent.
• Billing: plan, subscription status, payments and invoices. Card details are collected and stored by our payment provider; we never see your full card number.
• Agent content: the instructions, conversations, files, memory, routines, tables, drafts and interfaces that you and your agent create, and the voice notes you dictate.
• Credentials and connected accounts: the AI model account or API key you connect to power your agent, and the apps you authorize it to use. They are stored as encrypted secrets.
• Support: the messages and attachments you send us, and the calls you place through our contact assistant.
• Technical data: IP address, the approximate location derived from it (country, city), browser and device type, logs and error reports.
• Acquisition data: how you found us (campaign parameters and referring website) and, where you consent to it, data collected by advertising tags.

• To provide the service: create and run your agents, sign you in, answer your support requests (performance of our contract with you).
• To bill you and keep accounting records (performance of the contract and legal obligation).
• To keep the service secure: rate limiting, fraud and abuse prevention, investigation of suspicious activity as described in our Terms of Service (legitimate interest).
• To operate and improve the service: error monitoring, performance and audience measurement (legitimate interest, or your consent where the law requires it).
• To measure our campaigns and show relevant advertising (your consent where the law requires it).
• To send you service emails: sign-in codes, billing, important changes (performance of the contract).
• To comply with our legal obligations and answer lawful requests from authorities (legal obligation).

We do not sell your personal data. We do not use your agents' content or your conversations to train AI models.

Your agent thinks with the AI model you connect, for example your ChatGPT subscription or your own API key. Its requests to that model are sent to the provider you chose, which processes them under its own terms and privacy policy.

Some dashboard features, such as voice dictation and automatic conversation titles, rely on AI providers selected by us. We only send them what the feature needs (the voice note, or the beginning of your first message) and only to return the result.

Website and account: the molted.cloud website and dashboard are hosted by Vercel Inc. (United States) on its global network. Account, billing and dashboard data (including tables, drafts, shared conversation links and conversation titles) is stored with managed cloud providers that may process it in the European Union or in the United States.

Your agents: each agent runs on its own isolated computer in the region you choose when you hire it, currently Europe or North America. Its workspace (files, memory, conversations and credentials) is stored in infrastructure located in that region.

Transfers outside the European Economic Area: when a provider processes data outside the EEA, in particular in the United States, the transfer relies on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified providers) or on the standard contractual clauses adopted by the Commission.

Your data is only accessible to authorized members of our team who need it for their work, and to service providers acting on our instructions under contractual confidentiality and data protection commitments. These providers fall into the following categories:

• website hosting and content delivery
• cloud infrastructure and data centers running your agents, in the region you choose
• managed database and file storage
• payment processing
• transactional email delivery
• security, rate limiting and error monitoring
• the integration and browser infrastructure that powers your agent's connected apps and web browsing
• AI providers used for voice dictation and conversation titles
• customer support and contact tools
• audience measurement and advertising partners, listed in the cookies section below
• public authorities, only where the law requires it

For security reasons, we do not publish the names of our infrastructure providers. Customers who need the list of our sub-processors for their own compliance can request it at support@molted.cloud.

Our team does not look at your agent's workspace in the normal course of operations. Access is restricted to a small number of authorized people and is limited to what is necessary: when you ask us for help, when our systems detect activity that may be unlawful or harmful (as described in our Terms of Service), or when the law requires it.

• Strictly necessary: your sign-in session (7 days, renewed while you use the service), your language, the agent you last opened, and the continuity of a request started on molted.studio (24 hours). These do not require consent.
• Measurement: cookieless, aggregated audience and performance analytics, and error monitoring that may record a masked replay of a session in which an error occurs (text and media are hidden).
• Advertising and conversion measurement: tags from Google (Tag Manager and Ads), Reddit and X, and a business visitor identification service on our marketing pages. They are subject to your consent where the law requires it, and kept for the duration set by each partner.

You can delete cookies at any time from your browser settings. Refusing advertising cookies does not affect your access to the service.

• Account data: as long as your account is active.
• Agents: an agent's workspace is kept while the agent exists. When a subscription ends, the agent is stopped and its workspace is kept so you can reactivate or export it; we may permanently delete it from 30 days after the end of your subscription. Deleting an agent, or your account, deletes its workspace and disconnects its accounts.
• Billing records: 10 years, as required by French accounting law.
• Support requests: as long as your account is active.
• Sign-in codes: 10 minutes.
• Technical and security data: as long as necessary to secure the service and prevent fraud.
• After your account is deleted, we keep a minimal record (your email address and technical sign-up data) only as long as necessary to prevent fraud and abuse, for example to enforce a suspension, and to meet our legal obligations.

• Encryption in transit (HTTPS) for every exchange with the website, the dashboard and your agents
• Credentials and API keys encrypted at rest (AES-256)
• One isolated computer per agent, never shared between customers
• Passwordless sign-in by one-time code or passkey
• Rate limiting and abuse detection
• Access to production systems restricted to authorized people

No system is perfectly secure. If a breach affecting your personal data is likely to create a risk for you, we will notify the competent authority and, where required, inform you.

Under the GDPR and applicable law, you have the right to:

• access your personal data
• have it corrected
• have it deleted
• restrict its processing
• object to its processing, and to direct marketing at any time
• receive it in a portable format
• withdraw your consent at any time
• give instructions about what happens to your data after your death

To exercise these rights, write to support@molted.cloud from the email address of your account. We answer within one month. You can also delete your agents and your account yourself from the dashboard.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr) or with the data protection authority of your country.

The service is intended for people aged 18 and over. We do not knowingly collect data from minors.

We may update this policy. We will tell you about any significant change by email or in the dashboard before it applies.

If you have questions about this Privacy Policy or our privacy practices, please contact us at support@molted.cloud.