Why this policy exists
Moonbrush Inc. (“Moonbrush,” “we,” “us” or “our”) builds scored audiences from information about U.S. adults who do not have a direct relationship with us. That puts a duty on us to decide, in advance, what our data and models may and may not be used for, and to hold our clients to the same standard.
This policy summarizes those rules in plain language. Each client’s signed agreement contains the binding version, and an agreement may be stricter than this policy.
Permitted use: marketing and engagement only
Clients may use Moonbrush data, models and outputs only for marketing and engagement, and only for the specific purpose written into their agreement. Any purpose not written down is prohibited. Within those limits, permitted uses include:
- Audience creation. Building modeled audiences for a client’s own marketing on its own channels.
- Messaging and creative. Personalizing messaging and creative for the client’s own brands.
- Measurement and attribution. Measuring how a client’s campaigns perform, including with holdout groups.
- Analytics and insight. Understanding audiences, motivations and categories in aggregate.
- Enrichment. Adding our scores to a client’s environment or clean room, for the same permitted uses.
Marketing, fundraising, recruitment and outreach communications are permitted. Decisions about individuals are not.
Bright lines
These prohibitions apply to Moonbrush, to every client, to every user at a client, and to every downstream recipient. They are not negotiable.
| Never | What this means in practice |
|---|---|
| Eligibility decisions | No use in decisions about credit, lending, insurance underwriting, employment or tenant screening, housing eligibility, education admission or financial aid, healthcare diagnosis or treatment, or any other decision with legal or similarly significant effects on a person. No use for any purpose covered by the Fair Credit Reporting Act. Our data is not a consumer report and is not assembled or evaluated for eligibility purposes |
| Modeled ethnicity or political ideology | These fields are never selectable, never used as targeting inputs and never exported. They are blocked at the schema, query and product layers |
| Discrimination | No targeting, exclusion or different treatment based on race, color, ethnicity, religion, national origin, disability, sexual orientation or gender identity, or a proxy for one. Age range and gender may shape marketing audiences, but never who sees or is excluded from an offer of credit, housing, employment or insurance |
| Exploiting vulnerability | No targeting that exploits bereavement, addiction or recovery status, acute medical or mental-health distress, financial hardship or a similar vulnerability |
| Minors | Our data products exclude anyone under 18, by design. No use directed at minors, and no collection, modeling or targeting of children |
| Protected health information | We do not ingest protected health information in our standard services. We do not offer targeting of individuals based on a health condition |
| Individual lookup | We offer no individual lookup or people-search product. No one may use our data to look up or research a named person |
| Precise location and surveillance | We do not collect or sell precise geolocation. No precise geolocation targeting, tracking of an individual’s movements, or device-level surveillance of identified people |
| Law enforcement and government surveillance | We do not sell data to law enforcement or for surveillance. No use for law enforcement, criminal justice, immigration enforcement, intelligence or state surveillance |
| Re-identification and resale | No attempt to re-identify hashed or de-identified data, no combining data to create or infer identities, and no resale, sublicensing or redistribution of our data or any dataset containing it |
| Training other AI | No use of our data or outputs to train, fine-tune, calibrate or validate any other model. No embeddings or other learned representations. No submitting our data to a third-party AI system that may retain or train on it |
| Reverse engineering | No attempt to reverse engineer, extract or replicate our models, scores or data, and no use of them to build or benchmark a competing product |
How we build the limits into our products
Delivery
- Hashed identifiers. In standard delivery, clients receive hashed identifiers (SHA-256) and scores. Raw personal information, such as names, postal addresses, email addresses and phone numbers in readable form, does not leave our environment.
- Hashing happens inside our pipeline. When an audience is prepared for an advertising platform, we hash identifiers within our own environment.
- Professional audiences. For marketing to health care professionals, files may be keyed to the National Provider Identifier and delivered into the client’s own environment or a clean room.
Client data
- Client first-party data stays in the client’s own instance. We use it only for that client.
- Client first-party data never trains models shared with other clients.
- We may use aggregated or de-identified information, which does not identify the client or any person, to validate and improve our models.
- Clients must not send us protected health information (unless a business associate agreement is signed and the client’s agreement expressly permits it), data about minors, government identification numbers, financial account numbers, biometric identifiers or precise geolocation. If any arrives by mistake, we delete or return it.
Model governance
- The publish gate. We publish a model only if it outperforms both a demographic baseline and a lookalike baseline on the client’s own holdout data. Models that fail are not released, and every kill decision is logged.
- Model cards. Clients can request a model card for each delivered model. It describes the model’s intended use, validation evidence and known limitations, and distinguishes observed signals from modeled inferences.
- Honest outputs. Our scores are probabilistic estimates. We do not present them as certain explanations of any individual’s behavior.
Privacy choices
- When a person opts out or asks us to delete their information, we suppress their identifiers across our consumer graph, scored outputs and client deliveries, and the suppression carries through each monthly rebuild.
- We apply each client’s own suppression files, including opt-outs and do-not-contact records, to every activation we run for that client.
How clients are bound
Every client signs an agreement that incorporates these restrictions. Under our standard agreements:
- Permitted purpose in writing. Each engagement states its permitted purpose. Using our data for anything else requires a signed amendment.
- Named users and access controls. Only individually authenticated users with a need to know may access our data. Clients must apply least-privilege access and multi-factor authentication where feasible.
- Downstream recipients. An agency, partner or reseller may pass our data or outputs to its own customer only as needed for the permitted purpose, and only under written terms at least as protective as ours. The client remains liable for every downstream recipient, and we can enforce those terms directly.
- Audit rights. We may audit a client’s compliance once every 12 months on 30 days’ notice, and sooner if we suspect misuse, unauthorized disclosure or a security incident. Clients keep records that show compliance, including user lists and downstream agreements.
- Monitoring and suspension. We monitor use of our systems and may suspend access immediately if we reasonably believe our data is being misused.
- No cure period. Breaching a bright line is a material breach. No cure period applies, and we may terminate.
- Return or destruction. When an engagement ends, or when we ask, the client must stop using our data and return or securely destroy it, and certify that it has done so.
- Legal compliance. Clients are responsible for complying with the laws that apply to their marketing, including giving required notices and obtaining required consents, and for their own legal and regulatory review of creative and claims.
- Accurate claims. Clients may not make public claims about the size, composition, accuracy, origin or performance of our data or models beyond what we have stated to them in writing.
- Self-reporting. A client that learns of a breach of these rules, by itself or anyone downstream, must tell us without undue delay, stop the use and help fix it.
Reporting a concern
If you believe Moonbrush data is being used in a way this policy prohibits, contact legal@moonbrush.com. For questions about your own information, see our Privacy Notice or email privacy@moonbrush.com.
Changes to this policy
When we update this policy, we change the date at the top.
Contact us
Moonbrush Inc.
Attn: Legal
5830 E 2nd Street, Suite 7000
Casper, Wyoming 82609, USA
Email: legal@moonbrush.com