Privacy Notice

About this notice

Moonbrush Inc. (“Moonbrush,” “we,” “us” or “our”) is a U.S. behavioral intelligence company and a Wyoming corporation. Our products are atlas, our audience intelligence system, and stage, our behavioral intelligence workspace. Both are powered by Gravity, our family of models. Businesses and organizations use them to plan and target their marketing.

This notice explains how we handle personal information about three groups of people. Each group has a different relationship with us, so each has its own section.

If you belong to more than one group, each section applies to the information we hold about you in that role. For example, a client contact may also be one of the U.S. adults in our data.

This notice does not cover information about our own employees and contractors in their working relationship with us. It also does not cover personal information that a client collects and sends to us to process on the client’s behalf. The client’s own privacy notice governs that information. See Information our clients give us.

Key points

• We sell and share personal information about people in our data. We deliver audiences of hashed identifiers and scores to clients for their marketing, including cross-context behavioral advertising through media platforms. California law treats this as selling and sharing. You can opt out at any time at Do Not Sell or Share My Personal Information.
• You can limit our use of health-interest information. Some of our inferences reflect interest in health and wellness topics. California law treats them as sensitive, and you can tell us to stop using them at Limit the Use of My Sensitive Personal Information.
• We do not sell or share information about website visitors or business contacts.
• Some things we never do. Our data products exclude anyone under 18 by design. We do not collect precise geolocation. Modeled ethnicity and political ideology are never selectable for targeting. We do not offer individual lookups, and our data may not be used for credit, insurance, employment, housing or other eligibility decisions.
• You can make a request at Your Privacy Choices, by calling (877) 756-6662 toll-free, or by emailing privacy@moonbrush.com.

Website visitors

This section applies when you visit moonbrush.com.

What we collect and how

• Automatically. Our website host, Netlify, processes technical information such as your IP address and browser type to deliver the site and keep it secure. We store your cookie choices in your browser.
• With your consent. If you accept analytics cookies, Google Analytics 4 collects information about how you use the site. If you accept marketing cookies, HubSpot’s tracking code records your visits so we can connect a form you submit to the visit that led to it. Neither loads before you make a choice. Our Cookie Policy lists each cookie.
• From you. When you fill in a form, we receive what you enter and handle it as described under Business contacts and job applicants.

Google signals and ad personalization are turned off in our analytics. We do not use advertising cookies on moonbrush.com.

Notice at collection: website visitors

Sources: your browser or device and, with your consent, the analytics and marketing cookies described in our Cookie Policy.

We do not collect sensitive personal information through the website.

Do Not Track

Some browsers send a “Do Not Track” signal. There is no common standard for how websites should respond to it. We honor Global Privacy Control, which California law recognizes as an opt-out request, along with the choices you make in our cookie banner. See Global Privacy Control.

Business contacts and job applicants

This section applies if you are a client, prospect, partner or vendor of Moonbrush, if you work for one, or if you apply for a job with us. It also applies when you contact us through a website form, by email, by phone or at an event.

What we collect and how

• From you. Your name, business contact details, company and job title, and what you tell us in forms, emails, calls and meetings.
• From others. Your organization, your colleagues, and people who introduce us to you.
• From public sources. We may use company websites, professional networking profiles and news coverage.
• Automatically, with your consent. If you accepted marketing cookies, the visits to moonbrush.com that led to a form you submitted.
• Recordings. We record a call or video meeting only when everyone on it knows and agrees.

If you apply for a job, we collect your application, resume, work history, education, references and interview notes. If we offer you a role, we may conduct background screening as permitted by law and with any notice and authorization the law requires.

Notice at collection: business contacts and job applicants

Sources: you; your organization and colleagues; people who introduce us; public sources such as company websites, professional networking profiles and news coverage; and, with your consent, marketing cookies on moonbrush.com.

We do not use sensitive personal information about job applicants to infer characteristics about them.

People in Moonbrush’s data

This section applies to U.S. adults whose information is in the data we license and use to build audiences for clients. You have not given your information to us, and we do not have a direct relationship with you. That is why this notice explains our practices in detail, and why you can exercise your rights, including the right to opt out, directly with us.

What Moonbrush does

Our clients include pharmaceutical marketers (to consumers and to health care professionals), advertising and media agencies, higher education institutions, financial services firms, publishers, retail and consumer goods companies, and nonprofit and advocacy organizations. They use our products to decide whom to reach with their marketing, fundraising and outreach.

Our consumer graph covers 270M+ U.S. adults, resolved to individuals and households. We build it from licensed data and rebuild it every month. Our modeling of digital activity refreshes daily. Gravity models use this data to produce scores for propensity, motivation, decision style, receptivity and persuadability. A score is a probabilistic estimate. It can be wrong about any individual.

Where the information comes from

• Data providers. We license behavioral, demographic and contact information from third-party data providers, data cooperatives and identity-resolution services. Our providers represent that they collected the information lawfully, and they pass opt-out requests through to us.
• Our models. We create inferences, such as scores and modeled characteristics, from the licensed information.
• Client websites. Where a client places our tag on its own website and discloses that in its own privacy notice, we receive information about engagement with that client’s site and content.

We do not collect information directly from you, except when you contact us or make a privacy request.

How we match records

We match records about the same person or household using hashed email addresses and phone numbers, postal addresses and UID 2.0 tokens. Hashing (we use SHA-256) turns an email address or phone number into a fixed code, so records can be matched without exchanging the readable value. Hashed identifiers are still personal information under California law, and we treat them that way.

How we use it

• Build and maintain our consumer graph.
• Develop, train and validate our Gravity models. Before we release a model to a client, it must outperform both a demographic baseline and a lookalike baseline on that client’s own holdout data.
• Build, score and deliver audiences for clients’ marketing and engagement, and measure how their campaigns perform.
• Activate audiences in advertising and media platforms on a client’s behalf, when the client asks us to.
• Honor opt-out, deletion and other privacy requests, and keep the suppression records that make those choices last.
• Keep our systems secure, prevent fraud and misuse, enforce our client agreements and comply with law.

What our data is never used for

Our client agreements limit use of our data to marketing and engagement. Neither we nor our clients may use it for:

• decisions about credit, insurance, employment, housing, education admission or financial aid, or any other eligibility decision covered by the Fair Credit Reporting Act;
• law enforcement, immigration enforcement or surveillance. We do not sell data for these purposes;
• looking up a specific person. We do not offer individual lookup or people-search products;
• targeting on modeled ethnicity or political ideology. These fields are never selectable, never used as targeting inputs and never exported.

Our Data Use and Responsible Use Policy has the full list.

How we deliver audiences

In standard delivery, clients receive hashed identifiers and scores. Names, postal addresses, email addresses and phone numbers in readable form stay in our environment. Clients receive audiences in their own environment, through a data clean room, or activated in advertising and media platforms. For marketing to health care professionals, audiences may be keyed to the professional’s National Provider Identifier (NPI).

Notice at collection: people in Moonbrush’s data

Sources: every category is licensed from data providers, data cooperatives and identity-resolution services. Inferences also come from our models. Internet activity can also come from client websites that use our tag.

We do not collect precise geolocation or the contents of anyone’s private communications. We do not collect medical records, diagnoses, prescriptions or protected health information. Health and wellness interests of Washington and Nevada consumers are also covered by our Consumer Health Data Privacy Policy, which limits their sale and sharing.

To opt out of the sale and sharing of your personal information, use Do Not Sell or Share My Personal Information. To stop us using health-interest information about you, use Limit the Use of My Sensitive Personal Information.

How long we keep it. The same criteria apply to every category in the table. We keep licensed information while our license from the data provider allows it and we need it to provide our services. We rebuild our consumer graph monthly, and scores change as our models refresh. When you opt out or ask us to delete your information, we keep the minimum information needed to keep honoring your choice each time the graph is rebuilt.

Information our clients give us

Clients sometimes send us their own customer or prospect data, such as a customer list, so we can match it, score it or measure a campaign. For that data, we act as the client’s service provider (or processor) and follow the client’s instructions. The client’s privacy notice explains how it collects and uses that information.

Client data stays in that client’s own instance. We use it only to serve that client. It is never used for another client and never trains models shared with other clients. Unless the client directs otherwise, we keep it for the term of the client’s agreement plus 90 days, and we delete or return it as the agreement says.

If you send us a privacy request about information a client gave us, we will forward it to the client and help the client respond.

We may create aggregated or de-identified information from our work for clients, for example to check and improve our models. That information does not identify any client or any person.

Sale and sharing of personal information

We sell and share personal information. Under California law, a “sale” includes making personal information available to another business for something of value. “Sharing” means making personal information available for cross-context behavioral advertising, which is advertising targeted to you based on your activity across businesses, websites and services. When we deliver an audience of hashed identifiers and scores to a client for its marketing, that is a sale. When that audience is used to deliver advertising through media platforms, whether by the client or by us on its behalf, that is sharing.

In the past 12 months, we have sold or shared these categories of personal information about people in our data:

Categories of third parties to whom we sell or share: our clients (businesses, nonprofit and advocacy organizations, and the agencies that act for them), and advertising and media platforms used to deliver clients’ campaigns.

We do not sell or share personal information about website visitors or business contacts. We never sell or share the sensitive fields we block, such as modeled ethnicity. We have no actual knowledge that we sell or share the personal information of consumers under 16, and our data excludes minors by design.

How to opt out. Use Do Not Sell or Share My Personal Information, call (877) 756-6662 toll-free, or email privacy@moonbrush.com. You do not need an account, and we do not verify your identity for an opt-out. You can also send a Global Privacy Control signal, as described below.

Other disclosures

We also disclose personal information:

• to service providers that process it for us under contract (see Sub-processors);
• to professional advisers, such as lawyers, accountants and auditors;
• when the law requires it, such as in response to a valid subpoena or court order. We disclose only what is required;
• in connection with a merger, acquisition, financing or sale of assets, subject to the commitments in this notice.

Sensitive personal information

California and other state laws treat certain information as sensitive, such as racial or ethnic origin, precise geolocation, health information and account credentials.

• Health and wellness interests. Some of our inferences reflect interest in health and wellness topics or in health-related product categories, inferred from engagement with online content and searches and from purchase categories. We use them, and scores that draw on them, to build audiences for health and wellness marketing. California law treats information concerning a consumer’s health as sensitive, so we treat these inferences as sensitive personal information. They are never diagnoses, and we do not collect prescriptions, medical records or protected health information. We do not use or disclose health-interest information about Washington or Nevada consumers for these purposes, as our Consumer Health Data Privacy Policy explains.
• Modeled ethnicity and political ideology. Some licensed records contain modeled ethnicity. We block it from selection, targeting, model inputs and export. Modeled political ideology is also never selectable, never used as a targeting input and never exported.
• What we don’t collect. We do not collect precise geolocation, account credentials, government identification numbers or the contents of private communications about people in our data, and we do not offer targeting of individuals based on a health condition.
• Website visitors. We do not collect sensitive personal information through the website.
• Job applicants. If we hire you, we collect only the sensitive information the law requires to complete the hire, and we use it only for that purpose.

Right to limit. Because we use health-interest information to infer characteristics about people, California law gives you the right to limit our use and disclosure of your sensitive personal information to purposes the law allows, such as keeping our systems secure and complying with the law. When you limit, we stop using health-interest information about you to build, score or deliver audiences, and we stop disclosing it to clients and platforms. Use Limit the Use of My Sensitive Personal Information, call (877) 756-6662 toll-free, or email privacy@moonbrush.com. You do not need to verify your identity. The Your Privacy Choices link at the foot of every page of our website covers both this right and the right to opt out of sale and sharing.

Your California privacy rights

If you are a California resident, you have the rights below. They apply whether you are a website visitor, a business contact, a job applicant or a person in our data.

Right to know and access

You can ask us to tell you:

• the categories of personal information we have collected about you;
• the categories of sources it came from;
• our business or commercial purposes for collecting, selling or sharing it;
• the categories of third parties to whom we disclose it, and the categories of personal information we sold, shared or disclosed for a business purpose; and
• the specific pieces of personal information we hold about you.

We provide this information in a portable, readily usable format. Our response covers the 12 months before your request and, if you ask, a longer period where California law provides for it.

Right to delete

You can ask us to delete personal information we collected about you. We will delete it and tell our service providers, and the clients and others to whom we sold or shared it, to delete it too, unless that proves impossible or involves disproportionate effort.

For people in our data, we suppress your identifiers across our consumer graph, scored outputs and client deliveries, and the suppression carries through each monthly rebuild. We keep the minimum information needed to make sure your information is not added back when a data provider supplies it again.

The law lets us keep some information in limited cases, for example to complete a transaction, keep our systems secure or comply with a legal obligation. If we keep any information for one of these reasons, we will tell you which one.

Right to correct

You can ask us to correct inaccurate personal information about you. Much of the information we hold is licensed or modeled. Depending on the information and how we use it, we may correct it or, where the law allows, delete it instead. We will tell you what we did.

Right to opt out of sale and sharing

You can tell us to stop selling and sharing your personal information at any time. We process opt-out requests within 15 business days. Once your request is processed, we stop including your information in audiences we sell or share. If we sold or shared your information after you submitted your request and before we processed it, we will tell those recipients about your request and direct them to honor it.

Right to limit use of sensitive personal information

You can tell us to limit our use and disclosure of your sensitive personal information, which for people in our data means inferred health and wellness interests. We process these requests within 15 business days. Sensitive personal information explains what changes when you limit.

Right to non-discrimination

We will not discriminate against you for exercising any of these rights. We will not deny you goods or services, charge you a different price, or provide a different level of quality because you made a request. We will not retaliate against a job applicant for exercising these rights. We do not offer financial incentives tied to personal information.

Rights under other U.S. state privacy laws

Comprehensive privacy laws in these states give residents rights over their personal data: Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island.

Depending on where you live, you may have the right to:

• confirm whether we process your personal data, and access it;
• obtain a copy of your personal data in a portable format;
• correct inaccuracies in your personal data;
• delete your personal data;
• opt out of targeted advertising, the sale of your personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects; and
• in some states, including Oregon and Minnesota, obtain a list of the specific third parties to which we have disclosed personal data.

Not every right is available in every state, and each law has its own exceptions. We honor these rights as each applicable law provides. You can use the same request channels described in How to make a request. We respond within 45 days and may extend that once by 45 more days when reasonably necessary, in which case we will tell you within the first 45 days.

Targeted advertising and sale. Our audience work is targeted advertising and, under these laws, a sale of personal data. One opt-out at Your Privacy Choices covers both.

Profiling. We do not use personal data for profiling in furtherance of decisions that produce legal or similarly significant effects, such as decisions about credit, housing, insurance, education, employment or health care. Our client agreements prohibit clients from using our data for those decisions.

How to appeal

If we decline to act on your request, in whole or in part, you can appeal. Reply to our decision, email privacy@moonbrush.com with “Appeal” in the subject line, or use Your Privacy Choices. We will tell you in writing what we decided and why, within the time your state’s law requires. If we deny your appeal, you can contact your state attorney general, and our response will tell you how.

Global Privacy Control and other opt-out preference signals

Global Privacy Control (GPC) is a setting in some browsers and browser extensions that tells websites you want to opt out of the sale and sharing of your personal information. California and several other states require businesses to honor it.

When moonbrush.com receives a GPC signal, we:

• treat it as a valid request to opt out of sale and sharing for that browser;
• keep marketing cookies off;
• apply the opt-out to you as a person wherever we can associate the browser with you, for example when you submit a form or a privacy request from that browser; and
• show a status on the site confirming that your request was honored.

A GPC signal comes from your browser, so on its own it applies to that browser and device. To make sure your opt-out also applies to your record in our data, submit it at Your Privacy Choices with your name, postal address and email address.

How to make a request

You can make any request described in this notice in these ways:

Tell us which request you are making and which state you live in. If you are one of the people in our data, include your name, postal address and email address so we can find your record.

Verifying your identity

• Opt-out and limit requests. We do not require verification. We may decline an opt-out or limit request only if we have a good-faith, reasonable and documented belief that it is fraudulent, and we will tell you why.
• Requests to know, access, delete or correct. We take reasonable steps to confirm that the request comes from the person the information is about. The steps match the sensitivity of the information and the risk of harm if we disclosed or deleted it in error.
• People in our data. We match the name, postal address and email address you give us against the information we hold. For a request for specific pieces of information, we may also ask you to sign a declaration, under penalty of perjury, that you are the person the request is about.
• Website visitors and business contacts. We match details you give us, such as your email address, against the information we hold.

We never ask for your Social Security number or any account number to verify a request. We use the information you give us for verification only to verify your request, keep our systems secure and keep records of requests. If we cannot verify a deletion request, we will tell you and offer to treat it as a request to opt out of sale and sharing.

Authorized agents

You can ask an authorized agent to make a request for you. For a California request to know, access, delete or correct, the agent must give us your written, signed permission. We may also ask you to verify your identity directly with us or to confirm that you gave the agent permission. We do not ask for these steps when the agent holds a power of attorney under California Probate Code sections 4121 to 4130. An authorized agent can also submit an opt-out request for you, in California and in other states where the law allows it. We may ask the agent for your signed permission.

Response timelines

California data broker information and the Delete Act

California’s Delete Act created the Delete Request and Opt-out Platform (DROP), run by the California Privacy Protection Agency. California residents can use DROP to ask registered data brokers, in a single request, to delete their personal information.

Moonbrush accepts deletion requests directly at any time.

We are completing our review of state data broker registration requirements, including California, Oregon, Texas and Vermont, and will register wherever the law requires. You do not need to wait for a registry: every request described in this notice can be made directly to us, and we treat a deletion request from you the same way whether it comes to us directly or through a state platform.

Request metrics

California regulations (Cal. Code Regs. tit. 11, §7102) require businesses that buy, receive, sell or share for commercial purposes the personal information of 10 million or more consumers in a calendar year to publish metrics about the privacy requests they receive. We post metrics for the prior calendar year on this page by July 1 each year. They show how many requests to know, delete, correct, opt out and limit we received, how many we complied with in whole or in part, how many we denied, and how long we took to respond.

Metrics for calendar year 2025 are being compiled and will be posted here.

Children

moonbrush.com is intended for adults and business users. We do not knowingly collect personal information from or about anyone under 18. Our data products exclude minors by design. If you believe we hold information about someone under 18, email privacy@moonbrush.com and we will delete it.

Data security

We protect personal information with administrative, technical and physical safeguards suited to the data we handle. They include encryption in transit and at rest, single sign-on with multi-factor authentication on our core systems, role-based access with least privilege, limited and logged production access, and client-gated instances that keep each client’s data separate. Our security program is mapped to the NIST Cybersecurity Framework 2.0 and aligned to ISO/IEC 27001:2022. No security program can remove every risk. Our Security Overview has more detail.

Data retention

We keep personal information only as long as we need it for the purposes in this notice, or as the law requires. The tables above give the period or criteria for each group:

• Website visitors: consent records for 12 months, analytics cookies for up to 13 months, marketing cookies for up to 6 months.
• Business contacts: for the relationship, then as long as needed for legal, tax, accounting and dispute purposes.
• Job applicants: for the hiring process, then as long as employment recordkeeping laws require.
• People in our data: while our data licenses allow it and we need it, with minimal suppression records kept so your opt-out and deletion choices last.
• Client data: for the term of the client’s agreement plus 90 days, unless the client directs otherwise.

De-identified information

When we hold de-identified information, we keep it in de-identified form, take reasonable measures to make sure it cannot be linked to a person, and do not attempt to re-identify it, except as the law allows.

International visitors

Our data products cover U.S. adults only. We do not use information about people outside the United States in our data products.

If you visit moonbrush.com or contact us from Canada, the European Economic Area, the United Kingdom or elsewhere outside the United States, this notice applies to the website and business contact information we hold about you. We process that information in the United States.

• Legal bases (EEA and UK). We rely on your consent for analytics and marketing cookies, which you can withdraw at any time. We rely on our legitimate interests to run and secure the website, respond to inquiries, manage business relationships and consider job applications. We rely on contract when we enter into or perform an agreement with you or your organization, and on legal obligation where the law requires us to process information.
• Your rights. Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your personal information, to receive a portable copy, and to withdraw consent. In the EEA or UK, you can complain to your local data protection authority. In Canada, you can complain to the Office of the Privacy Commissioner of Canada.
• Transfers. Where the law requires it, we rely on appropriate safeguards, such as standard contractual clauses, for transfers to the United States.

To make a request, use the contact details below.

California Shine the Light

California Civil Code section 1798.83 lets California residents ask, once a year and free of charge, for information about the personal information we disclosed to third parties for their own direct marketing purposes in the prior calendar year, and the names and addresses of those third parties. To make a request, email privacy@moonbrush.com or write to us at the address below with “Shine the Light Request” in the subject line, and include your name and California address. We will respond as the law requires.

Nevada residents

Nevada residents can submit a verified request directing us not to sell their covered information, as Nevada Revised Statutes chapter 603A defines those terms. Use any method in How to make a request. We will respond within the time Nevada law requires.

Changes to this notice

We review this notice at least once every 12 months and update it when our practices change. When we update it, we change the date at the top. If we make a material change, we will post a prominent notice on moonbrush.com before the change takes effect.

Contact us

If you have a question about this notice or our privacy practices, contact us:

Moonbrush Inc.
Attn: Privacy
5830 E 2nd Street, Suite 7000
Casper, Wyoming 82609, USA

Email: privacy@moonbrush.com
Toll-free: (877) 756-6662
Online: Your Privacy Choices