Privacy Policy

Last updated

Who we are

Moment is operated by YellowMint Technology (CA0396372-K), a business registered in Ipoh, Perak, Malaysia. This policy explains what personal data we collect when you use Moment, why we collect it, and what you can do about it.

For anything in this policy, write to us at hello@yellowminttech.com.

Data we collect about account holders

Moment uses Google as its only sign-in method. When you sign in, Google shares a limited profile with us:

  • Your name and email address.
  • Your Google profile picture, where one exists.
  • A stable Google account identifier, used to recognise you on return visits.

We never receive or store your Google password. Alongside this we store the content you create — teams, links, image blocks, templates, and API keys — and billing records held for us by Stripe.

Data we process about your visitors

Moment's purpose is to show each visitor a version chosen for them, so when someone opens one of your smart links or dynamic images we look at the request in order to pick that version. This is the sensitive part of the service, and we keep it deliberately narrow:

  • An approximate country and city, derived locally from the visitor's IP address using a MaxMind GeoLite2 database. The lookup happens on our own servers; the IP address is not sent to a third party for this purpose.
  • A coarse device category — mobile, tablet, or desktop.
  • The time of the request, used for time-of-day rules and countdowns.
  • Any merge parameters you yourself put in the URL.

We do not store visitor IP addresses in our analytics, and we do not build cross-site profiles of your visitors or sell visitor data to anyone. What we retain is aggregated: daily counts of renders and clicks broken down by variant, country, device, and channel. Those counts cannot be traced back to an individual.

If you are using Moment on visitors in a jurisdiction with its own consent requirements, you are the data controller for that audience and are responsible for having a lawful basis to personalize their content. We act as your processor.

Cookies and analytics

Moment sets a session cookie so you stay signed in, and a cookie holding your light or dark appearance preference. These are strictly necessary for the product to work.

On our marketing pages we use Google Analytics 4 to understand which pages people find useful. You can opt out with a browser-level analytics blocker, and doing so has no effect on the product.

Who else processes your data

We use a small set of sub-processors, each for one job:

  • Google — sign-in, and Google Analytics on the marketing pages.
  • Stripe — subscription billing and card handling. Card numbers reach Stripe directly and never touch our servers.
  • MaxMind — the GeoLite2 database used for local country lookups. Queried as an offline file, not as a live service.
  • Browserless — headless Chromium used to render your dynamic images.
  • Our hosting and infrastructure providers, who store the data at rest.

How long we keep things

Account and content data is kept for as long as your account exists. Aggregated daily statistics are retained so that your historical analytics stay meaningful. When you delete a team or close your account we remove the associated content; billing records are kept for as long as Malaysian tax and accounting law requires.

Your rights

Under Malaysia's Personal Data Protection Act — and, where it applies to you, the GDPR — you may ask us to give you a copy of your personal data, correct it, delete it, or restrict how we use it. You may also object to processing and ask for your data in a portable format.

Email hello@yellowminttech.com and we will respond within 30 days. If you are in the EEA or UK and are unhappy with our response, you may complain to your local supervisory authority.

Security

Traffic to Moment is encrypted in transit. Access to production data is limited to the people who need it to run the service. No system is perfect, and if a breach ever affects your personal data we will tell you and the relevant authority without undue delay.

Changes to this policy

We will update this page when our practices change, and the date at the top always reflects the current version. Material changes will be announced by email to account holders before they take effect.