Moontel Privacy Policy

This Privacy Policy explains what personal data Moontel collects, why we collect it, who we share it with, and what choices you have.

1. Scope

This policy covers:

• the Moontel website at moontel.net, including the blog, the waitlist and the contact forms;
• the Moontel app at app.moontel.net, including your account, your profile, surveys, Data Rewards, and your eSIM;
• emails we send you;
• support conversations;
• paid plans, if and when we make them available.

This policy does not cover the websites of the survey providers you visit when you take a survey. Those companies have their own privacy policies. Section 8 explains this in detail.

2. Who controls your data

Moontel is currently an early-stage project (an MVP) operated by an individual. The person responsible for deciding how your personal data is processed — the data controller — is:

Tommaso Tonarelli, operating the Moontel project.
Contact: contacts@moontel.net

A Moontel company has not yet been incorporated. Once it is, this Privacy Policy will be updated to name the incorporated company as the controller, and we will tell you about the change.

We have not appointed a Data Protection Officer, and none is required for a project of this size. If that changes, we will name one here.

3. How to contact us

You can reach us at contacts@moontel.net for any question about this policy, about your data, or to exercise any of the rights described in Section 20.

4. Data we collect

We group data by where it comes from, because this affects how accurate it is and what we may do with it.

4.1 Data you give us

When you create an account: your email address. This is the only thing we need to let you in.

When you complete onboarding: your first name and your country of residence.

When you fill in your survey profile: your date of birth, gender, postal code, employment status, industry, company size, your role in your organisation, and your department. You choose how much of this to provide. The more you provide, the more surveys you are likely to match.

When you contact support or use a form on our website: whatever you write to us, including your email address and the content of your message.

When you join the waitlist on our website: your email address and the country you select.

4.2 Data we observe

Your IP address, each time you use the app or our website. We use it to keep the service secure, and we pass it to survey providers as described in Section 8.

The country your connection appears to come from. This can be different from the country of residence you told us — for example when you are travelling. We keep both, and we treat them differently: your declared country is what you told us, the observed country is what we measured.

Your browser or device information, including the user agent string your browser sends.

Whether your device supports eSIM. Your device reports this to us. If your device cannot support an eSIM, we cannot deliver a Data Reward to it, and we tell you so.

How you use the app: which screens you open, which surveys you start, and what happened at the end of them.

4.3 Data we derive

Your age, calculated from your date of birth.

Your eligibility for particular surveys, calculated from your profile.

Estimates of how much mobile data a reward is worth, calculated from the current rate for your country.

4.4 Data about your eSIM

When we provision an eSIM for you we store its ICCID, its activation details including the activation code and the QR code, its status, its balance, and the network and country it is operating on. We show you a masked version of the ICCID in the app.

4.5 Authentication data

We store the records needed to sign you in and to keep your session active, and to let you sign out.

5. Data received from others

From survey providers. When you finish, abandon or are screened out of a survey, the provider tells us what happened. Section 9 explains exactly what this message contains.

From our eSIM partner. Our eSIM partner tells us your profile's status, its balance, and which network and country it is connected to.

From your device. Your device tells us whether it supports eSIM.

We do not buy personal data from data brokers, and we do not enrich your profile with data bought from third parties.

6. How we use data

• To create and run your account, and to sign you in.
• To find surveys that are likely to be relevant to you, and to show them to you.
• To pass you to a survey provider when you choose to take a survey.
• To work out whether a completed survey earned a Data Reward, and how much.
• To provision, fund and support your eSIM.
• To show you your reward history.
• To answer your questions and provide support.
• To detect and prevent fraud, duplicate rewards and abuse of the reward system.
• To keep the service secure and available.
• To understand how the product is used and improve it.
• To send you service emails.
• To send you marketing emails, if you have asked us to.
• To meet legal obligations that apply to us.

7. Legal bases

Where the GDPR applies, we rely on the following legal bases. We assess each purpose separately. We do not treat consent as the default.

• Performance of a contract with you — to create and run your account and keep your session; to provision, fund and support your eSIM and deliver Data Rewards; to determine whether a survey outcome earns a reward; to answer your support requests; and to use and share the profile and technical information needed to match and deliver surveys, because surveys are how the service delivers Data Rewards.
• Our legitimate interests — to detect fraud and prevent duplicate rewards, to keep the service secure and available and keep security records, and to understand how the product is used (subject to the choices in Section 14).
• Your consent — for analytics and similar technologies on our website, and for marketing emails.
• Compliance with a legal obligation — where the law requires it.

Surveys are the way the service works: they are how you earn the mobile data that Moontel provides, so using and sharing the profile and technical information needed to match and deliver them is necessary to give you the service you signed up for. We do not use your survey profile for anything unrelated to matching and delivering surveys.

8. Survey matching and providers

Moontel does not create surveys. We work with survey providers who supply them. When you open the survey list, we ask those providers what is available for someone with your profile, and we show you the result.

Today we work with CPX Research and ayeT Studios. We have also integrated TheoremReach.

8.1 What we send, and to whom

This is the part people most often want to know, so we are specific. We send different things to different providers, because each one asks for different things.

Please read this carefully: CPX Research receives your email address and your full date of birth. The other two providers do not receive your email address, and TheoremReach receives only your age rather than your date of birth. We are telling you this because it is true today, not because we think it is ideal. We are reviewing whether these fields are necessary.

We never send your first name, your last name, your phone number, your eSIM identifier, your login credentials or your reward history to any survey provider. Your role in your organisation and your department are stored in your profile but are not sent to any survey provider.

8.2 The account identifier we use

The identifier we send is an internal Moontel account identifier. It is not your email address and it is not derived from it. However, it is a stable identifier: the same value is used every time, so a provider that receives it can recognise the same Moontel account across sessions.

8.3 When this happens

We send this information when you open the survey list, when you launch a survey, and when we check whether you are eligible for a specific survey. We do not continuously synchronise your profile in the background.

8.4 Opening a survey

When you choose a survey, you leave Moontel and go to the provider's own website — in the app this opens in an in-app browser, and on the web it opens in a new tab. From that moment, the provider — and the market research company running the study — is handling your participation. Their privacy policy and their terms apply to what happens there. We recommend reading them.

When you choose a survey supplied by TheoremReach, we also pass your age, your gender and, where applicable, your postal code as pre-filled answers, so that you are not asked the same questions again.

8.5 Who is responsible for what

Here is the factual position. Moontel decides what to send in order to find surveys for you. Once you open a survey, the provider — together with the market research company that commissioned the study — decides how the survey is run and what happens to the answers you give it. For that part, the provider acts on its own behalf, not as our subcontractor.

The precise data-protection role of each provider is governed by our agreement with that provider. If you want to know more about how a particular provider handles your data, their own privacy policy applies to the part of the process that happens on their site.

9. Survey answers and survey outcomes

When you answer questions inside a survey, those answers go to the survey provider and to the research company behind the study. They do not pass through Moontel on their way there.

Moontel does not intentionally request or use individual survey answers. Survey answers are normally collected directly by the survey provider. Moontel generally receives outcome, transaction and reward metadata.

The message we receive at the end of a survey tells us:

• what happened — you completed it, you were screened out, you did not qualify, the study was already full, the event is a reversal, or the outcome needs review;
• an identifier for the transaction, so we can match it to the survey you launched;
• the amount the provider is paying for that completion;
• an identifier for the survey;
• sometimes a short reason or status code.

We store that message so we can prove why a reward was or was not given, resolve disputes, and reconcile our records with the provider's. Our system does not read or use survey answers. For two of our providers we currently store the provider's message exactly as it arrives; we are changing this so that we only keep a fixed list of fields, which is already how our TheoremReach integration works.

10. Rewards and mobile data

When a survey completion is validated, you earn a Data Reward: an amount of mobile data added to your Moontel eSIM.

Data Rewards are not money. They have no cash value, they cannot be withdrawn, exchanged for cash or transferred, and there is no cash balance in your account. There is no way to take money out of Moontel, by design.

How the amount is worked out: the survey provider tells us what it is paying for your completion. We deduct our platform costs and a reserve. What remains is converted into mobile data at the data rate that applies to your country at that moment. We always round down, so you never receive less than what is shown after rounding.

We keep a record of each reward: the amount funded, the rate applied, the data credited, when it was credited, and which survey it came from. You can see this in your reward history.

11. eSIM and telecommunications partners

Your Data Rewards are delivered as mobile data on an eSIM. We provision that eSIM through our eSIM partner, Citrus Mobile.

What we send them: a pseudonymous reference to your Moontel account, and the amounts we are funding. We do not send them your email address, your name, your phone number or your survey profile.

What we receive back: your eSIM's identifier (ICCID), its activation details, its balance, its status, and the network and country it is operating on.

When your eSIM is ready, we email you the activation details, including the QR code and the activation code. Treat that email as sensitive: anyone with those details could install your profile. Coverage, speed and which local network you connect to are determined by our partner and the local operators, not by Moontel.

12. Payments and paid plans

Moontel does not currently take payments. There is no checkout in the app, no payment page, and no way to buy anything. We do not hold your card details, and we have never held them.

We have prepared the technical groundwork for paid plans using Stripe, but it is not switched on. If and when we launch paid plans, we will update this policy before doing so, and explain what Stripe receives, what we receive, and how refunds work.

13. Fraud, security and service integrity

Reward systems attract abuse, and abuse costs honest users. We take a number of measures:

• we verify that messages from survey providers are genuine, using cryptographic signatures agreed with each provider, and we reject those we cannot verify;
• we detect and ignore duplicate messages, so a single survey cannot be paid twice;
• we apply a ceiling to the amount that any single survey completion can fund;
• we record which survey launch corresponds to which outcome, so rewards cannot be reassigned;
• we hide or demote surveys that screen out an unusually high proportion of people;
• we limit how often authentication codes can be requested;
• we keep records of these events so we can investigate.

If we hold a reward for review, we will tell you, and you can contact us about it.

14. Analytics, cookies and similar technologies

Our website uses Google Analytics to understand how people find and use it, and a first-party measurement endpoint that we operate ourselves. Both rely on identifiers stored on your device.

We want to be straightforward about the current position. At the time of writing, our website loads analytics before asking you, and there is no cookie banner. That is not how it should work and we are fixing it. Until the consent controls we are building are actually deployed, this section describes a target state, not the current one.

Analytics are never necessary for the website to work. Only the technologies needed to sign you in, keep your session, and remember your privacy choices fall into that category.

The Moontel app itself does not currently load any third-party analytics or advertising tools. It stores your session token, a device identifier, and your notification preferences on your device so you stay signed in.

15. Communications and marketing

Service emails. We send you the emails you need in order to use the service: your sign-in code, your eSIM activation details, and important notices about your account. You cannot opt out of these while you have an account, because without them the service does not work.

Marketing emails. We only send these if you ask us to. You choose this separately, and it is off unless you turn it on. Every marketing email has an unsubscribe link, and unsubscribing takes effect without you needing to contact us. Turning off marketing emails does not close your account, does not affect your surveys, and does not affect your rewards.

Push notifications. If you enable notifications, your device gives us a subscription endpoint so we can send them. You can turn them off in the app or in your device settings.

16. Who receives data

We do not sell your personal data for money. We do share data with the survey providers listed above so they can offer you surveys — Section 8 explains exactly what, and why.

We may also disclose data where we are legally required to, to establish or defend legal claims, or to protect the safety and integrity of the service. If Moontel is later incorporated, or the project is transferred to a company or another operator, your personal data may be transferred as part of that change. We will tell you before that happens.

17. International transfers

Some of the companies listed in Section 16 operate, or process data, outside the European Economic Area. Where that happens, we rely on the transfer safeguards allowed under data protection law — such as a European Commission adequacy decision, or Standard Contractual Clauses agreed with the provider.

You can ask us at contacts@moontel.net which safeguard applies to a particular provider and how to obtain a copy.

18. Retention

We keep personal data for as long as we need it for the purposes described in this policy, and then we delete or anonymise it. We are still finalising exact retention periods and will state them here as they are confirmed. The criteria we apply are:

• Account and profile data is kept while your account exists.
• Sign-in codes are short-lived and are only needed to complete a single sign-in.
• Survey transactions and provider messages are kept long enough to resolve disputes, handle reversals, and reconcile our records with providers.
• Reward and eSIM records are kept while they are relevant to a service you are using.
• Support conversations are kept long enough to handle your request and any follow-up.
• Marketing records are kept until you unsubscribe. If you unsubscribe, we keep the minimum needed to make sure we do not email you again.
• Analytics data is kept according to the settings of the analytics tool and your choices.

Data held by survey providers is subject to their own retention policies, not ours.

19. Automated matching and decisions

Some things happen automatically:

• Which surveys you see. We rank and filter surveys automatically, based on your profile, the provider's assessment of whether you fit, and how often a survey screens people out.
• Whether a survey earned a reward. When a provider's message arrives, our system classifies it automatically and decides whether to credit a reward, refuse it, or hold it for review.

These decisions do not have legal effects on you, but they do affect whether you receive a reward, so we think you should know they are automated. You can always contact us about a reward decision, and a person will look at it. We do not use your data to make decisions about credit, employment, insurance, or anything of that nature.

20. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct it if it is wrong or incomplete;
• delete it, in the circumstances the law provides;
• restrict how we use it;
• object to processing we carry out on the basis of legitimate interests;
• object to direct marketing at any time, with no reason needed;
• receive a copy of data you gave us, in a portable format;
• withdraw consent where we rely on consent, without affecting what we did before you withdrew it;
• complain to your data protection authority.

To exercise any of these, contact us at contacts@moontel.net. We may need to verify your identity before we act, particularly for access and deletion requests. We will respond without undue delay and in any case within one month, and we will tell you if we need longer. You can make any of these requests by email today; we plan to add in-app controls for them over time.

21. Account deletion

You can delete your account at any time by emailing contacts@moontel.net from the address you registered with, or by asking us through support. We will action your request without undue delay and in any case within one month.

When you delete your account, we delete your personal data, except where we must keep specific records — for example to comply with a legal obligation, or to keep the minimum information needed to stop someone re-registering to abuse the reward system. Anything we keep for those reasons is reduced to the minimum and, where possible, anonymised so it can no longer be linked to you.

Any mobile data already loaded onto your eSIM at the time of deletion is consumed on the device and is not refundable.

22. Regional rights

Moontel is currently offered to users in the European Union and the European Economic Area. The rights in Section 20 apply to you on that basis.

We do not currently target or offer the service to users in the United States, so this policy does not yet describe rights under United States state laws such as the California Consumer Privacy Act. If we extend Moontel to those territories, we will update this policy and add the required disclosures before doing so.

23. Children

You must be at least 16 years old to use Moontel. Moontel is not intended for anyone under 16.

We ask you to confirm your age when you sign up. If we learn that we have collected personal data from someone under 16, we will delete it and close the account.

24. Security

We protect your data with measures including encrypted connections, verification of the messages we receive from providers, controls that prevent a reward from being paid twice, and limits on how often sensitive actions can be attempted.

No service can promise perfect security. If a breach occurs that presents a risk to you, we will notify you and the relevant authority as required by law. Please keep your email account secure. Anyone who can read your email can request a sign-in code for your Moontel account.

25. Changes

We will update this policy when the product changes. When we make a significant change, we will tell you before it takes effect — by email, in the app, or both — and we will give the new version a version number and a date so you can see what changed and when.

We will not treat your continued use of the service as agreement to a materially different use of your personal data. Where a change requires your consent, we will ask you for it.

26. Contact

Data controller: Tommaso Tonarelli, operating the Moontel project (MVP; company not yet incorporated).

Contact: contacts@moontel.net

If you are in the European Union, you also have the right to lodge a complaint with your national data protection authority. In Italy this is the Garante per la protezione dei dati personali (www.garanteprivacy.it).