Legal

Privacy Policy

Last updated: July 19, 2026

Zena Labs LLC ("we," "us," or "our") operates moelueker.com (the "Website") and the AI tools, blog, and products made available through it (together, the "Services"). This Privacy Policy explains what information we collect, how we use it, and the rights you have over it.

1. Who we are

We are Zena Labs LLC, a California limited liability company. Our mailing address for privacy inquiries and formal data subject requests is:

Zena Labs LLC
490 Post St, Ste 500 PMB 2077
San Francisco, CA 94102
USA

The fastest way to reach us on anything privacy-related is hello@moelueker.com.

2. What this policy covers

This policy applies to the Website, the blog, every tool on moelueker.com/tools (including YouTube-to-Blog, Social Content Generator, AI Headshots, AI Music / Song Generator, MoeLink Link Shortener, Business Plan Builder, Link-in-Bio, Cover Letter Writer, and any additional tools added over time), and purchased digital products. It does not cover third-party websites we link to.

3. Information we collect

We collect only the data we need to run the Services.

  • Account data. When you create an account (directly or via Google, Microsoft, or another OAuth provider), our authentication provider stores your name, email address, profile image if provided, and a password hash. We do not see or store your password ourselves.
  • Subscription and payment data. When you buy a subscription or a digital product, our payment processors capture your billing email, order ID, plan, and amount. We receive a confirmation of the transaction but do not see or store your full card number or CVV.
  • Content you create with our tools. This includes prompts you write, files and photos you upload, brand assets, short-link destinations, financial-model inputs, generated blog posts, generated images, generated audio tracks, and any other output you save to your account.
  • Face photos (AI Headshots only). If you use AI Headshots, the selfies you upload are stored in our database, associated with your account, and used only to generate headshot images for you. See §10 for the full biometric-data section.
  • Resume and application data (Cover Letter Writer only). Resume files are read in memory to extract text and the original file is discarded after that request. If you are signed in and choose to save a resume profile, we store the corrected resume text and the cover letters, job descriptions, and application statuses you save until you delete them or close your account.
  • Usage and analytics data.Pages visited, buttons clicked, tool events (for example, "blog post generated" or "image generated"), and approximate session duration. We also store a hashed version of your IP address for rate limiting and abuse prevention, and basic device and browser information.
  • Session replay recordings. See §5 for the full detail. In short, we record visual playback of interactions on the Website to help us fix bugs and improve the product.
  • Click and redirect data (MoeLink). When someone follows one of your short links, we record the hashed IP, referrer domain, country or city from request headers, device and browser parsed from the user-agent string, A/B variant served, and whether the request appears to be from a bot.
  • Contact-form submissions. Name, email, message, an approximate location derived from your IP at the moment of submission, time spent on the site before submitting, and the referring URL. This helps us prioritize genuine messages and filter spam.

4. How we use the information

  • To provide, operate, and maintain the Services you use.
  • To process subscriptions, purchases, and refunds.
  • To send transactional emails (account confirmations, receipts, password resets, subscription notices).
  • To send marketing or product-update emails only if you opted in. You can unsubscribe from any marketing email using the link in the email.
  • To debug bugs, measure usage patterns, and improve the Services.
  • To detect, prevent, and investigate fraud or abuse.
  • To comply with legal obligations.

We do not sell your personal information and we do not use it for cross-context behavioral advertising. We do not display third-party advertising on the Website.

5. Session replay and behavioral analytics

We use a product-analytics provider to record a visual replay of interactions on the Website (clicks, scrolls, page navigations, and typed input). We use these recordings only to debug product issues and improve user experience. Key details:

  • Password and email fields are automatically masked in recordings, so the replay shows dots rather than what you typed.
  • Free-text inputs (for example, AI tool prompts) may be visible in recordings. This is intentional so we can see how people use each tool and make the tools better. Do not type anything into a prompt field that you want to keep confidential.
  • Recordings are retained for 30 days and then automatically deleted.
  • If you are in the EU, EEA, UK, or Switzerland, session replay is off by default. It activates only if you accept the "Session Replay" category in our cookie banner.
  • You can change your preferences at any time using the "Manage cookies" link in the footer. If your browser sends a Global Privacy Control signal, we honor it automatically and do not record sessions.

6. Categories of service providers we share data with

To run the Services we share the minimum data needed with third-party providers. We do not publish a list of specific vendor names here, but every provider falls into one of these categories, and each one is contractually bound to process your data only for the purposes we direct:

  • Authentication and identity provider
  • Database, file storage, and hosting provider
  • Edge network and content delivery
  • Payment processors for subscriptions and one-time purchases
  • Transactional and marketing email delivery providers
  • Product analytics and session replay provider
  • Website analytics provider
  • AI model and inference providers that power our generation tools (blog writing, image generation, music generation, and related features)
  • Form-submission and internal CRM storage for messages and feedback
  • Bot-protection provider for forms
  • IP-based geolocation lookup used for security and spam filtering

A current list of named providers is available on written request to the address in §1.

7. Cookies and similar technologies

We use cookies and similar browser storage in two groups:

  • Strictly necessary. Authentication session, CSRF tokens, the cookie-consent state itself, and the short-link password session used by MoeLink protected links. These are always on because the site cannot function without them.
  • Optional (consent required in the EU, EEA, UK, and Switzerland).Product analytics, session replay, and general website analytics. You can accept, reject, or configure these per category using the "Manage cookies" link in the footer. If your browser sends a Global Privacy Control signal, we treat that as a refusal for optional categories automatically.

The main cookies you may see are: an authentication session cookie from our auth provider; short-term tokens from our database provider; ph_* cookies set by our product-analytics provider when analytics consent is granted;_ga set by our web-analytics provider when analytics consent is granted; a short-link password-session cookie on MoeLink protected links; mel-geo (a strictly-necessary 1-day cookie that stores the country code detected from your connection, used solely to decide whether to show the consent banner); and mel-consent-v1 (a 6-month cookie that stores the consent choices you make in the cookie-preference panel).

8. How long we keep your data

  • Account data: retained while your account is open. If you close your account, we delete or anonymize your personal data within 30 days.
  • Generated content you saved: kept until you delete it or close your account.
  • Cover Letter Writer uploads: the original resume file is not retained. Corrected resume text and saved application content are kept only when you use the signed-in save features, until you delete them or close your account.
  • Session replay recordings: 30 days.
  • Usage and tool-event counters: 90 days.
  • MoeLink click events: up to 12 months of detailed records, then retained only as aggregate totals.
  • Contact-form messages: up to 24 months in our internal CRM, then deleted.
  • Subscription and payment records: up to 7 years to meet tax and accounting obligations in the United States.
  • Backups: our database provider keeps rolling daily backups for a limited period. When you request deletion, we delete your data from live systems immediately. Any residual data in backups rolls off on the normal backup retention schedule.

9. Your rights

If you are in the EU, EEA, or UK (GDPR / UK GDPR): you have the right to access, rectify, erase, restrict processing of, port, and object to the processing of your personal data, and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your national supervisory authority. We will respond to requests within 30 days. To exercise any of these rights, email hello@moelueker.com.

If you are a California resident (CCPA / CPRA): you have the right to know what personal information we have collected, to delete it, to correct it, to limit our use of sensitive personal information, and to opt out of sale or sharing. We do not sell or share your personal information for cross-context behavioral advertising, and we do not discriminate against you for exercising any of these rights. To exercise your rights or submit a Do Not Sell or Share My Personal Information request, email hello@moelueker.com. Authorized agents acting on your behalf are accepted with proof of authorization.

Other US state privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others) grant substantially similar rights. We extend these rights to residents of any US state with an applicable privacy law.

10. Face photos and biometric-adjacent data (AI Headshots)

The AI Headshots tool requires you to upload one or more photos of your face so the tool can generate new images of you. By using this tool:

  • You confirm that the photos are of you, or of a person who has given you written permission to upload their photo.
  • You consent to your uploaded photos being processed for the sole purpose of generating AI headshot images for your own account.
  • Your photos are stored in our database, associated with your user account, and retained until you delete them or close your account.
  • During each generation, your photos are sent to our AI-model provider for inference and then discarded by the provider after the request completes. We do not use your face photos to train any AI model.

Illinois residents (BIPA): if you are a resident of Illinois, you may have specific rights under the Biometric Information Privacy Act. We will not retain your uploaded photos longer than the earlier of (i) your deletion request, or (ii) one year after your last use of the tool. You can request deletion at any time by emailing hello@moelueker.com.

11. AI tools and what happens to your inputs

When you use an AI tool on this site, the content you submit (prompts, uploaded images, transcripts, lyrics, brand descriptions, and similar material) is transmitted to our AI-model providers so they can generate a response. Where providers offer it, we use API configurations designed to exclude your input from model training. We cannot guarantee the independent practices of upstream model providers beyond what their own terms state.

For Cover Letter Writer, the corrected resume text, job description, and instructions you provide are sent to our AI-model provider to create and check the letter. We request that the provider not store the generated response and its API data is not used to train models by default. The provider may retain limited abuse-monitoring logs for up to 30 days unless stricter data controls apply.

Do not submit confidential information belonging to third parties (for example, client data under NDA) to any AI tool on this site.

12. International data transfers

We operate from the United States and most of our providers also operate there. If you access the Services from outside the United States, your personal data will be transferred to, and processed in, the United States. Where required by law (including for transfers out of the EU, EEA, UK, and Switzerland), we rely on Standard Contractual Clauses or an equivalent lawful mechanism inherited from our providers.

13. Age of users

The Services are not directed to and are not intended for anyone under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided us with personal information, contact us and we will delete it.

14. Security

We protect your information with TLS in transit, encryption at rest through our database and storage providers, role-based access to administrative systems, and logical separation of tenant data where applicable. No system is perfectly secure. If you believe your account has been compromised, email us immediately so we can help.

15. Changes to this Policy

We may update this Privacy Policy from time to time. Changes are posted on this page with an updated "Last updated" date. For material changes, we will also notify account holders by email or an in-site banner for a reasonable period before they take effect. Your continued use of the Services after the effective date means you accept the updated Policy.

16. Contact and complaints

Questions, requests, or complaints about this Privacy Policy or your personal data:

Zena Labs LLC
490 Post St, Ste 500 PMB 2077
San Francisco, CA 94102
USA
hello@moelueker.com

EU users: we will designate an EU representative under GDPR Art. 27 if and when our processing of EU personal data reaches the relevant threshold. Until then, you may contact us directly at the address above or at hello@moelueker.com.