Legal

Privacy Policy

Last updated: September 29, 2026

Zena Labs LLC ("we," "us," or "our") operates moelueker.com (the "Website") and the AI tools, blog, and products made available through it (together, the "Services"). This Privacy Policy explains what information we collect, how we use it, and the rights you have over it.

1. Who we are

We are Zena Labs LLC, a California limited liability company. Our mailing address for privacy inquiries and formal data subject requests is:

Zena Labs LLC
490 Post St, Ste 500 PMB 2077
San Francisco, CA 94102
USA

The fastest way to reach us on anything privacy-related is hello@moelueker.com.

2. What this policy covers

This policy applies to the Website, the blog, every tool on moelueker.com/tools (including YouTube-to-Blog, Social Content Generator, AI Headshots, AI Music / Song Generator, MoeLink Link Shortener, Business Plan Builder, Link-in-Bio, Cover Letter Writer, and any additional tools added over time), and purchased digital products. It does not cover third-party websites we link to.

3. Information we collect

We collect only the data we need to run the Services.

  • Account data. When you create an account (directly or via Google, Microsoft, or another OAuth provider), our authentication provider stores your name, email address, profile image if provided, and a password hash. We do not see or store your password ourselves.
  • Subscription and payment data. When you buy a subscription or a digital product, our payment processors capture your billing email, order ID, plan, and amount. We receive a confirmation of the transaction but do not see or store your full card number or CVV.
  • Content you create with our tools. This includes prompts you write, files and photos you upload, brand assets, short-link destinations, financial-model inputs, generated blog posts, generated images, generated audio tracks, and any other output you save to your account.
  • Face photos (AI Headshots only). If you use AI Headshots, the selfies you upload are stored in our database, associated with your account, and used only to generate headshot images for you. See §10 for the full biometric-data section.
  • Personal songs (Odewell birthday and gift songs). The name, details and lyrics you type are sent to Google (Gemini and Lyria, on the paid API tier, which does not train on them) to write and sing the song, and to OpenAI for a safety check and the cover art (API data is not used for training by default). If you choose a photo as the cover, it is re-saved without location data, a small copy is checked by OpenAI's safety filter, and the cover is the photo cropped as-is (no AI edits it). It is stored privately and deleted 24 hours after the cover is made. Songs made without an account are kept 30 days, free songs 1 year, and paid songs until you delete them. Songs carry Google's inaudible SynthID watermark. We never email the person you send a song to.
  • AI Song Generator songs. Songs you make without an account are deleted after 7 days, together with their audio file and cover image. Signing in within those 7 days on the same browser moves them into your account. On a free account, if you do not sign in for 30 days, the audio files of your songs are deleted (we email you first, on day 25 and day 29). Songs on a paid plan are kept until you delete them.
  • Logos and intro music (PodBumper only). If you upload a logo for a PodBumper cover, we re-encode it on our server (which removes location and camera data), store it privately, and place it on a plain background. It is never sent to an AI model. The uploaded file is deleted within 48 hours of your cover being made (cleanup runs once a day); the cover itself stays with your kit (and on any share link you create) until you delete the kit. Your intro kits are kept for 7 days if you are not signed in, 90 days on a free account, and until you delete them if you bought a pack. See §10.
  • Logos and jingles (HookHouse only).The business name, tagline, pronunciation and hook you type are sent to Google to make the jingle and to check it for misuse. If you give HookHouse your website address, we read that one public page to write your jingle words: the address and the page text are sent to Google's Gemini model, which writes a few short word options for you to pick from or edit. We do not keep the page text. We keep only the site's host name (for example "brightsidebakery.com") with your jingle, so you can see where the words came from. If that page names a logo image, we also fetch that one image to offer it as your cover. It is not stored unless you tap "Use the logo from your site"; then it is handled like an uploaded logo. "Help me spell it" sends only your business name to Gemini. After a jingle is sung, the recording is sent to Gemini once to find where your words end, so the jingle never cuts them off; we keep only that time. Uploaded logos are handled exactly like PodBumper logos: re-encoded, stored privately, placed on a plain background, never sent to an AI model, and deleted within 48 hours of your cover being made. Jingles are kept for 7 days if you are not signed in, 90 days on a free account, and until you delete them if you bought a pack while signed in. An unlocked jingle is kept until you delete it if you are signed in, and for a year on the device you bought on if you are not. From the moment you start an unlock checkout, that preview is kept even past those dates: for at most 7 days if you do not pay, and until the unlock finishes (up to about 30 days) if you do. If you are signed in, HookHouse can also save a business profile for you (the name, website, what you do, say-it-like spelling, style and singer voice you picked) so you do not have to retype it next time. We keep a saved business until you delete it (in the studio, tap Edit next to your saved businesses, then Delete) or delete your account. Deleting a saved business never deletes your jingles. See §10.
  • Previews, purchases and Team pick (HookHouse only). A free preview carries a short spoken HookHouse tag, and you can unlock a clean copy. You do not need an account to buy. If you pay without one, we keep a record of that checkout linked to a hash of your browser session and a keyed hash of your email address (not the address itself). The record lets that same browser unlock what it paid for. If the purchase is refunded or disputed, we note that on the record. We keep the record for 13 months after the purchase (the time refunds and card disputes can take), then delete it. The Team pick feature lets you share 2 or 3 of your jingles on a voting link. When a teammate votes, we store a random browser id (only as a hash), the option they picked, and a first name if they choose to type one. We check the name before we keep it. Only the owner of the link sees the counts and names. A vote is deleted 30 days after the vote ends or expires, or right away when you delete that jingle.
  • Resume and application data (Cover Letter Writer only). Resume files are read in memory to extract text and the original file is discarded after that request. If you are signed in and choose to save a resume profile, we store the corrected resume text and the cover letters, job descriptions, and application statuses you save until you delete them or close your account.
  • Usage and analytics data.Pages visited, buttons clicked, tool events (for example, "blog post generated" or "image generated"), and approximate session duration. We also store a hashed version of your IP address for rate limiting and abuse prevention, and basic device and browser information.
  • Session replay recordings. See §5 for the full detail. In short, we record visual playback of interactions on the Website to help us fix bugs and improve the product.
  • Click and redirect data (MoeLink). When someone follows one of your short links, we record the hashed IP, referrer domain, country or city from request headers, device and browser parsed from the user-agent string, A/B variant served, and whether the request appears to be from a bot.
  • Contact-form submissions. Name, email, message, an approximate location derived from your IP at the moment of submission, time spent on the site before submitting, and the referring URL. This helps us prioritize genuine messages and filter spam.

4. How we use the information

  • To provide, operate, and maintain the Services you use.
  • To process subscriptions, purchases, and refunds.
  • To send transactional emails (account confirmations, receipts, password resets, subscription notices).
  • To send marketing or product-update emails only if you opted in. You can unsubscribe from any marketing email using the link in the email.
  • To debug bugs, measure usage patterns, and improve the Services.
  • To detect, prevent, and investigate fraud or abuse.
  • To comply with legal obligations.

We do not sell your personal information and we do not use it for cross-context behavioral advertising. We do not display third-party advertising on the Website.

5. Session replay and behavioral analytics

We use a product-analytics provider to record a visual replay of interactions on the Website (clicks, scrolls, page navigations, and typed input). We use these recordings only to debug product issues and improve user experience. Key details:

  • Password and email fields are automatically masked in recordings, so the replay shows dots rather than what you typed.
  • Free-text inputs (for example, AI tool prompts) may be visible in recordings. This is intentional so we can see how people use each tool and make the tools better. Do not type anything into a prompt field that you want to keep confidential.
  • Recordings are retained for 30 days and then automatically deleted.
  • If you are in the EU, EEA, UK, or Switzerland, session replay is off by default. It activates only if you accept the "Session Replay" category in our cookie banner.
  • You can change your preferences at any time using the "Manage cookies" link in the footer. If your browser sends a Global Privacy Control signal, we honor it automatically and do not record sessions.

6. Categories of service providers we share data with

To run the Services we share the minimum data needed with third-party providers. We do not publish a list of specific vendor names here, but every provider falls into one of these categories, and each one is contractually bound to process your data only for the purposes we direct:

  • Authentication and identity provider
  • Database, file storage, and hosting provider
  • Edge network and content delivery
  • Payment processors for subscriptions and one-time purchases
  • Transactional and marketing email delivery providers
  • Product analytics and session replay provider
  • Website analytics provider
  • AI model and inference providers that power our generation tools (blog writing, image generation, music generation, and related features)
  • Form-submission and internal CRM storage for messages and feedback
  • Bot-protection provider for forms
  • IP-based geolocation lookup used for security and spam filtering

A current list of named providers is available on written request to the address in §1.

7. Cookies and similar technologies

We use cookies and similar browser storage in two groups:

  • Strictly necessary. Authentication session, CSRF tokens, the cookie-consent state itself, and the short-link password session used by MoeLink protected links. These are always on because the site cannot function without them.
  • Optional (consent required in the EU, EEA, UK, and Switzerland).Product analytics, session replay, and general website analytics. You can accept, reject, or configure these per category using the "Manage cookies" link in the footer. If your browser sends a Global Privacy Control signal, we treat that as a refusal for optional categories automatically.

The main cookies you may see are: an authentication session cookie from our auth provider; short-term tokens from our database provider; ph_* cookies set by our product-analytics provider when analytics consent is granted;_ga set by our web-analytics provider when analytics consent is granted; a short-link password-session cookie on MoeLink protected links; ca_session (an anonymous session cookie for HookHouse and PodBumper that keeps the jingles and podcast kits you made without an account on this device; it lasts up to about 400 days and renews when you use HookHouse); hh_voter (a random id for HookHouse Team pick voting, so one browser gets one vote per link; it is sent only with Team pick requests and lasts up to 180 days); hh_rehearsal (used only when the site owner tests checkout; it lasts 2 hours and no visitor gets it); mel-geo (a strictly-necessary 1-day cookie that stores the country code detected from your connection, used solely to decide whether to show the consent banner); and mel-consent-v1 (a 6-month cookie that stores the consent choices you make in the cookie-preference panel).

8. How long we keep your data

  • Account data: retained while your account is open. If you close your account, we delete or anonymize your personal data within 30 days.
  • Generated content you saved: kept until you delete it or close your account.
  • AI Song Generator: songs made without an account, 7 days. Free accounts, audio deleted after 30 days without a sign-in. Paid plans, until you delete them.
  • Cover Letter Writer uploads: the original resume file is not retained. Corrected resume text and saved application content are kept only when you use the signed-in save features, until you delete them or close your account.
  • Session replay recordings: 30 days.
  • Usage and tool-event counters: 90 days.
  • MoeLink click events: up to 12 months of detailed records, then retained only as aggregate totals.
  • Contact-form messages: up to 24 months in our internal CRM, then deleted.
  • Subscription and payment records: up to 7 years to meet tax and accounting obligations in the United States.
  • Backups: our database provider keeps rolling daily backups for a limited period. When you request deletion, we delete your data from live systems immediately. Any residual data in backups rolls off on the normal backup retention schedule.

9. Your rights

If you are in the EU, EEA, or UK (GDPR / UK GDPR): you have the right to access, rectify, erase, restrict processing of, port, and object to the processing of your personal data, and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your national supervisory authority. We will respond to requests within 30 days. To exercise any of these rights, email hello@moelueker.com.

If you are a California resident (CCPA / CPRA): you have the right to know what personal information we have collected, to delete it, to correct it, to limit our use of sensitive personal information, and to opt out of sale or sharing. We do not sell or share your personal information for cross-context behavioral advertising, and we do not discriminate against you for exercising any of these rights. To exercise your rights or submit a Do Not Sell or Share My Personal Information request, email hello@moelueker.com. Authorized agents acting on your behalf are accepted with proof of authorization.

Other US state privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others) grant substantially similar rights. We extend these rights to residents of any US state with an applicable privacy law.

10. Face photos and biometric-adjacent data (AI Headshots)

The AI Headshots tool requires you to upload one or more photos of your face so the tool can generate new images of you. By using this tool:

  • You confirm that the photos are of you, or of a person who has given you written permission to upload their photo.
  • You consent to your uploaded photos being processed for the sole purpose of generating AI headshot images for your own account.
  • Your photos are stored in our database, associated with your user account, and retained until you delete them or close your account.
  • During each generation, your photos are sent to our AI-model provider for inference and then discarded by the provider after the request completes. We do not use your face photos to train any AI model.

Illinois residents (BIPA): if you are a resident of Illinois, you may have specific rights under the Biometric Information Privacy Act. We will not retain your uploaded photos longer than the earlier of (i) your deletion request, or (ii) one year after your last use of the tool. You can request deletion at any time by emailing hello@moelueker.com.

Odewell photo covers:a photo you add as a song cover is not edited by an AI model and no face data is computed from it; a small copy is checked once by OpenAI's safety filter, which does not use API data for training. It is deleted 24 hours after the cover is made. Only add a photo you have the right to use; for a song about a child, the photo never appears on the share page.

Logos (PodBumper): an uploaded logo is not a face photo and is not used for any biometric purpose. Only our servers and our storage provider (Supabase) handle it; no AI provider sees it. We delete the uploaded file within 48 hours of your cover being rendered (cleanup runs once a day). Deleting a kit from your library deletes its cover, audio files and share links too. The same applies to logos uploaded to HookHouse (the AI Jingle Maker) and to deleting a jingle.

11. AI tools and what happens to your inputs

When you use an AI tool on this site, the content you submit (prompts, uploaded images, transcripts, lyrics, brand descriptions, and similar material) is transmitted to our AI-model providers so they can generate a response. Where providers offer it, we use API configurations designed to exclude your input from model training. We cannot guarantee the independent practices of upstream model providers beyond what their own terms state.

For Cover Letter Writer, the corrected resume text, job description, and instructions you provide are sent to our AI-model provider to create and check the letter. We request that the provider not store the generated response and its API data is not used to train models by default. The provider may retain limited abuse-monitoring logs for up to 30 days unless stricter data controls apply.

Do not submit confidential information belonging to third parties (for example, client data under NDA) to any AI tool on this site.

12. Games and public leaderboards

You can play the games at /games without an account. Your best times, medals, stars, sound settings and your own best run (used as a ghost) are saved in your browser's local storage on your device. We do not receive them unless you sign in.

If you sign in, we store:

  • Your account ID, your game progress (bests, medals, stars) and your game settings, so they sync across your devices.
  • For each level, your best verified run: its time, score, medal, stars, and the list of buttons you pressed during the run (the "input log"). We replay the input log on our server to check that the run is real, and we replay it again as a ghost.
  • Whether you chose to appear on the public leaderboards, and which display name you picked.

Public leaderboards are opt-in.After your first verified run we ask whether you want to appear. If you say yes, other visitors can see your display name, your times and medals, and can race your ghost. The display name is made from your account name (first name and last initial, first name only, or initials) or an anonymous courier number. You cannot type your own. You can switch names or hide yourself at any time from the game's Profile screen; public boards update within a few minutes.

Signing up from a games page does not add you to our email list. Game events (a level started or finished, a run posted) go to our product analytics provider under the same consent rules as the rest of the Website. We keep game data while your account exists. To have it deleted, email hello@moelueker.com.

13. International data transfers

We operate from the United States and most of our providers also operate there. If you access the Services from outside the United States, your personal data will be transferred to, and processed in, the United States. Where required by law (including for transfers out of the EU, EEA, UK, and Switzerland), we rely on Standard Contractual Clauses or an equivalent lawful mechanism inherited from our providers.

14. Age of users

The Services are not directed to and are not intended for anyone under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided us with personal information, contact us and we will delete it.

15. Security

We protect your information with TLS in transit, encryption at rest through our database and storage providers, role-based access to administrative systems, and logical separation of tenant data where applicable. No system is perfectly secure. If you believe your account has been compromised, email us immediately so we can help.

16. Changes to this Policy

We may update this Privacy Policy from time to time. Changes are posted on this page with an updated "Last updated" date. For material changes, we will also notify account holders by email or an in-site banner for a reasonable period before they take effect. Your continued use of the Services after the effective date means you accept the updated Policy.

17. Contact and complaints

Questions, requests, or complaints about this Privacy Policy or your personal data:

Zena Labs LLC
490 Post St, Ste 500 PMB 2077
San Francisco, CA 94102
USA
hello@moelueker.com

EU users: we will designate an EU representative under GDPR Art. 27 if and when our processing of EU personal data reaches the relevant threshold. Until then, you may contact us directly at the address above or at hello@moelueker.com.