Privacy policy

Last updated: 25 September 2026

Who we are

Mooch Agency Ltd is a two-person UX and AI automation agency based in London and Lisbon. We are the data controller for the data described here: we decide how it is used. This policy covers mooch.agency and every subdomain we run, including frwa.mooch.agency, samantha.mooch.agency and mts.mooch.agency. Questions go to hey@mooch.agency.

What we collect

We keep data collection minimal.

• Analytics: We use Vercel Web Analytics and Speed Insights. They collect anonymous, aggregated data: the page, referrer, country, device type and browser, plus a few named clicks, such as copying a prompt. No cookies are set and nothing identifies you. To stop your own visits being counted on mooch.agency, open any page with ?notrack=1 on the end of the address; that saves a flag in your browser’s local storage and loads no analytics from then on.
• Hosting: Like any web host, Vercel receives your IP address and browser details to serve pages and block abuse. Our tools also hold your IP address briefly in memory to limit how often each one can be used. We do not save it anywhere.
• Email and calls: If you email us or book a call, we keep your name, email address and what you send us, so we can reply and follow up. We do not add you to any marketing list.
• Free content audit: If you request an audit on the homepage, we store your website address and email address in Notion, where we work, so we can review the request and email you the report through Resend. Before saving, we check that your email’s domain can receive mail.
• AI tools: Some tools send the text or article you give them to an AI provider and show you the result. Write like Paul Graham and Samantha use OpenAI (Samantha first fetches the article through Firecrawl); /deslop and the Say Less demo use Anthropic. Apart from the Say Less demo below, we do not store what you send after the request completes. The providers process it under their own policies, may keep it for a short time to check for abuse, and do not train on data sent through their APIs by default.
• Say Less demo: The Say Less comparison is the exception. We store the question you submit and both answers it produces, so we can see which questions the demo handles well and check the published word-count claim against real use. These are kept in LangSmith, our tracing tool, which deletes them automatically, at most 400 days after you ask. We store the country and referring site alongside them, but never your IP address, and we do not use any of it for training. If you answer the short “would you use it?” question, we store your answer, and any note you add, in Notion, with no name, email or IP address attached, and your browser remembers that you answered so we do not ask again. To have a question deleted sooner, email hey@mooch.agency with its wording and roughly when you asked it. Please do not enter personal or confidential information.
• Paid /deslop runs: Running /deslop through its API is paid in USDC on the Base blockchain, using the x402 payment protocol. Your wallet signs the payment, and Coinbase’s payment service checks and settles it. Like any blockchain payment, the transaction and your wallet address are public. We do not link them to anything else about you.
• Monitoring the Situation: To subscribe at mts.mooch.agency, you give us your email address and pay through Stripe. We store your email address, your Stripe customer and subscription IDs and your subscription status, and use them only to run your subscription and send you a welcome email and the daily digest, through Resend. Stripe handles your card details; we never see them. If you cancel, we keep your record marked as cancelled so we stop emailing you, then delete it as set out below.

Why we use it

• To do what you asked: reply to you, run your audit, send your digest or process your payment. The legal basis is performing a contract with you, or taking steps you asked for before one.
• To run and improve our sites: analytics, hosting logs, and Say Less traces and feedback. The legal basis is our legitimate interest in knowing which pages and tools work and in keeping our sites secure. You can object to this at any time.
• To keep business records: invoices and contracts, because tax law requires it.

How long we keep it

• Emails, call bookings and audit requests that do not turn into work: 12 months after our last contact with you, then deleted.
• Client records: kept for the length of the work, then for as long as tax law requires us to keep invoices, contracts and accounts. For a UK company that is 6 years from the end of the financial year they relate to, and it can be longer where another country’s rules apply to us.
• Monitoring the Situation subscribers: kept while you are subscribed, and deleted 12 months after you cancel. Stripe keeps its own billing records under its own policy.
• Say Less demo traces: deleted automatically by LangSmith, at most 400 days after you ask.
• Say Less feedback: 12 months, then deleted. It carries nothing that identifies you.

Apart from the Say Less traces, we delete these by hand rather than automatically, so something can sit a little past its date before we get to it. You can ask us to delete your data sooner at any time.

What we do not do

• Use tracking or advertising cookies, or tracking pixels, on our sites. If Vercel suspects a visit is automated, it may set a short-lived security cookie while it checks.
• Run retargeting or third-party advertising
• Sell or rent personal data, or share it beyond the services listed below
• Use analytics data to identify individual visitors

Third-party services

These services process data for us. Several are based in the US, so your data may be transferred there. Where it is, it is covered by the safeguards in each provider’s data processing terms, such as standard contractual clauses (with the UK addendum) or the EU-US Data Privacy Framework and its UK extension.

• Vercel: Hosting, analytics, and subscriber storage for Monitoring the Situation. Vercel privacy notice.
• Google: Google Fonts serves our typefaces, so your browser fetches them from Google, which sees your IP address. Google Workspace runs our email. Google privacy policy.
• Cal.com: Discovery call bookings, on its EU instance. Cal.com privacy policy.
• Calendly: Office hours bookings. Calendly privacy notice.
• Notion: Stores audit requests and Say Less feedback. Notion privacy policy.
• Anthropic: Powers /deslop, the Say Less demo and our content audits. Anthropic privacy policy.
• OpenAI: Powers Write like Paul Graham and Samantha. OpenAI privacy policy.
• Firecrawl: Fetches the articles Samantha reads aloud. Firecrawl privacy policy.
• LangSmith: Stores Say Less demo traces. LangChain privacy policy.
• Coinbase: Checks and settles /deslop payments. Coinbase privacy policy.
• Stripe: Takes Monitoring the Situation payments. Stripe privacy policy.
• Resend: Sends Monitoring the Situation emails and audit reports. Resend privacy policy.

Your rights

You can ask for a copy of the personal data we hold about you, or ask us to correct or delete it, limit how we use it, or send it to you in a portable format. You can also object to any use based on our legitimate interests. Email hey@mooch.agency and we will act on it within one month. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ico.org.uk) or, in Portugal, the CNPD (cnpd.pt).

Changes

We will update this page if anything changes. No email notifications, just an updated date at the top.