Privacy Policy

1. Introduction

Molecule Systems LLC ("Company," "we," "us," or "our") operates Molecule ("Service"), a business-to-business scheduling platform for service businesses. This Privacy Policy explains how we collect, use, disclose, and protect your information.

By using the Service, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Name and email address
• Phone number (optional, for phone authentication)
• Password (encrypted)
• Profile information you choose to provide

2.2 Business Information

For business accounts, we collect:

• Business name and type
• Business address and contact information
• Staff member information (names, roles, schedules)
• Services offered and pricing

2.3 Booking Data

We collect data related to appointments and bookings:

• Client names and contact information
• Appointment dates, times, and services
• Booking history and preferences
• Notes and communications related to bookings

2.4 Payment Information

Payment processing is handled by Stripe. We do not store complete credit card numbers. Stripe's privacy policy applies to payment data.

2.5 Usage Data

We automatically collect:

• IP address and device information
• Browser type and version
• Pages visited and features used
• Time and date of access
• Referring website addresses

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service
• Process transactions and send related communications
• Send booking confirmations and reminders
• Respond to your inquiries and provide support
• Send promotional communications (with your consent)
• Analyze usage patterns to improve user experience
• Detect and prevent fraud or abuse
• Comply with legal obligations

4. Information Sharing

We do not sell your personal information. We may share information with:

• Service Providers: Third parties who assist in operating the Service (hosting, analytics, email delivery, payment processing)
• Business Partners: With your consent, for integrations you enable
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

5. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption of data in transit (TLS/SSL)
• Encryption of sensitive data at rest
• Regular security assessments
• Access controls and authentication
• Secure password hashing

While we strive to protect your information, no method of transmission or storage is 100% secure.

5.1 Data Breach Procedures

In the event of a data breach that may pose a risk to your rights and freedoms:

• Notification Timeline: We will notify affected users within 72 hours of discovering the breach (GDPR Article 33).
• Notification Method: Via email to your registered address and prominent notice in the Service.
• Information Provided: Nature of the breach, categories of data affected, likely consequences, and measures taken.
• Regulatory Notification: We will notify appropriate data protection authorities as required by law.

If you believe your data has been compromised, contact [email protected] immediately.

6. Data Retention

We retain your information for the following periods:

After these periods, data is securely deleted or anonymized. You can request early deletion by contacting [email protected], subject to legal retention requirements.

7. Your Data Rights

7.1 Rights for All Users (Global)

You have the following rights regarding your personal data:

• Right to Access (GDPR Art. 15): Request a copy of all personal data we hold about you
• Right to Rectification (GDPR Art. 16): Correct inaccurate or incomplete personal data
• Right to Erasure (GDPR Art. 17): Request deletion of your personal data, subject to legal retention requirements
• Right to Restriction (GDPR Art. 18): Limit how we process your data in certain circumstances
• Right to Data Portability (GDPR Art. 20): Receive your data in a machine-readable format
• Right to Object (GDPR Art. 21): Object to processing based on legitimate interests or for direct marketing

7.2 California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act (CCPA), California residents have additional rights:

• Right to Know: Request categories and specific pieces of personal information collected, sources, business purpose, and third parties with whom we share
• Right to Delete: Request deletion of your personal data, subject to certain exceptions
• Right to Correct (CPRA): Request correction of inaccurate personal information
• Right to Opt-Out: Opt out of the sale or sharing of personal information (not applicable - we don't sell data)
• Right to Limit Use of Sensitive Personal Information (CPRA): Limit use and disclosure of sensitive personal information
• Right to Non-Discrimination: Not be discriminated against for exercising your privacy rights

7.3 How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days (GDPR) or 45 days (CCPA).

We may need to verify your identity before processing your request. You may also designate an authorized agent to make requests on your behalf.

8. Children's Privacy

The Service is intended for businesses and is not directed to individuals under the age of 18 (United States) or 16 (European Union), or the applicable age of digital consent in your jurisdiction.

We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected]. We will delete such information within 30 days of verification.

Note: Our Service allows businesses to collect client information. Business users are responsible for ensuring compliance with children's privacy laws (COPPA, GDPR Article 8) when collecting information from minors.

9. Third-Party Services

The Service may integrate with or link to third-party services. These third parties have their own privacy policies:

• Stripe: Payment processing (Privacy Policy)
• Twilio: SMS notifications (Privacy Policy)
• Brevo: Email delivery (Privacy Policy)
• Mapbox: Location services (Privacy Policy)
• Encore: Infrastructure and API hosting (Privacy Policy)
• Wasabi: Media storage and CDN (Privacy Policy)

For social login, we may use the following OAuth providers. When you choose to sign in with a social account, that provider's privacy policy applies to data shared during authentication:

• Google: Privacy Policy
• Facebook: Privacy Policy
• Microsoft: Privacy Policy
• Apple: Privacy Policy
• TikTok: Privacy Policy
• Zoom: Privacy Policy

10. International Data Transfers

Molecule Systems LLC is based in the United States (Colorado). If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

10.1 Data Transfer Mechanisms

For transfers of personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to the United States, we rely on:

• Standard Contractual Clauses (SCCs): We use EU-approved Standard Contractual Clauses (2021/914) with our subprocessors to ensure adequate safeguards for your data.
• Adequacy Decisions: Where applicable, we rely on European Commission adequacy decisions for certain countries.
• Supplementary Measures: We implement technical and organizational measures including encryption in transit (TLS 1.3) and at rest (AES-256), access controls, and regular security audits.

10.2 Your Rights Regarding International Transfers

You have the right to obtain information about the safeguards we have in place for international data transfers. You may also object to certain transfers or request a copy of the relevant transfer mechanisms by contacting us at [email protected].

11. Cookies and Tracking

We use cookies and similar technologies to provide, secure, and improve our Service. Cookies are small text files stored on your device that help us recognize you and remember your preferences.

11.1 Types of Cookies We Use

11.2 Managing Your Cookie Preferences

You can control and manage cookies in several ways:

• Cookie Consent Banner: When you first visit our website, you can choose which categories of cookies to accept.
• Browser Settings: Most browsers allow you to refuse or delete cookies. Methods for doing so vary by browser. Please note that disabling essential cookies will prevent the Service from functioning properly.
• Do Not Track: We respect Do Not Track (DNT) browser signals for analytics cookies.

For more information about cookies and how to manage them, visit www.allaboutcookies.org.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. Your continued use after such notice constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

Molecule Systems LLC
Email: [email protected]