Privacy Notice | Moksha One

1. Who we are and when this notice applies

Moksha Group Limited, trading as Moksha One (England and Wales, company number 13188223, 128 City Road, London, EC1V 2NX, United Kingdom) is the controller of the personal data described in section 3. You can contact us about privacy at hello@moksha-one.com with the subject "Privacy request".

2. Data inside a customer's workspace

Moksha One is business software. When a business uses Moksha One, the records it keeps in its workspace (for example its customers, contacts, suppliers, staff, tickets, documents and invoices) are normally controlled by that business. We process those records on its behalf as a processor, under our agreement with it. Where that business itself acts for someone else, we may be a sub-processor.

If your details are held in a business's workspace, or you use a customer portal provided by a business, please contact that business about your data. If you contact us instead, we will tell you who to contact and, where appropriate, pass your request to them and help them respond.

3. What we collect as controller, and why

Purpose	Data	Source	Lawful basis
Responding to enquiries and demo requests	Name, work email, company, team size, what you tell us	You, through our forms or by email	Legitimate interests in responding to requests you make. If you contact us as a sole trader about entering a contract, steps before a contract.
Creating and administering accounts	Name, email, sign-in method, workspace membership and role, workspace requests and join requests	You, your organisation, or Google/Microsoft if you sign in with them	Legitimate interests in providing accounts to the business customers who use our service. Contract where you personally contract with us.
Signing in and keeping the service secure	Sign-in records, two-factor status, IP address, browser type, error and security records	Your device and our systems	Legitimate interests in protecting accounts, preventing misuse and fixing faults
Support	Your messages and the details needed to resolve them	You or your organisation	Legitimate interests in supporting our business customers
Agreements and billing with business customers	Names and job titles of signatories and billing contacts, signed agreement records, invoices and payments	The business customer	Legitimate interests in managing our business relationships; legal obligation for accounting and tax records

IP addresses and device information can be personal data and we treat them as such. We do not ask for blanket consent to use this website. If we ever rely on consent for something, we will ask for it specifically and you can withdraw it at any time.

You do not have to give us your details, but without them we cannot answer your enquiry or provide an account. We do not use automated decision-making that has legal or similarly significant effects on you.

4. Who receives personal data

We share personal data only as needed to run the website and service, with these kinds of recipients:

our hosting, database, storage, sign-in and email delivery provider (our platform provider and its infrastructure providers), including the content delivery and bot-protection service (Cloudflare) that delivers the site to your browser;
AI model providers reached through our AI gateway, only when someone uses an optional AI feature;
Google or Microsoft, if you choose to sign in with them (they act under their own privacy terms);
providers a business customer chooses to connect to its own workspace, such as accounting, payment, email or monitoring tools; these act under that business's own arrangements with them;
professional advisers, insurers, and authorities where the law requires it.

More detail is on our service providers page.

5. International transfers

Some of our providers, or their infrastructure, may process data outside the UK. We are confirming the countries where each provider processes data and the safeguards that apply under their arrangements. Restricted transfers of customer workspace data are authorised only once those countries and any required safeguards have been established with the relevant provider. You can ask for current details using the privacy contact below.

6. How long we keep data

Enquiries and demo requests: for as long as needed to follow up and manage any resulting relationship, and then deleted or anonymised when no longer needed.
Accounts: while the account or workspace is active, and afterwards only as long as needed to close it, resolve outstanding matters and meet legal obligations.
Security and error records: for as long as needed to investigate and fix problems and protect the service.
Agreement, invoice and payment records: for as long as required by tax and company law, and to establish or defend legal claims.
Workspace data: as set out in the business customer's agreement with us, and as instructed by that customer.

Deleted data may remain in backups for a limited period until those backups are overwritten in the normal cycle.

7. Your rights

You can ask us for access to your personal data, and to correct, erase, or restrict our use of it. You can object to uses based on legitimate interests, and ask for data you gave us to be moved to someone else where that right applies. Where we rely on consent, you can withdraw it. Some rights have exceptions; we will explain if one applies. Send requests to hello@moksha-one.com with the subject "Privacy request". We may need to confirm your identity.

8. Complaints

Please tell us first so we can try to put things right: see how to make a privacy complaint. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

9. Cookies and device storage

See our cookies and device storage notice.

10. Changes

We will update this notice when our practices change. The version and date at the top show the current version.

Moksha One is a trading name of Moksha Group Limited, a company registered in England and Wales (company number 13188223), registered office 128 City Road, London, EC1V 2NX, United Kingdom. Contact: hello@moksha-one.com.