2. Information We Collect
Account information: name, email address, password (stored in hashed form), role (creator, agency, talent manager, or admin), and profile details you provide.
Business and deal information: brand deal terms, deal amounts, payment status, commission and payout records, sourcing/manager assignments, and related notes entered into the platform by you or your agency.
Payment and accounting data: when you connect a payment processor (such as Stripe) or an accounting integration (such as QuickBooks Online), we receive and store the minimum information needed to create invoices, reconcile payments, and sync payment status — for example invoice IDs, payment status, and connected-account identifiers. We do not store your full QuickBooks or Stripe login credentials; connections use OAuth tokens issued by those providers, which are encrypted at rest. Invoices created in QuickBooks Online through the Service may be paid by brands using Intuit Payments (also known as QuickBooks Payments), Intuit's own payment processing service. When a brand pays an invoice through Intuit Payments, Intuit processes that payment directly and shares payment status with us via QuickBooks Online — for those payments we do not receive or store the brand's card or bank account details.
Bank connection data (optional): on plans that include the bank feed, you may choose to connect a business bank account through Plaid Inc. ("Plaid"). Your bank login credentials are entered into Plaid's own secure interface and are never seen, received, or stored by Moli. Plaid returns an access token, which we store encrypted, and we use it only to import your transaction history — transaction date, amount, merchant or description, and Plaid's spending category — onto your own books inside the Service. We request only Plaid's Transactions product; we do not initiate payments, transfers, or any other movement of money through Plaid. Imported transactions are visible only within your own workspace and to people you have given access to it. You can disconnect a bank at any time from the Finance screen, which stops all further importing; transactions already imported remain as part of your own bookkeeping records.
Google account data (Gmail and Google Calendar, optional): you can choose to connect your Google account. Depending on what you turn on, we request:
- Send email on your behalf (Gmail "send" permission) — used only to send pitch, follow-up and reply emails that you write or approve in the Service, from your own Gmail address. We never send an email you haven't written, chosen, or scheduled yourself.
- Email metadata (Gmail "metadata" permission, only if you turn on email tracking or Gmail pitching) — used to show, on a brand or contact in your account, the emails you've exchanged with them, and to stop a scheduled follow-up when a brand replies. This covers message headers (sender, recipients, subject, date) and Gmail's short preview snippet for messages to or from your saved brand contacts. We do not read the full body of your emails or any messages unrelated to your contacts.
- Your Google email address — to show which account is connected.
- Calendar events (only if you connect Google Calendar) — to add and update events you create in the Service.
Google access and refresh tokens are encrypted at rest. You can disconnect at any time from Settings in the Service, which revokes our access, or from your Google Account at myaccount.google.com/permissions.
Communications data: messages, pitch templates, and outreach content you create or send through the Service.
Usage data: log data, device/browser information, and general usage analytics that help us maintain and improve the Service.
Public social media data: when you or your agency add a social profile, we collect publicly available profile statistics (such as follower counts and recent post performance) through a data provider, to show analytics and media kits.
Information about people who don't have a Moli account: Moli users store information about other people in the Service, for example buyers in their store, course students, community members, booking clients, CRM contacts, and brand contacts in their pitch pipeline. Some brand contact details come from third-party business data providers. See Section 5a.