Last updated: August 19, 2026
Moshivo LLC ("Moshivo", "we", "us"), a Delaware limited liability company, operates the conversion desk for aesthetic clinics available at moshivo.com. Moshivo helps a business capture inquiries from LINE, WhatsApp, Instagram, Facebook Messenger and its website, qualify them, book appointments (with Google Calendar), and send confirmations, reminders and follow-ups. You can reach us at hello@moshivo.com.
For the personal data of a business's inquiries and contacts, the business (our customer) is the data controller and Moshivo acts as a processor on the business's behalf and on its instructions. For the account and website data of the business's staff who sign up and use Moshivo directly, we act as controller. The business is responsible for having a lawful basis and any required consent (for example, consent to be contacted on a messaging channel).
From business staff (account holders): name, email address, phone number, company name and role, provided when you contact us, request a demo, or sign in to Moshivo.
On behalf of businesses, from their inquiries and contacts: contact name, phone number or messaging channel identifier, the source channel (LINE, WhatsApp, Instagram, Facebook Messenger, web form), the language and location provided, the service of interest, the message content exchanged, the requested and confirmed appointment slot, the appointment status, and the follow-up history.
Usage data: basic technical information (pages visited, browser type, IP address) collected through analytics to operate and improve the service.
Moshivo is a conversion desk, not a system of record for your industry (such as a medical record, case-management or accounting system). We do not collect, request or store sensitive core records such as medical, legal or financial case files. Businesses are asked to keep sensitive detail out of Moshivo and in their own systems. Because inquiries may indirectly reveal an interest in a service, we minimize what is captured, restrict access, and process it only to book and manage appointments.
We use the information to capture, qualify, route and book appointments; send confirmations, reminders, rescheduling links and no-show follow-ups; operate the front-desk dashboard and reporting; respond to your requests; and improve the service. We do not sell, rent, or share personal information with third parties for their own marketing.
When a business connects a channel, we receive and store on its behalf the channel account identifier, display name, and the OAuth access and refresh tokens (or channel credentials) needed to receive and send messages the business has asked us to handle. This applies to Meta channels (WhatsApp Business, Instagram, Facebook Messenger) and LINE (Messaging API). Credentials are stored under strict access controls, isolated per business (tenant), and used solely to perform the actions the business has requested. We do not use them for any purpose outside that scope, and we do not access content beyond what is necessary to deliver the requested action. Outbound messages sent outside a platform's service window use pre-approved templates in accordance with that platform's rules.
Beyond messaging, a business can connect accounts so that Moshivo can publish content and read advertising and channel analytics on its behalf, through our gateway. When a business authorizes such a connection, we receive and store on its behalf the platform display name, account identifier, and short-lived access and refresh tokens, kept under strict per-tenant access controls and used solely to perform the actions the business has explicitly requested. Scopes requested per integration:
• X (Twitter): publish posts on the connected account (OAuth 2.0 with offline access for token refresh).
• LinkedIn: w_organization_social, r_organization_admin — publish posts to and read engagement for the connected organization page.
• TikTok (Login Kit / Content Posting): user.info.basic, user.info.stats, video.publish — retrieve the connected account's display name, avatar and aggregated profile statistics, and publish videos the business submits.
• TikTok for Business (Marketing API): Report, Ad Account Information, Lead Retrieval, Lead Test — read advertising scale metrics and lead-form submissions for the connected advertiser account; lead data is read-only, stored encrypted per tenant, and deleted within 30 days of disconnection or upon written request.
• YouTube: youtube.upload, youtube.readonly, yt-analytics.readonly — upload videos the business submits and read channel and video metadata and scale reports (no monetization or revenue data).
• Google Ads: adwords — read-only campaign and ad-group scale metrics; we never create, edit, pause or delete campaigns, ad groups, ads or keywords.
• Google Analytics: analytics.readonly — read-only GA4 property reports.
The Google integrations above (YouTube, Google Ads, Google Analytics) are additionally governed by the Google API Services User Data Policy Limited Use requirements described in the Google section of this policy. Tokens are retained while the connection is active and deleted on disconnection, account termination, or written request to hello@moshivo.com; a business can also revoke access at any time from the platform's own settings.
Moshivo's use of Google Calendar and Gmail complies with the Google API Services User Data Policy, including the Limited Use requirements. When a business connects a Google account, we access on its behalf:
• Google Calendar free/busy intervals of the connected calendar (start and end timestamps of existing busy blocks), read-only, to compute available appointment slots shown on the business's booking flow. We do not read event titles, descriptions, attendees or other details.
• The ability to create, update and delete calendar events, exclusively for appointments booked through Moshivo. Events we create are tagged with a private extended property identifying us as the source, so we never read or modify events created outside our flow. Push notification channels (Google Calendar watch) keep the business's booking dashboard in sync if an event is rescheduled or cancelled directly in Google Calendar.
• The Google account's primary email address (userinfo.email), captured at connection time only, to record which account was connected.
• Gmail messages, read-only (gmail.readonly), when a business connects its own mailbox. We run a Gmail search query the business itself configures (for example, messages whose subject indicates an appointment request) and read only the matching messages’ sender, subject and body, in order to import them into that business's inbox as conversations its staff can act on. We do not read messages that do not match the business's query, and we never export or copy the whole mailbox.
• Sending replies (gmail.send), when a business connects its own mailbox. We use this only to send a reply that the business's own staff compose inside Moshivo, from the business's mailbox, in the same email thread as the inquiry. We never send email automatically or on our own initiative, never send to anyone other than the person who wrote in, and never send bulk or marketing email. We do not modify, delete, label or archive existing email. The connection can be revoked at any time from the Moshivo dashboard or from the Google account's security settings, which deletes the stored access.
Data obtained through Google APIs is used solely to provide the booking and inquiry-capture features the business requested; it is not transferred except to the infrastructure providers strictly necessary to run the service or to comply with law, is not used for advertising, and is not read by humans except with consent, for security, to comply with law, or in aggregated/anonymized form.
We use Amazon Web Services (AWS) for hosting and transactional email, and Supabase (managed Postgres) for backend infrastructure. These providers process data on our behalf under their own privacy commitments.
We apply the following technical and organizational safeguards:
Encryption in transit. All traffic, including channel and API calls and dashboard access, is served over HTTPS using TLS 1.2 or higher.
Encryption at rest. The managed Postgres database and object storage are encrypted at rest using AES-256; backups inherit the same encryption. Channel and Google refresh tokens are additionally encrypted at the application layer before being stored.
Tenant isolation. Every record carries a business identifier, and all endpoints authenticate the caller before any read or write, so one business can never access another business's inquiries, tokens or reporting. Sensitive tables use Row-Level Security reachable only by our backend service role.
Limited human access. Personal and inquiry data is not read by humans except with the customer's consent, for security purposes, to comply with law, or in aggregated and anonymized form.
Incident response. On a confirmed incident affecting personal data or credentials, we notify affected businesses without undue delay, describe the data involved, and detail remediation, including revoking and rotating impacted tokens.
Data deletion. When a business disconnects an integration, terminates its account, or submits a written request to hello@moshivo.com, the associated tokens and personal data are deleted from production; residual copies in encrypted backups are purged within 30 days.
We retain inquiry and appointment data for as long as the business's account is active and the data is needed to provide the service, or as required by law, and delete it on request or on account termination as described above.
Depending on your jurisdiction, you (or a contact, via the business) may have the right to access, correct, or delete personal data. Contacts should reach out to the business (the controller); we will assist the business in responding. For requests concerning data we control, contact hello@moshivo.com.
Subscription payments are processed by Stripe, Inc. We never store your card details: they are collected and held by Stripe under its own privacy policy. We receive from Stripe only what we need to operate your subscription (subscription status, billing country, invoice references) and, where applicable, your billing address and tax ID for tax calculation.
Where a business takes payments through the Service, we act as its processor and never as the merchant. Card details are collected by Stripe, Inc. on its own hosted pages and never reach our servers. On the business's behalf we store the amount asked, the amount received, the status, the currency and the provider's transaction reference, linked to the appointment. The business's own provider credentials are held encrypted and are used only to create payment sessions and to read back what a payment did. Stripe acts as an independent controller for the payment itself under its own privacy policy; refunds, disputes and receipts are handled in the business's provider account, not by us.
Our website and the Desk app use essential cookies for proper functionality (such as authentication sessions). With your consent — collected through the cookie banner, and valid across moshivo.com and its subdomains — we also use Google Analytics cookies to understand how the Service is used. You can decline analytics cookies in the banner; the Service works fully without them. We do not use advertising tracking cookies.
We may update this Privacy Policy from time to time. Significant changes are reflected by updating the date at the top of this page.
For any privacy-related question, contact us at:
Moshivo LLC — 8 The Green #21902, Dover, Delaware 19901, USA
hello@moshivo.com