Moorkeep Privacy Policy
Moorkeep stopped in November 2026, before anything was released or sold. This policy stays as written, for the data we still hold.
This policy covers our website, the messages we exchange with people who write to us or whom we write to, and the records we keep about the businesses we write to. It is short because the business is small: one person, a static site, a mailbox and a private repository of records. Last updated 8 November 2026.
1. Who we are
Moorkeep is run by Eitan Plaks, a sole proprietor in Israel, at Dalia Ravikovitch 5, Rosh HaAyin 4840301. For the personal data described here we are the controller: we decide why and how it is used.
Privacy contact: eitanp214@gmail.com.
2. What this policy covers
Personal data about:
- visitors to this website;
- people who e-mail us; people at businesses we contact once, by e-mail, through their own contact form or on LinkedIn, to ask whether they run Flowise; and people named in the public sources we use to find those businesses;
- people who ask to hear about releases;
- people at customers and prospects: contacts, and people who sign a letter of intent;
- people who report security issues to us.
It does not cover the software you run yourself. Moorkeep runs on your own servers; we have no access to your installation and never see what is in it. Nothing is hosted by us, and nothing can be bought on this site today, so there is no payment data.
3. What we collect, why, and our legal basis
| Data | Where it comes from | Why we use it | Legal basis (GDPR Art. 6(1)) | How long we keep it |
|---|---|---|---|---|
| Website logs: IP address, browser type, pages requested and times | Your browser, through our website host | To deliver the website and keep it secure; to count visits, from the host's own server-side totals | Legitimate interests (f) | As long as our website host retains them |
| E-mail you send us: your address, your company if you give it, and what you tell us about your Flowise setup | You, in an e-mail you write and send yourself. This site has no form; the two buttons open your own mail program. | To reply, to understand demand, and to send you a letter of intent if you ask for one | Steps you ask us to take before a contract (b); legitimate interests in understanding demand (f) | 12 months after our last contact, unless you become a customer |
| Our records about businesses whose use of Flowise is visible in public sources, and our single first message to each, by e-mail, its own contact form or a LinkedIn message: the business's name, country and legal form; the contact address or page it publishes; the public evidence we relied on, with its link and date; the date and channel of our message and of any reply; and, for a few businesses, the name and role of a person, such as a sole proprietor or the author of a public post about Flowise | The business's own website or public profile, public company registers, and public technical sources such as urlscan.io scans, GitHub repositories and job advertisements | To choose whom to ask, to ask once whether they run Flowise in production and what they need, to say in that one message that a paid support plan exists (commercial prospecting), and to make sure we never write twice to anyone who has not replied | Legitimate interests (f). We write once; if there is no reply we do not write again | 12 months after our last contact, unless the business becomes a customer. After that we keep only the business's name, the address or page we wrote to and the date, on a do-not-contact list |
| Release announcements: your e-mail address | You, by asking | To tell you when a release ships; nothing else | Consent (a). Reply "stop" to any announcement and it ends | Until you say stop; then only on a do-not-mail list |
| Customer and prospect contacts: name, business e-mail, role, company, messages, support requests and letters of intent | You or your colleagues | To provide support, manage the relationship and keep contract records | Contract (b); legitimate interests (f) for contacts at business customers | For the relationship, then for as long as Israeli record-keeping rules require |
| Security reports: your name or handle, your contact details and the report | You, through our security-reporting channel | To fix vulnerabilities and, if you want, to credit you | Legitimate interests (f) | The report, for as long as the fix is published; your contact details, 24 months |
We do not sell personal data. We do not use it for advertising networks or ad targeting. We do not buy lists.
We use an AI assistant. Messages sent to us may be read by an AI assistant (Anthropic's Claude) that helps us log them and draft replies; it also helps us find the businesses we write to and draft that first message. Anthropic handles the text under its consumer terms. Model training is switched off on the account; Anthropic's terms still allow it to use content flagged for safety review or sent to it as feedback, and we send none as feedback. Every reply you receive was read and sent by Eitan Plaks; the assistant drafts, a person decides.
4. Who receives your data
The companies below. Where one acts for us under a contract, the contract is shown; where we use a consumer service under its own terms, we say so. That is the whole list; when it changes, this page changes and says so.
| Provider | What it does for us | Where it processes data | Safeguard for the transfer |
|---|---|---|---|
| Cloudflare, Inc. | Serves this website, answers its DNS, and forwards e-mail sent to our domain to our mailbox | United States, through a global network of edge locations | Cloudflare's Data Processing Addendum, which incorporates the EU Standard Contractual Clauses and the UK Addendum |
| Google LLC (Gmail) | Our mailbox: holds the e-mail you send us and carries our replies | United States | A standard Gmail account under Google's privacy policy. Google handles the mail under its own terms, as a separate company, not as our processor; there is no processor contract for a consumer account. We chose it for its security over a mailbox on a new domain |
| Anthropic, PBC | The AI assistant that reads messages and drafts replies (section 3) | United States | Anthropic's consumer terms and privacy policy. On a personal subscription Anthropic handles the text under its own terms, as a separate company, not as our processor; we have no contract with it beyond those terms |
| GitHub, Inc. | Hosts our source code, private until the first release, and a private repository with our business records: the records about businesses we write to (section 3) and notes of what people tell us when they reply. Security reports reach us by e-mail until the first release | United States | GitHub's own terms of service for a personal account. GitHub, Inc. states that it is certified under the EU-U.S. Data Privacy Framework and its UK Extension (GitHub Privacy Statement, 27 April 2026). We have not confirmed that it covers data we send to it from Israel. We have no separate contract with it. |
Others. We may share personal data:
- with our professional advisers, such as a lawyer or an accountant, who are bound by confidentiality;
- with authorities, when the law requires it;
- with a successor, if the business is transferred, for example to a company we set up. We will tell you first.
A representative in the EU or the UK. Where Article 3(2) of the GDPR applies, Article 27 requires a controller outside the EU to appoint a representative there, unless its processing is occasional, includes no large-scale processing of special categories of data, and is unlikely to risk anyone's rights. The UK has its own version of the same rule. We write to businesses as a regular part of running this project, so we do not treat that processing as occasional, and we keep the written record described in section 3. What is not settled is the question that comes first: whether Article 3(2) reaches us at all, since what we offer is addressed to the company, not to the person who reads the message. We have not appointed a representative. Before we take on a customer in the EU or the UK, and before any release announcement goes to the people who asked for one, we will settle that question and say here what we decided. If you think we have this wrong, write to us; we would rather be told than be right.
5. International transfers
We are based in Israel. The European Commission has decided that Israel protects personal data adequately, so data can flow from the EU to Israel without further safeguards. If you are in the United Kingdom, your data also reaches Israel; the UK's approved-country regulations carried over the adequacy decisions that were in force when it left the EU, and the decision on Israel is one of them.
The companies in section 4 handle data in the United States. The table shows the safeguard where one exists, and says so where none does.
6. How long we keep data
The table in section 3 gives each period. When a period ends, we delete the data or make it anonymous. We delete data sooner if you ask, unless the law requires us to keep it.
7. Your rights
Depending on where you are, you may have the right to:
- get a copy of your personal data;
- have it corrected;
- have it deleted;
- restrict how we use it;
- object to how we use it. You can always object to direct marketing, and one word does it;
- receive it in a portable format;
- withdraw consent at any time. Withdrawal does not affect what we did before.
Israeli privacy law gives similar rights to inspect and correct information.
To use a right, e-mail eitanp214@gmail.com. We reply within one month. We may need to confirm your identity first.
You can also complain to a data protection authority. In the EU, that is the authority where you live or work. In the UK, it is the Information Commission. In South Africa, it is the Information Regulator (inforegulator.org.za, enquiries@inforegulator.org.za). In Israel, it is the Privacy Protection Authority. You can also complain to us first, at eitanp214@gmail.com; we will acknowledge your complaint and answer it. We would be grateful for the chance to fix the problem first.
8. Security
The business is one person, a static website, a mailbox and a private repository of records, so the honest list is short. We protect personal data by:
- serving this website over HTTPS, with no scripts and no third-party requests;
- limiting access to Eitan Plaks, who is the only person with any, and keeping our records about businesses in a private repository, never on a public page;
- storing secrets in encrypted form, never in a document or a message;
- keeping our systems updated.
No method is perfect. If a breach affects you and the law requires us to tell you, we will.
9. Cookies and analytics
This website sets no cookies and loads no analytics script. We look at our host's server-side request counts, which involve nothing running in your browser. If that ever changes, this section changes first and we ask for consent where required.
10. Children
Our services are for businesses. They are not directed at children, and we do not knowingly collect data about children under 16.
11. Automated decisions
We do not make decisions about you that are based only on automated processing and that have legal or similarly significant effects.
12. The software itself
Moorkeep runs on your own servers and sends no usage data to us or to anyone unless you switch it on yourself. It has a dormant analytics client that only wakes if you set the environment variable POSTHOG_PUBLIC_API_KEY; no key ships with the software. If you set your own, the data goes to your own project, not to us. Unset it and it stops. The software also writes an audit log of its own actions to the storage you configure; that log stays with you.
13. Changes to this policy
When we change this policy, we post the new version here with a new date. If a change is material, we also e-mail customers and the people who asked for release announcements.