Who is responsible
MolaBoard is a product of MolaLabs. This website is operated by Mola Labs s.r.o.
Registered address: Řeporyjská 490/17, Jinonice, 158 00 Praha 5, Czech Republic
Registration: Company ID (IČO) 23842041. Commercial Register: Municipal Court in Prague, Section C, File 433750.
Contact: support@molalabs.ai
What this policy covers
This policy covers the MolaBoard public website and requests for early access. Account creation, workloads, and data uploaded to the MolaBoard application will have their own applicable privacy information when access opens.
Information we use
- The email address you provide and whether you choose to receive marketing emails.
- Your interest in a workspace plan and billing period, if you select them before requesting access.
- The first and latest request times, request count and status, and the version of the consent wording associated with your saved preferences. Addresses are not currently verified.
- When enabled, same-visit attribution uses limited campaign source, medium, campaign and content labels from a tagged link, plus a normalized referring platform domain. These values are stored with your early-access request only if you submit the form. Campaign labels are not verified and may not prove that an ad or post was viewed.
- Technical information needed to deliver and protect the website, such as network requests and service logs.
- Google Analytics information only when you allow it. Details about analytics data and your choices are in the Google Analytics section below. Cloudflare Web Analytics separately processes page-performance information, including page and referrer details, for visitors outside its configured regional exclusions. Cloudflare says it does not log query strings.
Why we use information
We use an early-access request to manage interest in the beta and record your request to receive beta updates, relying on your consent for those updates. We currently do not verify the address or send confirmation, beta-update or marketing emails.
When enabled, we use our legitimate interests to understand which tagged marketing sources lead to early-access requests. The same-visit attribution flow uses only allowlisted campaign labels and a normalized referring platform domain, keeps them in memory during the current visit, and stores them with your request only if you submit the form. It does not use a cookie, cross-visit browser identifier, pixel or ad click ID. We retain these attribution fields for up to 24 months from capture, then clear them from the contact record. Repeated requests do not extend this period. Contact and consent records have a separate retention period. The optional marketing choice is separate.
The separate optional checkbox records your consent to MolaBoard product news and offers. We rely on that consent if marketing delivery is enabled. Leaving it unchecked does not remove your request for beta access.
Google Analytics is used only after you give optional analytics consent. We use its reports to understand website performance, visitor journeys and which tagged marketing channels or campaigns lead to visits and requests. See the dedicated Google Analytics section below for the data, processor and transfer details.
Separately, Cloudflare Web Analytics measures page performance. Our legitimate interest is to understand how the public website performs and keep it reliable. Our Cloudflare configuration excludes visitors connecting through Cloudflare data centers in the EU/EEA, Switzerland, and the UK; in other regions, it may measure performance regardless of your Google Analytics choice. We limit this use to performance measurement. Cloudflare says its beacon uses browser performance information, may send page and referrer URLs, and does not access or store browser storage. Cloudflare receives the request IP as part of ordinary network handling and says it discards that IP at the nearest Cloudflare data center rather than storing it in core databases or logs. You can object to processing based on legitimate interests; see Cloudflare’s RUM beacon information for Cloudflare’s description of collection and processing. Necessary website operation and proportionate security measures also serve our legitimate interest in keeping the site available and preventing abuse. Processing required by law is based on the relevant legal obligation.
Providing information is your choice
You can browse without submitting an early-access request. An email address is required to save a request and contact you about beta access; without it, we cannot accept the request. Marketing permission and plan or billing interests are optional. Submitting the form does not create an application account or a paid subscription.
Google Analytics 4
If you choose “Accept optional” or enable Analytics in Cookie Settings, we use Google Analytics 4 (GA4) to measure visits and interactions, understand journeys through the website, improve website performance and attribute visits or early-access requests to tagged marketing channels and campaigns. The Google tag is blocked until you give consent. Rejecting or withdrawing consent prevents future GA4 collection from this website.
Depending on your activity and device, GA4 may process page views and other interactions, browser and device information, approximate geographic information derived from the network connection, and identifiers stored in first-party cookies such as _ga and _ga_*. We send sanitized page paths and limited campaign labels; we do not intentionally send email addresses, form contents, raw campaign query strings or full page URLs as GA4 event data. Google’s default cookie expiry can be up to two years, subject to browser limits and configuration. Our GA4 property currently retains event data for two months and user-level data for fourteen months; these settings may change and do not necessarily determine the retention of aggregated reports.
Google acts as our processor under its Data Processing Terms. The Google entity named in the applicable contract (which may be Google Ireland Limited or Google LLC) provides the service; the contracting entity is determined by those terms, not simply by a visitor’s location. Data may be transferred to and stored in the United States or other countries where Google or its service providers operate facilities, subject to the applicable contractual safeguards. With “Google products & services” data sharing off, Google says it acts as a service provider under its US State Privacy Laws Service Provider and Processor Addendum. We do not currently link this GA4 property to Google Ads, use Google Signals, or use GA4 data for personalized advertising or remarketing. The account setting for sharing data with Google products and services is off. The separate “Modeling contributions & business insights” setting is on; Google says data shared for this purpose is aggregated with data from other sites and apps and cannot be used to identify our organization, account or users.
You can change or withdraw consent at any time using Cookie Settings. You can also clear Google Analytics cookies in your browser settings or use Google’s Analytics Opt-out Browser Add-on. The add-on applies to the browser where it is installed.
Service providers
Cloudflare hosts the website and handles early-access form submissions. Sanity supplies the published content captured during site builds. Cookie choices are stored in your browser. Google Analytics 4 is used only after you allow it, as described in the dedicated section above. Cloudflare Web Analytics is configured to exclude visitors connecting through Cloudflare data centers in the EU/EEA, Switzerland, and the UK, and may measure page performance in other regions regardless of that choice. Cloudflare says its beacon does not access browser storage and discards the request IP at its nearest data center rather than storing it in core databases or logs. See Cloudflare’s RUM beacon information. Cloudflare says RUM data may be processed in a country or region different from where it originated. See Cloudflare’s Data Processing Addendum for its processing and transfer terms.
Supabase stores email addresses submitted through the early-access form, consent choices and optional plan interest. The attribution fields described above are included only when attribution collection is enabled. The contact record does not contain raw page URLs, IP addresses, geographic data or ad click IDs. A failed or unavailable submission is not reported as a successful request. Supabase’s Data Processing Addendum describes its processing and transfer terms.
Before contact collection opens, the final notice must identify the applicable hosting and email arrangements, processor locations, and any safeguards for transfers outside the European Economic Area. We do not claim a particular data region or transfer arrangement before it is configured.
How long information is kept
We keep your early-access contact details, preferences and linked consent history while the early-access programme is running and your request remains active. You can withdraw your early-access request by contacting us and asking us to erase it. We then delete the contact and its linked consent history, including the saved marketing preference. We also delete these records when we close or cancel the early-access programme. We do not automatically transfer the list into application accounts or a new marketing list.
When same-visit attribution is enabled, we clear the campaign and referrer fields within 24 months of their first capture. Repeated requests do not reset this period. This cleanup does not delete the contact or its consent history; those records have a separate retention schedule.
Cloudflare says it keeps unsampled Web Analytics beacon data for seven days, then aggregates it to around 10% of its original volume for longer-term storage. Web Analytics data can be viewed for the previous six months. See Cloudflare’s Web Analytics FAQ for its current retention details.
Withdrawing only optional marketing permission stops that use of your address; your beta request and its linked preference history remain until one of the deletion events above. We keep no separate consent-evidence or suppression copy after deleting the contact. Technical logs and provider backups have separate retention settings that must be confirmed before this policy is approved. A database deletion does not mean immediate expiry of provider backups.
Your choices and rights
Contact support@molalabs.ai to withdraw your request or consent to beta updates or optional marketing at any time. Tell us which preference you want to change. No email delivery or public unsubscribe/preference page is currently enabled; the contact address is the current route for these requests.
Depending on the applicable conditions, you can request access to your personal data, correction, deletion, restriction, or a portable copy, and object to processing based on legitimate interests. Withdrawing consent does not affect processing that was lawful before withdrawal.
You can object to direct marketing at any time, free of charge; we will stop using your data for that purpose. You may also object, for reasons relating to your situation, to our legitimate-interest processing, including same-visit attribution and Cloudflare performance measurement.
We respond to rights requests without undue delay and within one month. If complexity or the number of requests requires up to two additional months, we will explain the extension within the first month. If we reasonably doubt your identity, we may ask for the information needed to confirm it.
You may complain to the relevant data protection authority. In the Czech Republic, this is the Office for Personal Data Protection.
Changes and questions
We will update this page when our data handling changes, including before early-access collection opens to the public. For privacy questions, contact support@molalabs.ai.