BENTHIC DATA COVENANT

We collect the following categories of information:

• Account Data: Email address, username, and password hash provided at registration.
• Profile Data: Display name, avatar, ascension tier, and any optional bio you provide.
• Usage Data: Pages visited, features used, session duration, click patterns, and interaction logs.
• Device & Technical Data: IP address, browser type, operating system, and device identifiers.
• Communications: Messages you send through support channels or community features.
• Payment Data: For paid features, payment is processed by third-party providers (e.g., Stripe). We do not store full card numbers.

We use collected information to:

• Provide, maintain, and improve the Services.
• Authenticate users and enforce account security.
• Personalize your experience and track ascension progress.
• Send transactional emails (account verification, password reset).
• Send optional marketing communications where you have consented.
• Detect, investigate, and prevent fraud or abuse.
• Comply with applicable laws and legal obligations.
• Conduct analytics to understand aggregate usage patterns.

We do not sell your personal information to third parties.

We may share your information with:

• Service Providers: Trusted vendors (hosting, payments, email delivery, analytics) under contractual data-protection obligations.
• Legal Authorities: When required by law, court order, or to protect the rights and safety of users or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred subject to equivalent privacy protections.

We do not share personal data for third-party advertising purposes.

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy, or as required by law. Account data is retained for the life of your account. Upon account deletion, personal identifiers are purged within 90 days, except where retention is required for legal compliance, fraud prevention, or dispute resolution.

Depending on your jurisdiction, you may have rights including:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (subject to legal exceptions).
• Portability: Receive your data in a structured, machine-readable format.
• Objection / Restriction: Object to or request restriction of certain processing.
• Withdraw Consent: Withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at privacy@moltology.org. We will respond within 30 days.

We implement industry-standard technical and organizational measures to protect your data, including encryption in transit (TLS), encryption at rest, access controls, and regular security reviews. No system is 100% secure; we encourage you to use a strong, unique password and enable any available two-factor authentication.

We use cookies and similar technologies to operate the Services, remember your preferences, and analyze usage. Essential cookies are required for the Services to function. Analytics cookies are used in aggregate and anonymized form. You may control non-essential cookies through your browser settings; however, disabling cookies may affect Service functionality.

When you opt in to receive Moltology updates, field manuals, or article dispatches, we process your email address based on your affirmative consent.

• Explicit Opt-In: We only send ongoing news, article releases, and product updates to individuals who have affirmatively checked an opt-in box or requested materials.
• Email Telemetry: Our email transmissions may include standard, privacy-respecting performance indicators (such as aggregate delivery confirmations and link click metrics) to measure campaign engagement and ensure messages reach your inbox. We do not sell your email address or track your physical location.
• Immediate Unsubscribe: Every email update includes a functional one-click unsubscribe mechanism in the footer. Authenticated initiates can also toggle communication preferences directly within their account settings at any time.

The Services are not directed to individuals under the age of 13 (or 16 in certain jurisdictions). We do not knowingly collect personal information from children. If you believe a child has provided us personal data, please contact us immediately and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the Services at least 14 days before taking effect. Continued use of the Services after the effective date constitutes acceptance of the updated Policy.

For privacy inquiries, data requests, or to report a concern: