Skip to content

Moʻolelo Marketing

Privacy Policy

This is the privacy policy for the Moʻolelo Marketing dashboard: the client portals and the internal team portal. It explains what we collect, why, who it is shared with and the choices you have. Last updated 13 October 2026.

Who we are

Moʻolelo Marketing, Hawaiʻi. Questions about this policy go to nakana@moolelomarketing.com.

What we collect

  • Account details. Your name, email address and, where you give it, a phone number and role. Clients may add a second contact. We use these to sign you in, to reach you and to know who approved what.
  • Sign-in records. The time of each sign-in, passkeys you register (the public half only), and a session cookie. We never see your passkey private key or your device PIN.
  • What you put into the portal. Onboarding answers, messages to the team, comments and decisions on posts, files you upload, leads you add, service and quote requests, your brand colour and logo, and your notification choices.
  • Your social media performance. Follower counts, post statistics, ad results and scheduled posts for the accounts you asked us to manage. These come from the tools we run your accounts with, listed below, and from our own follower log.
  • Leads. If we run ads or forms for you, the names, emails, phone numbers and notes of people who contacted your business appear on your Leads page so you can follow up. You are responsible for only adding people who agreed to hear from you.
  • Notifications. If you turn on notifications, the browser gives us a push subscription for that device. It carries no personal details and we delete it when it stops working or when you turn notifications off.

We do not collect anything the dashboard does not need. There is no advertising tracking, no analytics script and no third-party code running in the portal pages.

Why we use it

  • To provide the service you hired us for: planning, approving and publishing content, reporting results, handling leads, files, messages and invoices.
  • To tell you about things that need you: posts waiting for approval, replies from the team, new leads, a post going live, your weekly summary. You choose which of these you get, by email and by notification, in Settings.
  • To keep the portal secure and working: sign-in, session handling, abuse prevention and error logs.
  • To meet accounting and legal obligations, such as keeping invoices.

Who it is shared with

We share data only with the services that run the dashboard or the work you hired us for. We do not sell it and we do not share it for advertising.

  • Cloudflare hosts the dashboard, its database, file storage and the sign-in sessions.
  • Resend sends our emails.
  • Metricool schedules posts and reports social media statistics for the accounts you connected to us.
  • GoHighLevel holds ad leads and campaigns for clients who use ads with us.
  • Notion holds our team's tasks, meeting notes and the follower log.
  • Google Drive stores client files when it is connected; otherwise files stay in our Cloudflare storage.
  • Meta, TikTok, YouTube, LinkedIn and Google Business Profile receive the posts you approve, through the access you grant us during onboarding.
  • Apple, Google and Mozilla push services deliver notifications to the devices where you turned them on.

Each of these providers has its own privacy policy. Within our team, only the people assigned to your account see your portal.

How long we keep it

For as long as you are a client, plus up to 12 months so we can answer questions about past work. Invoices and payment records are kept as long as tax law requires. Sign-in links expire within an hour and sessions within 30 days of inactivity. You can ask us to delete your data sooner, below.

Your choices and rights

  • See or correct your data. Most of it is on your portal pages and in Settings. For anything else, email us.
  • Emails and notifications. Every notification email links to Settings, where each kind can be switched off. Sign-in and security emails cannot be switched off while you have an account.
  • Delete your data. Use the request button in your portal Settings, or email us. We complete deletion within 30 days and confirm by email, keeping only what the law requires us to keep.
  • Revoke our access. You can remove us from your Meta, LinkedIn, Google or other accounts at any time; the onboarding steps show where.

If you are in a region with specific privacy rights, such as the EU, UK or California, those rights apply and you can exercise them by email. We will not treat you differently for doing so.

Children

The dashboard is for businesses and is not directed at children. You must be 18 or older to hold an account. We do not knowingly collect data about anyone under 18; if you believe we have, email us and we will delete it.

Security

Connections are encrypted, sign-in uses passkeys or single-use links rather than shared passwords where possible, and access is limited to the people who need it. No system is perfectly secure; if we learn of a breach affecting your data we will tell you promptly.

Changes

If this policy changes in a way that matters, we will say so in the portal and update the date above.