Privacy Policy

Introduction

Hasule Inc., a Delaware corporation, doing business as Moffeus ("Moffeus," "we," "us," or "our"), operates a career services platform that connects students, schools, and employers to create equitable pathways into the workforce. This Privacy Policy ("Policy"), together with our Terms of Service, describes the personal data we collect, how we use and share it, and details on how you can reach us with privacy-related inquiries. The Policy also outlines your rights and choices as a data subject.

This Policy applies to all users of our services, including our websites (moffeus.com, hasule.com, and any school-branded subdomains), applications, APIs, AI features, tools, and documentation (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this Policy. If you do not agree with this Policy, please do not use the Service.

Defined Terms

"Personal Data" refers to any information associated with an identified or identifiable individual, which can include data that you provide to us and that we collect about you during your interaction with the Service.

Depending on the context, "you" may be a Student, Employer, Career Center Staff member, or Visitor:

• Student. When you use Moffeus to explore careers, find jobs, connect with employers, or receive career guidance, we refer to you as a "Student." You may have an account created via your school's SSO/SAML system, via email and password signup, or pre-populated by your school's career center.
• Employer. When you use Moffeus on behalf of an employer to recruit talent, post jobs, create workforce programs, or host events, we refer to you as an "Employer."
• Career Center Staff. When you use Moffeus as a career center professional at an educational institution, we refer to you as "Staff."
• Visitor. When you visit our websites or interact with Moffeus without being logged in, we refer to you as a "Visitor."

Personal Data We Collect

Our collection of Personal Data differs based on what kind of user you are and how you interact with the Service.

Student Personal Data

• Information You Provide. When you create or claim an account, we collect your name, email address, phone number, date of birth, affiliated school, major, degree level, student type (middle school, high school, or post-secondary), and profile photo. You may also provide career interests, industry interests, skills, hometown, racial/ethnic background, gender, expected graduation date, and other profile information.
• Documents You Upload. You may upload resumes, transcripts, work experience details, and other career-related documents.
• Information From Schools. When partner schools enable SSO/SAML authentication, they may share student data (such as name, email, and student ID) with Moffeus to pre-populate accounts and facilitate the Service. Where the Family Educational Rights and Privacy Act (FERPA) applies to data shared by schools, it is processed in compliance with the statute.
• Phone Verification. When you verify your phone number during onboarding, we store the phone number and verification status. Phone numbers may be used for duplicate account detection and merge prompts.
• Personal Email. SSO-authenticated students may add a personal email and password to retain access after graduation. We store the personal email, its verification status, and a hashed password on your account.

Employer Personal Data

When Employer representatives create an account, we collect contact information including first and last name, email address, phone number, job title, and organization details. Account administrators may invite additional team members whose contact information is also collected.

Career Center Staff Personal Data

When staff members are added by their institution, we collect basic contact information including name, email address, and role within the institution.

Information We Automatically Collect

• Usage Data. We collect information about how you access and use the Service, including your IP address, browser type, operating system, referring URLs, pages visited, links clicked, and the date and time of your visit.
• Device Information. We collect information about the device you use to access the Service, including the hardware model, operating system and version, and unique device identifiers.
• Cookies & Similar Technologies. We and our third-party partners use cookies, web beacons, pixels, and similar technologies to automatically collect certain information about your interactions with the Service. You can manage your cookie preferences through your browser settings.
• Geolocation Data. We may collect or infer your approximate location from your IP address or device settings to help with security, fraud detection, and compliance with regional requirements.

Additional Data Categories

• Communications Data. Messages exchanged through the Service's inbox and messaging features, support inquiries, and feedback you provide.
• Event Data. RSVP information, event attendance, booth visits, poll responses, survey responses, and engagement data from career fairs and events.
• Application & Job Data. Job applications you submit, jobs you interact with (bookmarks, views), and employer assessments or interview data.
• Workforce Program Data. Enrollment, session attendance, time logs, task submissions, and performance reviews within workforce development programs.
• Career Development Data. Career assessments, development plan goals, competency ratings, skill ratings, and progress tracking data.
• AI Interaction Data. Submissions and Generated Responses from interactions with Moffy, our AI career assistant. See the "Moffy AI" section below for details.
• Document Signing Data. Electronic signature records created through integrated document signing services.
• Payment & Billing Data. Payment information processed through our payment provider (Stripe). We do not directly store your credit card numbers or full payment credentials.

How We Use Your Personal Data

• Providing the Service. To operate the Service, including creating your account, authenticating your identity (via email/password or SSO/SAML), matching you with opportunities, facilitating communication between students and employers, managing events, scheduling appointments, tracking workforce program participation, and providing career development tools.
• Account Linking & Merging. To detect and resolve duplicate accounts through phone number and email matching, and to facilitate account merges when the same person has multiple accounts (for example, one created via B2C signup and one via school SSO).
• School Affiliations. To manage and track your affiliation with educational institutions, including linking your account to schools via SSO, recording school transfers, and maintaining affiliation history.
• Communications. To send you notifications, updates, alerts, and announcements about the Service, including career opportunities, event reminders, and messages from employers or career center staff. You may opt out of promotional communications at any time.
• AI & Personalization. To power Moffy, our AI career assistant, and to provide personalized job matching, career recommendations, and resume feedback. Anonymized and aggregated data may be used to improve our AI models.
• Analytics & Improvement. To understand how the Service is used, diagnose technical issues, analyze trends, and improve features and user experience.
• Security & Fraud Prevention. To detect, investigate, and prevent fraudulent or suspicious activity, maintain platform integrity, and protect against unauthorized access.
• Compliance & Legal. To comply with applicable laws, respond to legal requests, enforce our Terms of Service, and protect our rights, property, and safety.

How We Share Personal Data

With Other Users

• Schools. If your account is affiliated with a partner school (via SSO or affiliation), that school's career center staff may view your profile information, including private profiles, as part of their administrative duties.
• Employers. Student information is shared with employers only when you choose to make your profile public, apply for a job, RSVP for an event, or otherwise engage with an employer through the Service. Employers are contractually prohibited from selling, sharing, or using student data for unauthorized purposes (including data analytics, advertising, or marketing).
• Other Students. If your profile is set to public, other students may see your profile information. Private profiles are not visible to other students.

With Service Providers

We engage third-party service providers to assist with operating the Service. These providers are contractually bound to use your data only for the purposes we specify and to maintain appropriate security measures. Examples include:

• Cloud infrastructure and hosting (e.g., Google Cloud Platform)
• Payment processing (Stripe)
• Email and SMS delivery
• Document signing services
• Video conferencing integrations (Zoom, Microsoft)
• Calendar integrations (Google Calendar, Microsoft)
• Analytics and monitoring
• AI model providers for Moffy features

For Legal & Safety Reasons

We may share Personal Data with law enforcement, government agencies, or other third parties if we believe disclosure is reasonably necessary to: comply with applicable law, regulation, or valid legal process; enforce our Terms of Service; protect the safety, security, or integrity of the Service; or protect the rights, property, or safety of Moffeus, its users, or others. We will attempt to notify you before sharing your data with law enforcement, unless prohibited by law.

Corporate Transactions

If we enter a transaction that modifies the structure of our business (such as a merger, acquisition, sale of assets, or reorganization), we may share Personal Data with parties involved in the transaction. Any successor entity will be bound by this Policy with respect to your data.

No Sale of Personal Data

Moffeus does not sell your Personal Data to third parties.

Moffy AI & Data

Moffeus offers AI-powered features through "Moffy," our career intelligence assistant. When you interact with Moffy, you provide inputs ("Submissions") that cause the Service to generate responses ("Generated Responses").

• Data Used by AI Features. Moffy may use your profile data, career interests, skills, resume content, and conversation history to provide personalized career guidance, job matching, and feedback.
• No PII in Submissions. You should not include sensitive personally identifiable information (such as Social Security numbers, financial account numbers, or passwords) in your Submissions. We disclaim liability for personal information you include in Submissions.
• Anonymized Data for Improvement. We may use anonymized and aggregated AI interaction data to improve the Service, train models, and develop new features. We will not use individually identifiable Submissions to train models without your consent.
• AI Content Storage. Conversation history with Moffy may be stored to provide continuity across sessions and to improve the quality of responses. You can request deletion of your AI interaction history by contacting us.

SSO/SAML & School Data Flows

When a partner school enables SSO/SAML authentication, the following data flows occur:

• Your school's identity provider (IdP) sends your school email address, and optionally your name, to Moffeus during the authentication process.
• We use this information to create or match your account and to establish a formal school affiliation.
• Your school's career center staff may view your profile as part of their administrative duties.
• If you transfer schools, your previous school affiliation is marked as "transferred," and your current school affiliation is updated.
• School-provided data is handled in accordance with our agreements with the school and applicable law, including FERPA where applicable.

Students who sign up via email and password (B2C) without SSO are not formally affiliated with a school. They may select a school name for display purposes, but this does not create a formal affiliation or grant the school access to their data.

Account Linking & Merging

To provide a seamless experience, Moffeus may detect duplicate accounts belonging to the same individual. Duplicate detection occurs through:

• Phone Number Matching. During onboarding, if your verified phone number matches an existing active student account, we will prompt you with a merge option.
• Email Matching. During SSO login, if your school email matches an existing affiliation, we resolve your identity to the existing account.

When you accept a merge, data from the secondary account (affiliations, profile data) is transferred to the primary account, and the secondary account is deactivated. An audit trail is maintained for both accounts.

Data Security

We implement organizational, technical, and administrative measures designed to protect Personal Data from unauthorized access, destruction, loss, alteration, or misuse. These measures include:

• Encryption of data in transit and at rest
• Secure password hashing
• Role-based access controls for staff and admin users
• Regular security reviews and monitoring
• Secure session management with short-lived credentials and automatic rotation

No data transmission or storage system is guaranteed to be 100% secure. We encourage you to use a strong, unique password and to safeguard your credentials. If you believe your account has been compromised, please contact us immediately at security@moffeus.com.

Data Retention

We retain Personal Data for as long as necessary to provide the Service, perform legitimate business purposes, and comply with legal obligations. Specific retention considerations include:

• Active accounts: data is retained for the duration of your account.
• Deactivated accounts (merged or deleted): limited data may be retained for legal compliance, fraud prevention, and audit purposes. Merged accounts retain a deactivation reason and a pointer to the surviving account.
• Audit logs (affiliation history, merge history): retained indefinitely for compliance and dispute resolution.
• AI interaction data: retained for service continuity and may be deleted upon request.

When we no longer need your data, we securely delete or anonymize it in accordance with applicable law and our internal data retention schedules.

Age Restrictions & Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect Personal Data from children under 13 without verifiable parental consent, in compliance with the Children's Online Privacy Protection Act (COPPA).

Students aged 13 to 17 may use the Service with parental or guardian consent. We may require verifiable parental consent before granting access to certain features.

If we learn that we have collected Personal Data from a child under 13 without parental consent, we will promptly delete that data. If you believe a child under 13 has provided us with Personal Data without consent, please contact us at privacy@moffeus.com.

Your Rights & Choices

Depending on your location and subject to applicable law, you may have the following rights regarding the Personal Data we process:

• Access. You may request confirmation of whether we process Personal Data about you, and if so, request access to that data.
• Correction. You may request that we correct or update inaccurate, incomplete, or outdated Personal Data.
• Deletion. You may request that we delete your Personal Data in certain circumstances as provided by law. You can also delete your account through your account settings.
• Restriction of Processing. You may request that we restrict the processing of your Personal Data in certain circumstances.
• Data Portability. You may request that we export the Personal Data we hold about you in a portable format.
• Objection to Processing. You may object to the processing of your Personal Data if we are processing it based on our legitimate interests. Unless there are compelling legitimate grounds, we will cease processing upon receiving your objection.
• Withdrawal of Consent. Where processing is based on your consent, you may withdraw that consent at any time.
• Opt Out of Marketing. You may opt out of marketing communications at any time by clicking the unsubscribe link in any promotional email or updating your notification settings.

To exercise any of these rights, please contact us at privacy@moffeus.com. We will respond to requests within 30 days (or 45 days for California residents). We will not discriminate against you for exercising these rights.

FERPA Compliance

Where partner schools share education records with us, we act as a "school official" with a legitimate educational interest under FERPA. We use education records solely to provide the Service as described in our agreements with partner schools. We do not use FERPA-protected education records for advertising or marketing purposes. Schools retain control over their students' education records and may request correction or deletion at any time.

Employer Data Obligations

Employers who access student data through the Service are contractually bound to:

• Use student data only to provide employment or career services to the student.
• Not sell, share, or use student data for data analytics, data monetization, advertising, marketing, or any other unauthorized purpose, even if the data is aggregated or de-identified.
• Handle and maintain student data with standards equivalent to or exceeding those described in this Policy.
• Comply with all applicable data protection laws.

Third-Party Links & Integrations

The Service may contain links to third-party websites, applications, and services. We also integrate with third-party platforms such as Zoom, Microsoft, and Google Calendar. Your interaction with these third-party services is governed by their own privacy policies. We are not responsible for the privacy practices of third parties. Please review their policies before submitting any information.

International Data Transfers

Moffeus is based in the United States. If you access the Service from outside the United States, your data may be transferred to, stored in, and processed in the United States or other countries where our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction. By using the Service, you consent to the transfer of your data to the United States and other countries as described in this Policy. Where required by applicable law, we rely on appropriate data transfer mechanisms.

White-Label & Subdomain Deployments

Moffeus may be accessed through school- or organization-branded subdomains (for example, yourschool.moffeus.com). Regardless of which domain or subdomain you use to access the Service, the same Privacy Policy applies, and all data is processed by Hasule Inc. as described herein. The school or organization branding is cosmetic and does not change the data controller or data processing practices.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. The "Last updated" date at the top of this Policy indicates when it was last revised. If we make material changes, we will notify you by email, through the Service, or by presenting the updated Policy for your acceptance. Continued use of the Service after changes are posted constitutes your acceptance of the updated Policy.

Contact Us

If you have questions about this Privacy Policy, need to access it in an alternative format, or have a privacy-related inquiry, please contact us: