Privacy policy

1. Scope

The proposed scope covers people using the Mobli website, early-access applicants, nonprofit staff and supporters interacting with enabled organization features. The public domains, production services and responsibilities for each data flow must be confirmed before this draft becomes effective.

2. Data We Collect

Early-access applications

The inspected website form asks for a work email address, then a name, organization or cause, and an optional interest. Its server implementation stores these details with creation/update timestamps and source labels in Firebase Firestore. A hashed submission token identifies the record. This describes the implementation, not a verified production storage or retention configuration.

Organization records

Inspected product code supports individual contact details, household relationships, notes, tags, list membership, form-linked respondent identifiers and recorded giving transactions. The enabled features and information an organization enters determine the relevant records.

Review before publication: Complete the production data inventory: account/authentication data, event and volunteer information, communications and engagement telemetry, uploaded media, AI prompts and outputs, voice data, device/network logs, cookies and sensitive information. Source descriptions alone do not establish Mobli collection.

3. How We Use Your Data

The early-access form explains that the team will use the submitted details to follow up about access. The inspected CRM workflows use stored organization records for supporter management, list membership, giving review and reporting.

Review before publication: Confirm all additional purposes, legal bases where applicable, service messages, marketing permissions, fraud/security logging and any analytics or model-related use. Do not infer permission for unrelated marketing from an early-access application.

4. Third-Party Services

The early-access server code uses Firebase Firestore. Other enabled product workflows may use external services, but an integration name in source code does not establish an active provider relationship or the data shared in production.

Review before publication: Approve a complete provider/subprocessor list, purposes, data categories, hosting regions, cross-border transfers and contractual safeguards. The source lists OpenAI, Google, Stripe, Square, Twilio, Unsplash and MinistrySafe; none is confirmed here as an active Mobli subprocessor merely by being listed.

5. AI Features

Review before publication: Confirm data handling separately for text assistance, image/video generation, uploaded media and any future voice feature: what inputs and context leave Mobli, which provider receives them, stored outputs, logs, retention, training use, deletion and user controls. No call recording policy, no-training promise or zero-retention claim has been established. Pro phone examples on the marketing site do not establish a deployed voice-processing service.

6. Payment Processing

Inspected transaction workflows store information such as donor identity, amount, fund, date, method and transaction status. Offline gift entry can include check details.

Review before publication: Verify the actual payment data flow, processor configuration, card/bank credential handling and any uploaded check images. The source assurance that raw credentials are never stored and all processing is PCI-compliant cannot be adopted without confirming Mobli implementation and scope.

7. Data Sharing

Review before publication: The source proposes sharing with service providers, the organization receiving a submission, legally required recipients, parties to a business transfer and recipients authorized by the person. Confirm which disclosures actually occur and the related contracts. Do not publish the source no-sale statement until sale/sharing, advertising and analytics practices have been reviewed.

8. Security

No method of electronic transmission or storage is completely secure.

Review before publication: Verify production transport encryption, storage configuration, access controls, organization isolation, monitoring, incident response and backup recovery. The source security commitments are preserved in the review archive, not asserted as verified Mobli controls.

9. Data Retention & Deletion

Review before publication: Set and document retention periods or criteria by data category, including early-access applications, financial records, media, AI interactions, logs and backups. The source promises deletion and backup purging within 30 days; no supporting Mobli schedule was verified. Confirm account closure, deletion exceptions, export windows and how requests propagate to providers. A privacy request contact is still required.

10. Children’s Privacy

Review before publication: The source permits accounts from age 13, requires consent under 18 and describes organization-managed records about minors. Mobli account age restrictions, direct collection from minors, organization responsibilities and parental consent/deletion procedures remain unconfirmed. No minimum age or children’s data practice is adopted by this draft.

11. Cookies & Tracking

Browser settings can be used to manage cookies and stored site data; disabling storage may affect features that rely on it.

Review before publication: Inventory deployed cookies, local storage, analytics, tracking pixels and logs. Confirm consent controls, opt-out and browser privacy signals before describing them. The source Google Analytics and anonymised-analytics claims have not been verified for this Mobli deployment.

12. Your Rights

Review before publication: The rights below are retained as a proposed outline, subject to applicable law. Confirm request channels, identity verification, authorized-agent handling, response procedures and exceptions before publication.

Depending on your jurisdiction, you may have the right to:

• Access — Request a copy of the personal information we hold about you
• Correction — Request correction of inaccurate personal information
• Deletion — Request deletion of your personal information
• Portability — Receive your data in a portable format
• Opt-out — Opt out of promotional communications at any time
• Restriction — Request restriction of processing in certain circumstances

We will not discriminate against you for exercising any of these rights. To submit a request, contact us at [verified privacy request contact required before publication].

13. California Residents

Where the CCPA/CPRA applies, California consumers may have rights to know/access, delete and correct personal information, opt out of sale or sharing, limit certain uses of sensitive personal information and receive non-discriminatory treatment, subject to statutory conditions and exceptions.

See the California Attorney General’s CCPA guidance.

Review before publication: Determine applicability and publish accurate categories, sources, purposes, retention criteria, recipient categories and request methods. Confirm sale/sharing and sensitive-data practices, opt-out signals and the prior-period disclosures. California entity location alone does not settle these questions.

14. Policy Changes

We may update this Privacy policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where required by law, provide additional notice (such as an in-app notification or email). Any required notice or consent for a material change must be assessed before it takes effect.

15. Contact Us

Notable Consulting LLC
California

Review before publication: Registered/mailing address, privacy contact and legal-notice channel have not been supplied. Add verified details and request procedures before publication. No predecessor contact has been retained.