This explains what MoldMove collects, why, who else touches it, how long it is kept and how to get it back or get rid of it. MoldMove is a tool for companies, so most of what it holds is plant and process data rather than personal data — but the parts that are personal are set out here plainly.
1. Who we are
MoldMove is operated by Almond Joy Plastics, LLC, a Florida limited liability company. We are the controller of the personal data described below. For your plant and process data we act on your instructions — you decide what goes in and what comes out.
2. What we collect
Account information
- Name and email address.
- A one-way hash of your password. We never store the password itself and cannot recover it.
- Your role and which company account you belong to.
- If you turn on two-factor authentication, the secret that generates your codes.
Session information
- A session cookie, set when you sign in. It is HttpOnly, so page scripts cannot read it.
- One active session per account at a time.
What you enter about your plant
- Machines: make, model, control, tonnage, shot capacity, screw diameter, stroke, intensification ratio and similar specifications.
- Materials, molds, studies, setup sheets, troubleshooting records, shot-weight and defect logs.
- Files and photographs you attach, including nameplate and controller images.
Activity log
- An append-only record of who did what and when inside the account — created for your benefit, because an approved setup sheet is only worth anything if you can show who approved it.
If you ask for early access
- Just an email address. The form asks for nothing else: no machine data, no process data, nothing about your customers.
3. What we do not collect or do
- We do not sell your data.
- We do not use your data to train models.
- We do not run advertising or advertising trackers.
- We run one analytics script, and it is a cookieless one.
These pages load Cloudflare Web Analytics. It counts page views, referrers
and roughly where in the world a visit came from. It sets no cookie,
stores no identifier on your device, does not follow you between sites, and
does not build a profile of you. There is no Google Analytics, no tag
manager, no advertising pixel, no session recording and no heatmap.
Correction, 6 October 2026. Version 1.0 of this policy said we ran no analytics at all, and said we had checked what was deployed. That was wrong: the Cloudflare beacon is injected by the network at the edge rather than written into the site files, and the check was made against the files instead of against the delivered page. Nothing about what the script does changed — it never set a cookie and never identified anybody — but the sentence describing it was false from the effective date of version 1.0 until today, and it is corrected here rather than quietly edited away. - We take no payment cards, so there is no card number to store and no payment processor in the path. Setup fees and subscriptions are invoiced and paid by check or ACH, ordinarily against a purchase order. If we ever add a card option we will name the processor in section 6 before it goes live.
4. Why we hold it
To run the service you asked for: to sign you in, to compute conversions and studies from the data you enter, to show your records to the people you have invited, to keep the audit trail that makes an approved setup sheet meaningful, to send you transactional email such as invitations, password resets and lapse notices, and to bill you.
The only use beyond your own account is the equipment reference library described in section 7 of the Terms of Service — nameplate specifications and controller screen layouts, never process data — and you can ask to be excluded from it. That library is not built and is not running; nothing has been aggregated from any account. Consent for it is asked for in advance deliberately, and you will be emailed before it starts.
5. Cookies
MoldMove sets one cookie: the session cookie you get when you sign in. There are no advertising cookies, no analytics cookies and no cross-site tracking. Our analytics script is the cookieless kind — it is described in section 3 and it stores nothing on your device — so nothing here asks for cookie consent, because there is nothing to consent to beyond the cookie that keeps you signed in.
Two pieces of third-party code load on these pages, and both are worth naming rather than hiding:
- Google Fonts serves the typefaces. Your browser requests the font files from Google, which means Google sees the IP address making the request. It sets no cookie.
- Cloudflare Turnstile, where enabled, protects the sign-up and contact forms by checking that a submission comes from a person rather than a script. It is not an advertising product and does not track you across sites.
6. Who else touches it
| Who | What for |
|---|---|
| Cloudflare | Hosting, the application server, the database, DNS and bot protection. Everything you enter is stored here. |
| Resend | Transactional email only — invitations, password resets, lapse notices. Delivery runs on Amazon SES infrastructure. |
| Google Fonts | Serves the typefaces for these pages. Receives the IP address of the browser requesting a font file. No account data. |
| Cloudflare Web Analytics | Counts page views and referrers for these pages. Cookieless: sets nothing on your device and stores no identifier. Receives the IP address of the request, the page address and the referring page. No account data and nothing you enter in the application. |
That is the whole list. There is no advertising network, no payment processor, no customer-support platform and no image-reading service in the path, and the one analytics provider is named above. If that list changes we will change this table before the change goes live, not after. If your procurement needs a data processing agreement with any of the above, ask and we will tell you what we can and cannot sign.
7. Where it is stored
Your data is stored in Cloudflare's infrastructure. The database is a Cloudflare D1 database created in Cloudflare's Eastern North America region, and the application runs on Cloudflare's network.
Being accurate about the rest of it: Cloudflare operates globally and handles a request at the location nearest the person making it, so request processing can happen outside the United States even though the database sits in North America. We do not currently offer a contractual data residency guarantee. If your compliance program requires US-only residency, raise it before signing — it is a configuration question we would rather answer in your order than promise on a web page.
8. How long we keep it
Account and plant data follow the schedule in section 13 of the Terms of Service: full access while your period is current, read-only for 14 days after, dark but intact to 90 days, then removed — and only after a notice email has actually been sent.
Export works at every stage, including after your subscription lapses. That is deliberate. A retention schedule you cannot get your data out of is not a retention schedule.
9. Your rights
- Get a copy — one-click export, any time, any account state.
- Correct it — edit records in the application; deleted records are recoverable for 30 days.
- Delete it — ask us and we will delete your account and its data.
- Be excluded from the reference library — ask, and we will exclude your account at no cost.
- Depending on where you live you may have further rights over personal data, including access, portability, correction, erasure and objection. Write to us and we will honor them.
MoldMove is a United States product sold to United States plants, and this policy is written as a plain commitment rather than against a particular statute. We are not set up today for the European Union's GDPR, and we would tell you that rather than sign a data processing addendum we could not honor. If you are outside the United States, or your own compliance program requires specific language, raise it before signing.
10. Security, stated honestly
What is built and testable today:
- Each company's data is isolated. Which company you belong to comes from your session and never from anything a browser sends, and cross-account probes are tested against the live database.
- Membership is invite-only and enforced in the database, not just in the interface.
- Four roles — owner, QA, technician, view-only.
- Optional two-factor authentication.
- An append-only activity log.
- One active session per account.
- Deleted records recoverable for 30 days.
- Approved setup sheets fork rather than being overwritten.
And the part most vendors leave out: we have administrative access to the database, the way every software vendor does. We do not use it to look at your work, the application gives us no path to it, and going around the application leaves a record — but we are not going to tell you that we technically cannot see your data, because that would not be true.
11. Children
MoldMove is a tool for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18.
12. Changes
If we change this policy in a way that materially affects you, we will email the address on your account. The effective date at the top always shows the current version.
13. Contact
Questions, exclusion requests, deletion requests, or a copy of your data: aaron@moldmove.com.
By post: Almond Joy Plastics, LLC, 2939 SW 42nd Avenue, Palm City, Florida 34990.