Your data, handled with care.

ABOUT THIS POLICY

Who we are and what this covers.

This policy explains how MouldDetect Technologies Pty Ltd (ABN 80 696 130 784) handles personal information. “We”, “us” and “Mould Detect” mean that company. Last updated 31 October 2026.

It covers four services:

• Our public website, moulddetect.ai
• Our data APIs, data.moulddetect.ai and environment.moulddetect.ai
• The Mycelium Network: our MCP server and the Mycelium command-line tool (CLI)
• The Mould Detect iOS app and the services it calls

Mould Detect is for adults. You need to be 18 or older to use the app, create an account or hold an API key.

OUR APPROACH

Only what a feature needs.

Personal information is information or an opinion about you, or about someone who could reasonably be identified. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth).

We collect only what a feature needs, we keep it in Australia wherever we can, and we tell you below where we cannot. We do not sell personal information and we do not use it for advertising.

THE WEBSITE

No cookies, and two forms.

• Cookies and storage. The website sets no cookies and runs no analytics or advertising tools. Your browser keeps one preference, your light or dark theme choice, in its own local storage on your device. We never receive it.
• Fonts are served from our own site, so loading a page sends nothing to a font provider.
• Videos on /learn/. The video thumbnails are loaded from YouTube, so your browser asks Google for them and Google receives your internet address and browser details. Playing a video happens on YouTube under Google’s terms.
• Early-access waitlist. We keep your email address, when you joined and confirmed, and a salted one-way hash of your internet address, used only to limit abuse. Joining is double opt-in: you are on the list only after you click the link in our confirmation email; if you never confirm, we delete your sign-up after 30 days. Every email we send has a withdraw link. If you withdraw, we delete your sign-up 30 days later. All we keep after that is a scrambled (hashed) form of your email address on a do-not-email list, so we never email you again unless you sign up afresh. Otherwise we keep your sign-up until you ask us to delete it.
• Enquiry forms. We keep what you enter (your name, email, organisation if given, the options you tick and your message), the page and time, and a salted one-way hash of your internet address. The enquiry is stored in AWS Sydney and emailed to our team inbox, hello@moulddetect.ai, through Amazon’s email service. We use it only to reply and do not add you to a mailing list. We keep it until you ask us to delete it.
• Service logs. The service behind the waitlist and enquiry forms keeps technical logs for 30 days.

THE DATA APIS

We do not log the places you look up.

data.moulddetect.ai and environment.moulddetect.ai return weather, humidity, flood and air-quality data for places you ask about.

• We do not log the coordinates you query.
• If we issue you an API key, we store only a hash of the key, never the key itself, together with the name of the app it was issued for and daily request counts used to apply your quota.

THE MYCELIUM NETWORK

Tools for AI assistants, kept briefly.

The Mycelium Network gives AI assistants and the Mycelium CLI access to our mould-risk, weather, flood, air-quality and photo tools.

• What we keep. A hash of your key and your account identifier (from Amazon Cognito). Usage records, used for your daily allowance, are kept for 35 days. Service logs are kept for 14 days.
• Photos sent through the photo tool go to the same vision service as the app and are not kept.
• The CLI and your AI provider. The CLI sends your prompts to the AI provider you choose (Anthropic, OpenAI or Google), using your own account with that provider. That provider handles your prompts under its own terms and privacy policy, not ours.
• AI assistants. If you connect our MCP server to an AI assistant, that assistant’s provider handles your conversation under its own terms. We receive only the tool requests it sends us.

THE IOS APP

Your photo is checked, then let go.

• Your account. Sign-in runs on Amazon Cognito in AWS Sydney. We hold your email address and an account identifier. Your password is held by Cognito, not by us.
• Checking a photo. Before a photo leaves your phone, the app removes its location data and camera details. The photo is then sent to our vision service in AWS Sydney without your account identifier, name or email. The service analyses it, returns the result and heat map, and does not keep the photo. When you are offline, the app can analyse the photo entirely on your phone.
• Your scan library. Each scan keeps the photo, result, heat map and any details you add (property, room, surface, smell, lighting, notes). It can also record approximate location (about 1 km), the phone’s angle, air pressure, light level, and your phone model and iOS version. This stays on your phone unless you back it up.
• Cloud backups (optional, paid plans). When you choose to back up, copies of your scans, including their photos, notes and approximate location, are stored in AWS Sydney in a private area linked to your account, so that only you can restore them. Backups are linked to you; they are not anonymised.
• Location. The app asks for approximate location only, and only for a feature that needs it, such as filling in an address, finding nearby specialists or recording where a scan was taken. Turning coordinates into an address uses Apple’s map service.
• Phone permissions. Camera, photo library, location, motion and microphone are each asked for separately. You can refuse or turn off any of them in Settings; only the feature that needs it stops working.
• Contacting a specialist. The app opens your own email app with a message you write. It goes directly from you to the specialist; we do not receive it.
• Subscriptions. Apple handles payment. We receive your subscription status, not your payment details.

AI TRAINING AND ANALYSIS

Your photos do not train our models today.

We do not currently use your photos to train AI models. If that changes, we will ask for your opt-in consent first, and any photo used will have its location data, camera details (EXIF) and link to your account removed.

Mould results and heat maps come from our own AI models without a person reviewing them. They support your decisions; they are not a diagnosis, a laboratory test or a building inspection.

WHO ELSE RECEIVES INFORMATION

Our providers, and the ones you choose.

We use service providers that handle information for us under contract and only on our instructions, chiefly Amazon Web Services in Sydney (hosting, sign-in, storage, backups, photo analysis and email). Other organisations receive information because of how you use our services:

• Apple: App Store, payments and map lookups, under Apple’s privacy policy
• Google: YouTube thumbnails on /learn/
• The AI provider you choose for the Mycelium CLI, or the provider of the AI assistant you connect
• Specialists you email yourself from the app

We do not otherwise disclose personal information unless the law requires it.

INFORMATION THAT LEAVES AUSTRALIA

Sydney by default.

We store and process your information in AWS Sydney. Information goes overseas only in these cases:

• Google (United States and other countries), when your browser loads YouTube thumbnails
• The AI provider you choose for the Mycelium CLI (Anthropic, OpenAI or Google), which may process your prompts in the United States or elsewhere
• Apple (United States and other countries), for the App Store, payments and map lookups

SECURITY

How we protect it.

Information travels encrypted (HTTPS). API and Mycelium keys are stored only as hashes. Backups sit in private storage that blocks public access, and each account can reach only its own files. Photos sent for analysis carry no account details and are not stored.

If you think someone has used your account or key, tell us at privacy@moulddetect.ai.

HOW LONG WE KEEP IT

A stated time, or until you ask.

• Photos sent for analysis: not kept.
• Scans on your phone: until you delete them.
• Cloud backups: until you close your account or ask us to delete them. Deleting a scan on your phone does not yet remove its backup copy; ask us and we will.
• Mycelium usage records: 35 days.
• Mycelium service logs: 14 days.
• Waitlist sign-ups, confirmed: until you ask us to delete them.
• Waitlist sign-ups, never confirmed: 30 days.
• Waitlist sign-ups, withdrawn: 30 days after you withdraw, apart from a hashed do-not-email record.
• Website form service logs: 30 days.
• Enquiries: until you ask us to delete them.
• Account: until you delete it.

ACCESS, CORRECTION AND DELETION

Ask to see it, fix it or delete it.

You can ask what personal information we hold about you and ask us to correct it, by writing to privacy@moulddetect.ai.

You can delete your account in the app, or by emailing privacy@moulddetect.ai. We can also delete your backups, waitlist sign-up or enquiries on request. We may need to confirm your identity first. If we refuse a request, we will tell you why and how to complain.

COMPLAINTS

Tell us first; the regulator is there if we fall short.

Write to privacy@moulddetect.ai. We will respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

CHANGES TO THIS POLICY

We will tell you before it matters.

We will update this policy when our practices change and show the new date at the top. If a change materially affects information you have already given us, we will tell you in the app or by email before it takes effect.

CONTACT

Ask us anything about your data.

MouldDetect Technologies Pty Ltd (ABN 80 696 130 784)

Privacy: privacy@moulddetect.ai