Effective November 3, 2026. Mothlight is operated by SEW Inc. (SEWORKS). Questions: help@mothlight.ai.
Mothlight (mothlight.ai) is a bot and AI-agent intelligence service operated by SEW Inc., doing business as SEWORKS ("we", "us"). Our team operates from San Francisco, California. This Privacy Policy explains how we collect, use, disclose and retain personal information when you visit mothlight.ai or use the Mothlight API or MCP endpoint (the "Services"). Section 2.3 briefly describes the security research data our network sensors (the "Sensors") record.
Contact: help@mothlight.ai · SEW Inc., 200 Continental Dr Ste 401, Newark, DE 19713-4337, USA.
| Category | Examples | When |
|---|---|---|
| Identifiers and contact details | name, email address, organization | contact form, API access request |
| Professional information | intended use, requested plan | API access request |
| Communications | the content of your messages and our replies | contact form, email |
| Account information | email address, optional name, organization name and your role in it | when you create an account or accept an invitation |
| Billing information | billing name and address, tax ID, plan, subscription status and invoices (payment card details are collected and stored by Stripe, not by us) | when you subscribe to a paid plan |
| Account and usage information | API key identifier, plan, request and row counts per day | when you use an API key |
To limit spam, the contact form also stores a one-way hash of your IP address, your country and your browser family. We do not use third-party CAPTCHAs or advertising trackers.
Sign-in and cookies. When you sign in, we set one strictly necessary session cookie on mothlight.ai. We do not store your IP address or browser user agent with your session. To prevent abuse, sign-in attempts are rate-limited using keyed one-way digests of the email address and IP address, which are deleted within a day.
We also operate network sensors that receive unsolicited inbound connections from the internet; they never initiate contact. For security research they record connection metadata (such as the source IP address, the network operator and country derived from public IP data, timestamps and protocol) and bounded samples of what a client sends, and we derive automated labels such as bot category and confidence. Most of this traffic is automated; we minimize what we keep and protect it as security data.
We do not knowingly collect information from children under 13, and the Services are not directed to children.
We use service providers that process personal information on our behalf under contract, for hosting and edge delivery (Vercel), database hosting (Neon), sensor hosting (Fly.io), transactional and sign-in email (Resend) and payments and billing (Stripe). If you choose to sign in with Google or Microsoft, that provider shares your name and email address with us. These providers may use the information only to provide their services to us.
Approved customers on paid plans may receive event-level Sensor data, which can include IP addresses and request details, for security purposes only and under contractual restrictions (no re-identification, no use for decisions about individuals' credit, employment, insurance or housing, no harassment or retaliation). Raw data beyond the plans is provided only under a separate written agreement. Some state laws may treat these disclosures as a "sale" of personal information. You can opt out as described in Section 7. We do not sell or share the personal information of website visitors or account holders.
Our public pages and public API show only aggregates, top lists, and a deterministic 1-in-100 sample of observations with minute-level time, country-level origin and a tool-family label. Public cells with fewer than 3 events or 2 distinct sources are withheld. Full IP addresses are shown publicly only for verified crawlers and agents whose operators publish their address ranges; all other addresses are masked (IPv4 /24, IPv6 /48) or not shown. The public sample dataset is licensed CC BY 4.0.
We may disclose information to comply with law or valid legal process, to protect the rights, property or safety of SEW Inc., our users or others, in connection with a merger, acquisition or sale of assets, or with your direction or consent.
We do not use personal information for targeted advertising.
| Data | Retention |
|---|---|
| Sensor events (raw records) | 180 days, then deleted; events included in a licensed dataset are kept for at most 24 months |
| Payload and request-body samples | 90 days, then cleared (at most 24 months for a licensed dataset); hashes and labels are kept |
| Aggregates and published statistics | indefinitely (they do not identify individuals) |
| Contact messages and access requests | deleted 90 days after we receive them |
| Account information | while your account exists; deleted within 30 days after you delete it |
| Sign-in links and sessions | links expire after 10 minutes and work once; sessions expire after 7 days; expired records are purged daily |
| Billing records | 7 years, for tax and accounting obligations |
| API key and usage records | daily usage counts for 24 months; revoked keys are deleted 24 months after revocation |
We protect information with access controls, encryption in transit, least-privilege database roles and restricted raw-data access. Captured payloads are stored as inert data and are never executed or fetched. No method of transmission or storage is completely secure.
You can ask to access, correct or delete personal information we hold about you, or to receive a copy, by emailing help@mothlight.ai. For Sensor data, include the IP address and the UTC time window. We will verify the request in a manner proportionate to the data (for an IP address, for example, evidence that you control it). You may use an authorized agent with written permission. We will not discriminate against you for exercising your rights.
We may decline or limit a request where the law permits, including where the information is needed to detect security incidents, protect against malicious, deceptive, fraudulent or illegal activity, or comply with a legal obligation.
If the California Consumer Privacy Act (as amended by the CPRA) applies to us, California residents have the rights to know, delete, correct, and opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information. In the last 12 months we collected the categories in §2 (identifiers, commercial information such as subscription and purchase history, and internet or network activity) from the sources described there, for the purposes in §3, and disclosed them as described in §4. We acknowledge requests within 10 business days and respond within 45 days (extendable once by 45 days with notice). To opt out of the sale or sharing of Sensor data about you, email help@mothlight.ai with the IP address and UTC time window; after we verify the request we stop including that data in what we provide to customers.
Residents of states with comprehensive privacy laws (for example Virginia, Colorado, Connecticut, Texas, Oregon) may have similar rights, including to appeal our decision by replying to our response.
SEW Inc. is the controller. We process Sensor data and Services data on the basis of our legitimate interests in network and information security and in providing threat intelligence, and on the basis of contract for API customers. You may object to processing based on legitimate interests, and you may lodge a complaint with your supervisory authority. Information is processed in the United States.
We will post changes here with a new effective date and note material changes on our changelog.
help@mothlight.ai · SEW Inc., 200 Continental Dr Ste 401, Newark, DE 19713-4337, USA.