Privacy Policy - Product Moat

1. Who we are

Product Moat (productmoat.com) is an interview series run by Martin Knapic. This policy covers the information collected through the website - browsing the directory and map, applying to be featured, recommending someone else, signing up for a profile, and signing in with LinkedIn to verify an application.

2. Information we collect

Depending on how you use the site, we collect:

Application details - name, role, company, location, LinkedIn URL, personal website, X/Twitter handle, years of experience, a short bio, a pull quote, an optional photo, and any Q&A answers you write when applying to be featured.
Recommendation details - the LinkedIn URL of the person you're recommending, your own name and email if you provide them, and any note you add about why they'd be a good fit.
LinkedIn sign-in data - when you sign in with LinkedIn to verify an application, we receive your name, email, and profile photo from LinkedIn's OpenID Connect response. This confirms you are who you say you are before unlocking the application form, and also signs you in site-wide (see "LinkedIn sign-in" below).
Profile & newsletter preference - if you sign up via the nav's "Sign up" button, or tick "Subscribe me to the newsletter" next to any LinkedIn sign-in button (Sign up, Apply, Recommend, Put yourself on the map), we store your name, email, and photo as a private record together with your newsletter choice (see "Signing up & the newsletter" below).
Newsletter email address - if you enter your email in the signup box on the homepage, we collect only that address, and pass it to our email service provider, SendFox, to subscribe you to the newsletter. We don't create a profile record for it (see "Signing up & the newsletter" below).
Map pin details - if you put yourself on the map, we store the approximate location you choose, your name, and photo, shown publicly as a pin once approved.
Local preferences - your light/dark theme choice, stored in your browser's local storage so the site remembers it on your next visit.
Basic technical data - our hosting provider processes standard request information (like IP address and browser type) as part of running and securing the site. We don't read this ourselves or combine it with your application, profile, or map data.

2a. Where this comes from

Most of what we collect, you give us directly by filling in a form. When you sign in with LinkedIn, LinkedIn is the source of your name, email, and photo, sent to us under your authorization. When someone else recommends you, the source is that recommender, not you - if you'd rather not be recommended this way, contact us using the details in section 17 and we'll remove the recommendation.

3. How we use it

We use the information above to:

Review applications and recommendations, and decide who to feature in the series.
Verify that an application is genuinely coming from the person it claims to be from, via LinkedIn sign-in.
Publish an interview - name, role, company, links, bio, photo, and Q&A - on productmoat.com and share it across our distribution channels (LinkedIn, the newsletter, X, Facebook), if and when you're featured, and always with your knowledge.
Send the newsletter only to people who explicitly ticked the "Subscribe me to the newsletter" box.
Remember your theme preference between visits.

We don't use your information for anything beyond running and improving Product Moat.

4. LinkedIn sign-in

Signing in with LinkedIn on the Apply, Recommend, or Put yourself on the map forms does two things. First, it's an identity check: LinkedIn's authorization server sends the confirmation back to a short-lived, server-side function, which reads your name, email, and photo from the token and stores them in a signed, HttpOnly cookie for a few minutes - just long enough to pre-fill the form. Second, it signs you in site-wide: the same function also sets a longer-lived (30-day) signed, HttpOnly session cookie, which is what shows your avatar and a "My profile" / "Log out" menu in the nav afterward, on any page. You can end that session at any time via "Log out." Either way, we don't use this to post to LinkedIn on your behalf or access your connections.

5. Signing up & the newsletter

Every LinkedIn sign-in button on the site - Sign up, Apply, Recommend, and Put yourself on the map - comes with an unticked "Subscribe me to the Product Moat newsletter" checkbox. We subscribe you only if you tick it; we never pre-tick it or subscribe you automatically. If you do, we store your name, email, and photo as a private record alongside that choice, and every issue includes an unsubscribe link. To send the newsletter, your name and email address are also passed to our email service provider, SendFox, which may email you to confirm your subscription. Clicking "Sign up" in the nav additionally creates a private profile record (name, email, photo) whether or not you subscribe. If you don't tick the box on Apply, Recommend, or Put yourself on the map, we don't create a profile record or touch your newsletter subscription. If you'd like your record deleted or your newsletter preference changed later, contact us using the details in section 17.

You can also subscribe with just your email address using the signup box on the homepage. In that case we don't ask for or store a name, photo, or profile: the address goes straight to SendFox, which may email you to confirm your subscription, and every issue includes an unsubscribe link. Entering your email there is your consent to receive the newsletter; to have the address removed, unsubscribe from any issue or contact us using the details in section 17.

5a. The alumni network

On the Apply page (and on the Alumni network and My profile pages) you can choose to join the Product Moat alumni network by ticking an unticked-by-default checkbox. The network is a members-only directory of people we've interviewed. By joining you agree that, once you've been interviewed and your interview is published, other members of the network can see your name, photo, role, company, location, focus areas, short bio, links and email address. In return you get access to the directory of the other members who have agreed the same. We record that you opted in (and when) on your private member record. You can leave at any time from My profile, which removes you from the directory and ends your access straight away. Members should use the details of others only for genuine peer-to-peer connection.

6. Legal bases for processing (EEA/UK)

If you're in the European Economic Area or the UK, we rely on one of these bases for each use of your information:

Consent - for the newsletter, the alumni network, and signing in with LinkedIn. You can withdraw consent at any time (see "Your rights" below) without affecting anything we did before you withdrew it.
Steps you ask us to take before a contract - reviewing an application or recommendation is a step you request before we might feature you, so we can process it on that basis.
Legitimate interests - running and securing the site, verifying that an application genuinely comes from the person it claims to, and publishing an interview you've reviewed and approved. We've weighed these interests against your rights and don't believe they override them; contact us if you disagree.

7. Sharing of information

We don't sell or rent your information. We don't share application or recommendation details with third parties except:

The service providers that host the site and process form submissions on our behalf.
LinkedIn, to the extent required to complete the sign-in flow described above.
Publicly, if you're accepted and featured - and only the interview content you review and approve before it goes live.

We don't sell personal information, and we haven't sold anyone's personal information in the past 12 months. We also don't "share" personal information as that term is defined under California's CPRA - none of the sharing above is for cross-context behavioral advertising.

8. International data transfers

Our service providers - including our hosting provider (Vercel) and our email service provider (SendFox) - are based in the United States. If you're accessing Product Moat from the EEA, the UK, or elsewhere outside the US, your information may be transferred to and processed in the US. Where that's required, we rely on safeguards such as our providers' standard contractual clauses to protect it in transit.

9. Cookies & local storage

Product Moat doesn't run third-party analytics or advertising trackers. We set two cookies, both described above: the short-lived LinkedIn verification cookie, which expires automatically a few minutes after it's created, and the 30-day sign-in session cookie, which you can clear early with "Log out." We also use your browser's local storage to remember your theme preference - this stays on your device and is never sent to us.

10. Data retention

We keep application and recommendation details for as long as needed to review them and, if you're featured, to keep your published profile accurate. If you signed up, we keep your record and newsletter preference until you ask us to delete it. If you'd like your application, recommendation, or profile data deleted, contact us and we'll remove it.

11. Automated decision-making

We don't use automated decision-making or profiling that produces legal or similarly significant effects on you. Whether an application or recommendation is accepted is a human decision, made by us after reading it.

12. Your rights

You can ask us at any time to:

Tell you what information we hold about you and why (access).
Correct information that's wrong or out of date (rectification).
Delete your information, including a published interview, your profile record, or a map pin (erasure).
Pause how we use your information while a request like the above is sorted out (restriction).
Get a copy of the information you gave us in a portable format (portability).
Object to processing we base on legitimate interests, as described in section 6.
Withdraw consent at any time for anything based on consent - the newsletter, the alumni network, or LinkedIn sign-in - without affecting what we did before you withdrew it.
Unsubscribe from the newsletter, using the link in any issue or by contacting us.

Reach out using the contact details in section 17 and we'll handle it directly. If you're in the EEA or the UK and aren't satisfied with our response, you also have the right to lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner's Office).

13. California privacy rights

If you're a California resident, the CCPA (as amended by the CPRA) gives you these rights over the personal information described in section 2, in addition to everything in section 12:

Right to know - what categories of personal information we've collected about you, where it came from, and why, over the past 12 months.
Right to delete - your personal information, subject to the exceptions the law allows.
Right to correct - inaccurate personal information we hold about you.
Right to opt out of sale or sharing - we don't sell personal information or share it for cross-context behavioral advertising, so there's nothing to opt out of (see section 7).
Right to limit use of sensitive personal information - we don't collect the categories of sensitive personal information defined by the CPRA (like government ID numbers, precise geolocation, or financial account details), so there's nothing to limit.
Right to non-discrimination - we won't deny you service, charge you a different amount, or treat you differently for exercising any of these rights.

The categories of personal information described in section 2 map to the statutory categories: identifiers (name, email, LinkedIn URL); professional or employment information (role, company, years of experience, bio); internet or network activity (theme preference, basic technical data); geolocation (the approximate location you choose for a map pin); and photographs. We collect these directly from you, and from LinkedIn when you sign in, for the purposes described in section 3. We haven't sold or shared any of it in the preceding 12 months.

To exercise any of these rights, contact us using the details in section 17. You can also designate an authorized agent to make a request on your behalf; we may ask for proof of that authorization before acting on it. California's "Shine the Light" law (Civil Code §1798.83) lets residents ask what personal information we've shared with third parties for their own direct marketing - we don't do this, so there's nothing to disclose under it.

14. Security

We take reasonable steps to protect the information you share with us, including keeping the LinkedIn verification exchange server-side and never exposing credentials or tokens to the browser. No method of transmission or storage is ever fully secure, so we can't guarantee absolute security.

15. Children's privacy

Product Moat is intended for working professionals and isn't directed at children. We don't knowingly collect information from anyone under 16.

16. Changes to this policy

We may update this policy as the site evolves. If we make a material change, we'll update the "Last updated" date at the top of this page.

17. Contact

Questions about this policy, or a request to access, correct, or delete your information? Reach out via [ LinkedIn ].