Privacy Policy
1. Who is responsible for your data
MumbleMe ("we") is responsible for the personal data described here. Contact us about privacy at [email protected].
2. What we collect, and why
| What | When | Why (purpose and lawful basis) |
|---|---|---|
| Your email address, and your name and profile picture if you sign in with Google | You create an account or sign in | To run your account and sign you in (contract) |
| Purchase and billing records: plan, slots, amounts, dates, Stripe or PayPal references, invoices | You buy or renew | To provide what you paid for, and to keep accounts (contract; legal obligation) |
| Your servers: names, addresses, region, settings, channels, permissions, the server passwords you set, and what you change in the control panel | You use the service | To provide and run your servers (contract) |
| Data on your Mumble server: names and certificate identifiers of users registered on it, its own logs of who connected, including IP addresses | Your users connect | To run the server you asked for (contract). You decide who uses your server, and we handle this data on your behalf. |
| Support messages: your name, email address and message | You contact us | To answer you (legitimate interests) |
| Technical data: IP address, browser, pages requested, and security signals from Cloudflare | You visit the site | To keep the site secure and working, and to stop abuse (legitimate interests) |
| Visit statistics, anonymous and without cookies, through Umami, *only if switched on* | You visit the public pages | To understand which pages are used (legitimate interests) |
We do not record voice conversations. We do not sell your data, and we do not use it for advertising.
3. Who we share it with
We use these service providers. Each handles data only on our instructions, or under its own policy where it is the controller (for example Stripe, for payments).
| Provider | What for | Where |
|---|---|---|
| Stripe | Card payments and subscriptions; card details go to Stripe, never to us | Global; Stripe privacy policy |
| PayPal | Subscriptions from our previous system, for existing customers | Global |
| DigitalOcean | Hosting the website, database and UK voice servers | London, UK |
| Kamatera | Hosting US voice servers | New York, USA |
| Cloudflare | DNS, website security and delivery, the support form's bot check (Turnstile), and email forwarding | Global |
| Resend | Sending account and billing emails | USA |
| Sign-in, only if you choose "Sign in with Google" | Global | |
| Umami | Anonymous visit statistics, only if switched on; IP addresses are used only briefly to count visits and are not stored with them | USA and EU |
We may also disclose data where the law requires it, or to protect people or our service from harm.
International transfers. Some providers process data outside the UK, for example US voice servers and global providers. We rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum, or the provider's equivalent safeguards.
4. How long we keep it
| Data | Kept for |
|---|---|
| Your account | While it is open. When you close it, sign-in stops straight away, and your personal details are anonymised 12 months later. Billing records are kept for the period below. You can ask us to delete your data sooner (section 6). |
| Billing and payment records | 6 years after the year they relate to (UK tax and accounting law) |
| A server after its subscription ends or goes unpaid | Stopped, then kept for 90 days so you can restore it, then deleted |
| A free-trial server that is not bought | 24 hours after the trial ends, then deleted |
| A free-for-life server from our previous system | Warned after 23 days unused, stopped at 30, deleted 7 days after that |
| Mumble server logs (including connecting IP addresses) | Up to 31 days |
| Support emails | For as long as we need them to help you and to keep a record of what was agreed. You can ask us to delete them at any time. |
| Backups | Encrypted. Daily copies are kept for 7 days, weekly for 4 weeks and monthly for 6 months, then deleted |
5. Cookies
We use only cookies that are needed for the site to work:
- a sign-in session cookie, so that you stay signed in;
- Cloudflare security cookies, which help tell people from bots;
- Stripe's cookies on its own checkout pages, to process your payment securely.
We use no advertising or tracking cookies. Visit statistics, if switched on, use no cookies at all. So we do not need to ask for cookie consent.
6. Your rights
Under UK GDPR you can ask us to:
- access the personal data we hold about you, and receive a copy;
- correct it if it is wrong;
- delete it, where we no longer need it. We must keep billing records for the period in section 4;
- restrict or object to how we use it, where we rely on legitimate interests;
- give it to you in a portable format.
To use any of these rights, email [email protected]. We reply within one month. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office, ico.org.uk, but please contact us first so we can try to put it right.
If you are a user of someone else's MumbleMe server: that server's owner decides who may use it and sets its rules. Contact them first. You can also contact us.
7. Security
- Connections to the site and the control panel use HTTPS.
- Server passwords are not kept in our database. It holds only a one-way fingerprint, and the password itself is held by your Mumble server. SuperUser passwords are shown to you only once.
- Access to our systems is limited and protected.
- Backups are encrypted.
- Payment card details never reach our systems.
No system is perfectly secure. If a breach affects your data and puts your rights at risk, we will tell you, and the ICO where required.
8. Children
MumbleMe is for adults: you must be at least 18 to open a server. We do not knowingly collect data from children.
9. Changes to this policy
We will post any changes here and update the date above. If a change matters to you, we will email you before it applies.
Questions? Email [email protected].