Privacy Policy & Data Protection

Data Controller & Company Details

The controller of your personal data within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation — GDPR / RODO) and the legal entity operating the MUMRO service (https://mumro.io and https://app.mumro.io) is DORADZTWO INŻYNIERYJNO-TECHNICZNE MONIKA HUMAJ, with its registered office at ul. Kuźnicy Kołłątajowskiej 17K lok. 30, 31-234 Kraków, Poland, NIP (Tax ID): 9492232056.

For all matters regarding privacy, data protection, exercising your GDPR rights, or revoking platform permissions, you can contact us directly via email at stuczynski.g@gmail.com or in writing at the registered address in Kraków.

• Company / Data Controller: DORADZTWO INŻYNIERYJNO-TECHNICZNE MONIKA HUMAJ
• Registered office address: ul. Kuźnicy Kołłątajowskiej 17K lok. 30, 31-234 Kraków, Poland
• Tax Identification Number (NIP): 9492232056 (EU VAT: PL9492232056)
• Direct privacy & data protection email: stuczynski.g@gmail.com
• Primary domains covered: https://mumro.io and https://app.mumro.io (MUMRO / RolePlayingTech)

Scope of This Privacy Policy

This Privacy Policy applies to two distinct layers of the MUMRO ecosystem:

First, the public informational and demonstration website available at https://mumro.io (in English and Polish). All interactive product previews, campaign scenarios (such as Cycling Escapes / FIELDWORK and Świadek Dziejów), and MCP chat walkthroughs on the public landing page operate locally in your browser using static demonstration fixtures without connecting to live user accounts.

Second, partner onboarding, direct correspondence, and the authenticated MUMRO application environment (including workspaces, content studio, social and website publishing queues, comment moderation, analytics, and Model Context Protocol server tools) made available to invited partners, brands, and editorial teams.

• Public website visitors browsing https://mumro.io and https://mumro.io/pl/
• Prospective partners and clients contacting us for live demos, pilots, or collaboration
• Authenticated workspace members and administrators using the MUMRO platform and MCP integrations

Categories of Data We Collect & Process

We adhere to the principle of data minimization (Article 5(1)(c) GDPR) and collect only the data strictly necessary for the specific interaction:

• Website technical & diagnostic data: IP address, HTTP request headers, browser type and language preference (Accept-Language), requested URL, timestamp, and HTTP status code recorded in standard Nginx web server logs.
• Contact & partner onboarding data: name, email address, company/brand name, role, website/social links, and any project context you voluntarily include when emailing stuczynski.g@gmail.com.
• Workspace account & authentication data: user identifier, email address, hashed password or OAuth login token, workspace membership, assigned role, and security audit logs of administrative actions.
• Brand context & editorial content: brand strategy documents, Brand Voice guidelines, research sources, article and social drafts, media assets (images, video, audio), and publishing schedules stored in your workspace.
• Connected channel & OAuth data: encrypted access and refresh tokens, platform account/page IDs, channel handles, avatars, published post metadata, audience comments/replies (where comment management is enabled), and aggregated channel performance metrics.

Purposes & Legal Basis for Processing

We process personal data solely on valid legal bases defined in Article 6(1) of the GDPR:

• Performance of a contract or pre-contractual steps (Article 6(1)(b) GDPR): responding to your inquiry about MUMRO access or a pilot, provisioning and operating your MUMRO workspace, executing scheduled publications, and providing technical support.
• Legitimate interests of the controller (Article 6(1)(f) GDPR): ensuring network and application security, preventing abuse, diagnosing technical errors, remembering your interface language preference (EN/PL), and maintaining B2B communication with partners.
• Explicit consent / authorization (Article 6(1)(a) GDPR): connecting third-party social media accounts or CMS websites via OAuth or API tokens. You may withdraw consent and disconnect any integration at any time without affecting the lawfulness of prior processing.
• Compliance with legal obligations (Article 6(1)(c) GDPR): fulfilling applicable tax, accounting, or statutory record-keeping requirements when commercial cooperation takes place.

Connected Social Channels, OAuth & Website CMS Integrations

MUMRO enables workspace users to connect external publishing and analytics channels, including Meta Platforms (Facebook Pages and Instagram Professional accounts), Google / YouTube (YouTube Data & Analytics APIs), LinkedIn, X (Twitter), TikTok, WordPress sites, and custom CMS endpoints.

When you authorize a connection via OAuth 2.0 or provide an API/webhook credential, MUMRO accesses and processes platform data strictly to deliver the features you explicitly trigger or configure within your workspace:

• Publishing & scheduling: transmitting approved text, images, carousels, short-form videos, or articles to the target channel at the scheduled time or upon human confirmation.
• Audience conversations & comments: fetching comments on your connected posts and publishing replies strictly according to your workspace autonomy rules (manual review or bounded auto-reply rules).
• Performance analytics: retrieving post-level and channel-level reach, engagement, and click metrics to display cohort comparisons and strategy insights inside your workspace.
• Token security & strict non-abuse guarantee: OAuth access and refresh tokens are stored encrypted at rest. MUMRO never sells platform data, never uses data from Google, Meta, LinkedIn, X, or TikTok APIs for surveillance, creditworthiness, or third-party advertising, and never transfers connected account data outside the authorized workspace.

AI Model Providers & Model Context Protocol (MCP)

Within the MUMRO platform, workspace users can generate, refine, and analyze content using integrated AI models (such as OpenAI, Google Gemini, Anthropic Claude, or ElevenLabs for audio) and can connect external AI assistants (such as Claude Desktop, Cursor, or ChatGPT) via the Model Context Protocol (MCP).

All AI and MCP operations are governed by strict workspace boundaries and human-in-the-loop controls:

• Scoped context: AI prompts include only the brand strategy, voice rules, research sources, and performance summaries belonging to the active workspace.
• No public model training: data transmitted from MUMRO to commercial AI APIs is processed under API terms that prohibit the provider from using customer API payloads to train public foundation models.
• MCP confirmation gates: when an external agent connects via MCP, read tools are scoped to the authenticated workspace, and publishing or scheduling mutations require explicit confirmation gates in accordance with your autonomy settings.

Cookies, Local Storage & Server Logs

We respect your browser privacy and keep client-side storage to an absolute minimum:

• Language preference cookie (mumro_lang): when you switch between English (EN) and Polish (PL) on mumro.io, we set a first-party functional cookie named mumro_lang (values: en or pl, Path=/, Max-Age=31536000 / 12 months, SameSite=Lax, Secure on HTTPS). If cookies are disabled in your browser, language selection continues to work via URL paths (/ and /pl/) and query parameters (?lang=en|pl).
• Authenticated session cookies (app.mumro.io): the MUMRO application uses strictly necessary HttpOnly, Secure session cookies to keep logged-in workspace users authenticated and protected against CSRF.
• No third-party tracking cookies: we do not load Google Analytics, Meta Pixel, TikTok Pixel, or third-party retargeting scripts on mumro.io. All fonts (Inter, Instrument Serif) and media assets are self-hosted directly from mumro.io.
• Server logs: Nginx access and error logs are stored on our EU serversolely for security monitoring, DDoS mitigation, and troubleshooting, and are rotated automatically.

Data Recipients, EU Hosting & International Transfers

We do not sell, rent, or trade your personal data. Data may be shared only with trusted infrastructure and API providers acting as data processors or independent controllers to the extent necessary to deliver the service:

• Primary EU hosting & infrastructure: Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) — hosting the mumro.io website and MUMRO platform infrastructure within European Union data centers.
• Connected social & CMS platforms: Meta, Google/YouTube, LinkedIn, X, TikTok, or your own WordPress/CMS host — only when you explicitly connect those channels and instruct MUMRO to sync or publish content.
• AI API providers (workspace users only): OpenAI, Google Cloud / Gemini, Anthropic, or ElevenLabs when AI generation features are invoked within a workspace.
• Transfers outside the EEA: where an integrated API provider processes data in the United States, transfers are safeguarded by the EU–U.S. Data Privacy Framework (DPF) adequacy decision and/or European Commission Standard Contractual Clauses (SCCs, Article 46 GDPR).

Data Retention & User Data Deletion Instructions

We retain data only for as long as necessary to fulfill the purposes outlined in this policy: server logs are retained for up to 90 days; the mumro_lang cookie expires after 12 months; email correspondence is kept for the duration of discussions or cooperation; and workspace data is retained while your workspace remains active.

You have full control to disconnect third-party integrations and request complete erasure of your personal data and connected platform data at any time:

• Step 1 — Disconnect channels or revoke OAuth immediately: you can disconnect any social account or CMS inside MUMRO workspace settings, or revoke MUMRO’s OAuth access directly in your platform settings (Facebook Settings → Business Integrations, Google Account → Third-party apps & services, LinkedIn → Permitted Services, X → Connected apps, TikTok → Manage app permissions). Upon disconnection, stored OAuth tokens are invalidated and deleted.
• Step 2 — Request full account & data deletion via email: send an email to stuczynski.g@gmail.com from the email address associated with your account or inquiry with the subject line "Data Deletion Request — MUMRO" (state which workspace, connected channel, or email thread you wish to erase).
• Step 3 — Verification & permanent erasure timeline: we acknowledge every deletion request within 48 hours and permanently delete your personal data, workspace records, encrypted OAuth tokens, and cached social/CMS metadata within 7 business days (and in all cases no later than 30 days as required by GDPR), sending you written confirmation once completed.

Your Rights under GDPR (RODO) & Policy Updates

Under the General Data Protection Regulation (GDPR / RODO), you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) — obtain confirmation of whether we process your data and receive a copy of it.
• Right to rectification (Art. 16 GDPR) — request correction of inaccurate or incomplete personal data.
• Right to erasure / "right to be forgotten" (Art. 17 GDPR) — request deletion of your personal data (see Section 09 above).
• Right to restriction of processing (Art. 18 GDPR) and right to data portability (Art. 20 GDPR).
• Right to object (Art. 21 GDPR) to processing based on legitimate interests, and right to withdraw consent at any time without affecting prior processing.
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych — PUODO, ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl), or the data protection authority in your EU member state.