Privacy policy

Last updated: 7 November 2026 · Magyar változat (prevails if the versions differ)

Draft. Have this policy reviewed by a lawyer before public launch.

This policy explains what personal data mumus (the web app at mumus.app and the “mumus – Bug Reporter” browser extension) processes, why, and what rights you have.

Who is responsible

Digital Zombies Kft., [registered office, company registration number], e-mail [hello@mumus.app] (see imprint). Data protection contact: [privacy@mumus.app]. [Data protection officer, if appointed].

When an organization (for example an agency) uses mumus for its clients, that organization is the controller for the reports in its workspace, and mumus processes them on its behalf under a data processing agreement (Art. 28 GDPR, see data processing agreement). For account, billing and website data, we are the controller.

Account data

Name, e-mail address, password (stored only as an Argon2id hash), optional mobile number for SMS alerts (only after you verify it), two-factor secrets (encrypted), notification settings, and login timestamps. Legal basis: contract (Art. 6(1)(b) GDPR).

Billing and payments

Subscriptions are paid through Stripe (Stripe Payments Europe Ltd., Dublin, Ireland), using Stripe Checkout and the Stripe customer portal. Card and bank details are entered on Stripe's pages: mumus never sees or stores them. Stripe receives the name, e-mail address, billing address, VAT ID and payment data of the person who subscribes. We store the Stripe customer and subscription IDs, the plan, the billing interval, the subscription status and the invoice history Stripe reports back. Legal basis: contract (Art. 6(1)(b) GDPR) and legal obligations for accounting and tax records (Art. 6(1)(c) GDPR; invoices and accounting records are kept for 8 years under Section 169 of the Hungarian Accounting Act, Szt.). The legally valid invoice is issued through Számlázz.hu, which receives the billing name, address, e-mail, tax number and the invoice amounts, and reports the invoice to the Hungarian tax authority (NAV) as required by law. Stripe may transfer data to the USA. That transfer is covered by the EU-US Data Privacy Framework and standard contractual clauses.

What the browser extension collects

The extension does nothing on a website until you open it there and the website belongs to one of your projects (Chrome asks for permission per website). It sends data to mumus only when you submit a report, a comment or a recording:

The extension does not track your browsing, does not read pages of websites outside your projects, does not sell or share data with advertisers, and contains no analytics. The login token stays in the extension's background process and is only sent to the mumus server you connected to.

Reports by e-mail and through the website widget

If a project turns these channels on, members can also report by e-mail to the project's secret address, or with the mumus widget on the project's website (for example from a phone, after signing in with a QR code).

• E-mail: the message arrives in our report mailbox at our hosting provider (IONOS, Germany), which mumus reads and empties every minute. We check its DKIM signature and the sender's membership, and store the subject, text, attachments and sender as a task. Mails that fail these checks are discarded without being stored (only a log line with the reason and the sender's domain is kept for [90] days). We send the sender a confirmation.
• Widget: it does nothing for normal visitors of the website. For signed-in reporters, it sends the report text, the optional screenshot, the page address, the pinned element, the browser, operating system, language, time zone, screen and window size, orientation and uncaught JavaScript errors of that page. It stores a "1" flag in the website's local storage and a sign-in token (7 days) in the storage of the mumus frame.

These reports are workspace content: the organization is the controller, and we process them on its behalf (data processing agreement).

Usage analytics (only with your consent)

If you click “Accept analytics” in the cookie banner, we measure how the mumus website and web app are used, so we can find confusing flows and improve them. We do this ourselves, on our own servers in the EU, with no third-party tools:

• Page views: only the name of the page type (for example “project board”), never IDs, addresses of your tasks or query strings.
• Clicks on interface elements: an element identifier defined by our developers (for example “new task button”) and the click position relative to the page. Never text content, form input or keystrokes.
• “Rage clicks” (several fast clicks on the same spot), scroll depth, time on the page and the size of the browser window.

The events are linked only to a random ID that lives for one browser tab session (mumus-analytics-session in session storage). We store no user ID, e-mail address or IP address with them. There's no tracking across other websites and no profiling. Events are deleted after 90 days. Legal basis: your consent (Art. 6(1)(a) GDPR, Section 155(4) Eht.). You can withdraw it at any time under “Cookie settings” in the footer or in the account menu. Withdrawing stops the measurement immediately. Without consent, nothing is measured. Details: cookie policy.

Operating the service

To provide support, enforce storage limits and bill correctly, we look at usage figures per organization, such as the number of members, projects and tasks, the storage used and its growth, the subscription status and the last login. We don't read the content of your reports for this. Legal basis: contract (Art. 6(1)(b) GDPR) and our legitimate interest in a stable, fairly used service (Art. 6(1)(f) GDPR).

Our web server keeps technical logs (IP address, time, requested address, status code, browser) to keep the service secure. They are deleted after [14] days. Security events (for example failed logins) are kept for [90] days. Legal basis: legitimate interest in IT security (Art. 6(1)(f) GDPR).

Success stories

On our customer stories page, we only publish names, photos, logos and quotes of people and companies who have given us their written consent (Art. 6(1)(a) GDPR). Consent can be withdrawn at any time, and we will then remove the story.

Recipients and processors

SMS alerts contain the project name, task number and a short title. Optional AI assistants you connect yourself (for example Claude Code or Codex) receive the task data they request with your token. You control and revoke these tokens, and the AI provider is your own contractual partner.

Breached-password check: when you choose a password, the first five characters of its SHA-1 hash are checked against Have I Been Pwned (k-anonymity). The password itself never leaves our server.

Storage period

Reports, comments and files are kept until the organization deletes them or closes its workspace. After a subscription ends, the workspace stays read-only. If it stays without a subscription for [6 months], we may delete it after 30 days' notice by e-mail (see section 12 of the terms). Workspaces deleted by their owner are deleted permanently after 30 days. Unconfirmed sign-ups expire after 24 hours and password-reset links after 1 hour; both are deleted after 7 days. Usage analytics are kept for 90 days, security logs for [90] days, and invoices and accounting records for 8 years (Section 169 Szt.). Backups are overwritten after [30] days.

Cookies and local storage

mumus uses a session cookie for login and CSRF protection and a cookie that stores your cookie choice (both strictly necessary). Your theme choice is stored in your browser's local storage. Usage analytics run only with your consent. There are no advertising cookies. Full list: cookie policy.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR), and you can lodge a complaint with a supervisory authority, for example the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, Falk Miksa utca 9–11, 1055 Budapest, naih.hu) or the authority in your EU country. Contact us at [privacy@mumus.app]. If your data is in an organization's workspace, we will forward your request to that organization.

Self-service: you can delete your own account at any time under Account settings → Delete account. Workspace owners can download a complete export (JSON, CSV and all files) and delete the workspace under Team & access → Data & deletion. A deleted workspace stays read-only for 30 days so it can be restored, and is then deleted permanently. Copies in backups are overwritten within the backup retention period.

Security

TLS for all connections, two-factor login, role-based access per project, private file storage, and encrypted secrets. Details: Security.