Privacy policy
This policy explains which personal data Muhamor processes, why, for how long, who receives it and what rights you have under the EU General Data Protection Regulation (GDPR). We collect as little as possible and do not use tracking or advertising cookies.
1. Controller
The controller is Uravia OÜ, registry code 17631710, Tornimäe tn 5, 10145 Tallinn, Estonia. For any privacy question or request write to hello@muhamor.com.
2. What data we process and why
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Account: email, nickname, password hash, preferred language, two-factor authentication settings | Create and secure your account, sign-in, service emails | Contract (6(1)(b)) |
| Profile: bio and avatar you add voluntarily | Show your public profile | Contract (6(1)(b)) |
| Content and activity: publications, revisions, comments, votes, bookmarks, reports, appeals | Provide the platform, keep the edit history, moderation | Contract (6(1)(b)); legal obligation for notices and statements of reasons under the Digital Services Act (6(1)(c)) |
| Security signals: IP address, a pseudonymous device identifier stored in a cookie, network cluster, timestamps | Rate limits, protection against spam, account abuse and attacks | Legitimate interest in keeping the service safe (6(1)(f)) |
| Trust level, risk points, sanctions and their history | Apply the community rules and handle appeals | Contract (6(1)(b)); legitimate interest (6(1)(f)) |
| Payments: Stripe customer and payment identifiers, purchase and subscription status, amounts | Premium, paid articles, advertising, refunds, accounting | Contract (6(1)(b)); legal obligation under accounting and tax law (6(1)(c)) |
| Authors: payout account identifier, country, verification and payout status, data needed for tax reporting | Pay authors, meet tax reporting duties (including DAC7 where applicable) | Contract (6(1)(b)); legal obligation (6(1)(c)) |
| Newsletter: email address, language, consent version and the times you signed up and confirmed | Send the monthly newsletter you asked for (double opt-in) and prove your consent | Consent (6(1)(a)), which you can withdraw at any time with the unsubscribe link in every email |
| Translation error reports and support requests | Fix translations, answer you | Legitimate interest (6(1)(f)) |
Guests who report illegal content may give their name and email; we use them only to handle the notice and inform them of the decision. For guests we additionally keep a hashed IP address to limit abuse of the reporting form.
3. Automated processing
We calculate trust levels and spam risk points automatically. They affect what you can do on the site (for example how many links you may post). When automated sanctions are enabled, a score above the threshold can temporarily restrict writing. Such decisions are labelled as automated, you are told the reasons, and a person reviews them on appeal. A permanent ban is always decided by a person.
4. Machine translation
To translate public publications and comments, their text may be sent to a translation provider acting as our processor (DeepL SE in Germany, Google Cloud or OpenAI). Only public content is sent. Content from private communities and members-only publications is never sent to an external provider.
5. Who receives data
- Hosting and storage providers, email delivery provider, error monitoring — as processors under data processing agreements.
- Stripe Payments Europe Ltd. for payments and Stripe Connect for author payouts and identity verification. Stripe is also an independent controller for its own legal obligations.
- Translation provider (see section 4).
- Authorities, when we are legally required to share data, for example under article 18 of the Digital Services Act if there is a threat to someone's life or safety.
Your public profile, nickname and public content are visible to everyone on the internet. If data is transferred outside the European Economic Area, we rely on an adequacy decision or on the European Commission's standard contractual clauses.
6. How long we keep data
- Account and profile data: while the account exists. After deletion we erase it, except where a legal obligation requires us to keep something.
- Publications and comments: until you or a moderator delete them. When you delete your account, your content is deleted or anonymised (shown as written by a deleted user) so that discussions remain readable.
- IP addresses, device identifiers and other anti-abuse signals: 90 days.
- Moderation decisions, sanctions and appeals: as long as needed to handle appeals and possible legal claims.
- Payment and accounting records: 7 years, as required by the Estonian Accounting Act.
- Newsletter: until you unsubscribe — then the address is deleted at once. Sign-ups that are not confirmed within 7 days are deleted automatically.
- Server backups are overwritten on a rolling schedule.
7. Cookies
We only use cookies that are strictly necessary: the session cookie for signing in, the CSRF protection cookie, your language preferences (the interface language, and the reading language in the mh_read cookie once you pick one, so publications are shown in your language) and a pseudonymous device cookie used for anti-abuse limits. We do not use analytics, tracking or advertising cookies, so we do not ask for cookie consent.
8. Your rights
You have the right to access your data, to rectify it, to erase it, to restrict processing, to data portability and to object to processing based on legitimate interests. You can export your data and delete your account in the account settings, or write to us. We answer within one month. You can also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the supervisory authority of your country.
9. Security
Connections are encrypted (HTTPS), passwords are stored as hashes, staff must use two-factor authentication, and access to personal data is limited to people who need it for their work.
10. Changes
If we change this policy in a material way, we will announce it on the site and by email before the change takes effect.