Legal
Privacy Policy
- Last updated:
- 13 September 2026
- Effective:
- on public launch
Who we are
UMTUBA Limited (in registration, Republic of Ireland) operates umtuba.com and the UMTUBA mobile applications. We are the data controller for personal data described in this policy.
- Registered office: [[REGISTERED ADDRESS]]
- Company registration number: [[CRN]]
- Privacy contact: [email protected]
What we collect
You give us directly:
- Account data: username, display name, email address, password (stored hashed, never in readable form)
- Profile data: photo, cover image, biography, website link, and optionally city and country
- Content: videos, images, text posts, comments, live streams, messages
- Communications: anything you send to our support addresses
Collected automatically:
- Technical data: IP address, browser type, device type, operating system, language
- Usage data: pages viewed, videos watched, interactions, session timing
- Cookies and similar technologies (see our Cookie Policy)
From third parties:
- Payment status from our payment processors (we never receive your full card number)
- App install and crash data from Google Play and the Apple App Store
Why we use it, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the service you signed up for | Contract |
| Keeping the platform safe; preventing abuse and fraud | Legitimate interests |
| Responding to your support requests | Contract / Legitimate interests |
| Improving the product and fixing faults | Legitimate interests |
| Sending optional marketing messages | Consent |
| Non-essential cookies and analytics | Consent |
| Complying with legal obligations | Legal obligation |
You may withdraw consent at any time. Withdrawal does not affect processing carried out before withdrawal.
Product analytics (draft)
If you accept optional analytics, we send usage events to PostHog, a product-analytics service hosted in the European Union (eu.i.posthog.com). Analytics stays off until you accept. If your browser sends a Do Not Track signal, we do not turn analytics on.
We record page views and named actions such as sign-up, login, video view/like/share, comments posted, posts published, games started or finished, store product views, course opens, searches (whether results were empty — not the search text), and reports submitted. After you sign in we identify you only by your account id. We do not send your email, name, phone number, or the text of posts, comments, or messages.
We keep the first advertising tags from your first visit (utm_source, utm_medium, utm_campaign) and the referring website, so we can later see which campaigns bring people who return. This wording is a draft for review and is not legal advice.
Location data
Location is optional. We do not track you continuously.
Profile city and country are private by default. They become visible to others only if you choose to publish them in your privacy settings.
Location attached to a post is separate: you choose it when publishing, and it is shown with that post.
Who we share with
We do not sell your personal data.
We share with:
- Service providers who process data on our instructions: hosting, storage, content delivery, email delivery, payment processing, crash reporting
- Other users, where you have chosen to publish content or profile information
- Authorities, where we are legally required to disclose
All processors are bound by written agreements requiring confidentiality and security measures equivalent to our own.
International transfers
Some providers operate outside the European Economic Area. Where that happens, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision. You may request a copy of the safeguards by writing to [email protected].
How long we keep it
| Data | Retention |
|---|---|
| Account and profile | While your account is open |
| Content you publish | While published, or until you delete it |
| Content you delete | Up to 30 days in soft-deleted state, then permanently removed |
| Deleted accounts | Up to 30 days, then removed except where law requires longer |
| Server and security logs | Up to 12 months |
| Records of legal complaints and safety reports | Up to 24 months |
| Transaction and tax records | 6 years, as required by Irish law |
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten")
- Restrict how we process your data
- Portability — receive your data in a machine-readable format
- Object to processing based on legitimate interests
- Withdraw consent at any time
- Not be subject to a solely automated decision with legal or similarly significant effects
To exercise any of these, use the request forms in your account settings, or email [email protected]. We respond within one month. That period may be extended by two further months for complex requests; we will tell you if that happens.
If you are unhappy with our response, you may lodge a complaint with the Irish Data Protection Commission (dataprotection.ie) or the supervisory authority in your country of residence.
Security
We use encryption in transit (HTTPS), access controls, database-level row and column permissions, and regular review of who can reach production systems. No system is completely secure; we will notify you and the relevant authority of a personal data breach where the law requires it.
Children
UMTUBA is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, write to [email protected] and we will delete it.
Changes
We will post any changes on this page and update the date above. For significant changes we will notify you in the app or by email before they take effect.