Privacy Policy

1. Data controller

The controller of users personal data is the entity operating the Mutterbox service. You may contact us about data protection matters at the email address given in the site footer.

2. What we collect about users

Email address, password in hashed form, display name, interface language, organization name and billing details passed to the payment processor. We also keep technical access logs needed for security.

3. Personal data inside analysed reviews

Reviews are public but contain data about the people who wrote them. The service does NOT store author names, profile links or avatars. Instead of an author identifier we store an irreversible hash, sufficient to detect a series of reviews by the same person on one platform but not to identify them.

4. Report content

Reports describe processes and places, not people. Naming individual employees is excluded at generation time and checked in a separate verification step.

5. How long we keep data

Account data is kept for as long as the account exists. Raw reviews are kept for up to 24 months from the last use of a given venue and then deleted, retaining aggregated data only. Billing records are kept for the period required by tax law.

6. Who we share data with

Providers necessary to deliver the service: the payment processor, the language model provider processing review text, the review data provider, and the email and hosting providers. Each receives only the data required for its task.

7. Your rights

You have the right to access, rectify, erase, restrict processing of and port your data, and to object. We provide an organization data export on request. You may also lodge a complaint with your data protection authority.

8. Cookies

The cookies necessary for the service to work are the session cookie and the remember-me cookie. Only with your consent (Art. 6(1)(a) GDPR) do we use Google Analytics 4, a tool of Google Ireland Ltd., which sets the _ga and _ga_* cookies (up to 2 years) to count visits and see which content gets read. Data may be transferred to Google LLC in the USA under the Data Privacy Framework. Without consent Google Analytics sets no cookies. You can withdraw consent at any time via the "Cookie settings" link in the page footer. We do not use advertising trackers or cross-site profiling.

9. Waitlist and downloadable resources

If you join the waitlist or request a resource, we process your email address, the page language and the signup date. We do this to send what you asked for: a confirmation link and a single email on launch day, or the file (Art. 6(1)(b) GDPR). A waitlist signup only counts once you click the link in the email. We send marketing tips only if you tick a separate consent box (Art. 6(1)(a) GDPR), which you can withdraw at any time. Every email includes a link to remove your address. The waitlist link deletes your signup immediately. We keep waitlist addresses until launch and for at most 12 months after it if you do not create an account.