Privacy Policy
Not yet reviewed by a solicitor. These terms apply as written, but are pending professional legal review and will be revisited on incorporation.
This policy explains what personal data the Umbwela platform collects, why, and what rights you have. Umbwela is built to collect as little about you as possible. We do not sell your data, we do not use it for advertising, and most of what we keep, we keep only because you have signed agreements that we must be able to evidence.
1. Who is responsible for your data
The Umbwela platform (the "Platform") is operated by David Manning, a sole trader based in Brisbane, Australia, trading as Umbwela, who is the data controller for the personal data described in this policy. You can contact us about privacy at hello@umbwela.com.
2. Our approach
We designed Umbwela around data minimisation. Across the Platform, and on public pages, you appear as a nickname and an avatar. Your real name is shown only to the people you work with directly, as set out in section 6. We do not ask for your phone number, your postal address, your date of birth, or any payment card details. We collect the limited information below only to run the Platform and to keep proper records of the agreements you enter into.
3. What we collect
3.1 Account information: your email address (to create your account, sign you in, and send you essential messages such as document-signing links), your password (which we store only in a securely hashed form), and the nickname and avatar you choose as your public identity.
3.2 Identity for agreements: your first name, last name, and legal name. These are held privately and used for the legal agreements you accept on the Platform — your legal name is recorded as part of the signature evidence for each document you sign, which is what makes that signature meaningful.
3.3 Optional information: a general location (such as country or city) if you choose to provide it. We do not collect a street address.
3.4 Your activity on the Platform: the projects you take part in, the contributions you make, and the tokens and ledger records that result from them.
3.5 Agreement records: when you accept the Platform Terms and this policy, we record which version you accepted and when. When you sign a project's Non-Disclosure, Contributor, or Project Governance Agreement, we record evidence that you signed it — your identity (legal name, nickname, and account identifier), the document and its version, the date and time, the consent wording shown to you, your IP address, and your browser or device information. This is standard for electronic signatures and is what allows the agreement to be relied on later.
3.6 Technical information: the minimum needed to keep you signed in and to keep the Platform secure, such as the sign-in details your browser keeps for you and basic security logs.
3.7 Feedback: if you send us feedback from within the Platform, we keep your message, the page you were on, and your browser information, so we can follow it up.
3.8 Faucet waiting list: if the invite faucet is closed and you ask us to tell you when it reopens, we keep only your email address and the date you asked. We use it once, to send that one email, and then delete it.
4. What we do not do
We do not collect your phone number, postal address, date of birth, or payment card details. We do not track you across other websites, we do not use your data for advertising, and we never sell your personal data to anyone.
5. Why we use your data, and our lawful basis
5.1 To provide the Platform and your account — because it is necessary to perform our contract with you.
5.2 To keep records of the agreements you accept, including the signature evidence — because we have a legal obligation to keep proper records and a legitimate interest in being able to evidence and enforce those agreements.
5.3 To keep the Platform secure and prevent misuse or fraud — because we have a legitimate interest in protecting the Platform and its users.
5.4 To send you essential service messages — because it is necessary to perform our contract with you.
5.5 To tell you once when the invite faucet reopens, if you asked us to — because you asked us to (your consent), and only until we send that one email.
6. Who can see your data
6.1 Anyone visiting a public page, and other users in general, see your nickname and avatar and the public parts of your profile, such as your role, your projects and your contribution totals, but never your real name or email address. The people you work with directly see more: other members of your project (including its founders when they offer you a seat) see your real name, your contributions, your token stake as recorded in the ledger, and the fact that you have accepted the project's agreements; the founders of your project can also download the documents you sign there, with the signature evidence described in 3.5; and the other managers of a partner you help manage see your real name. This is how projects and partners work. Your email address is not shown to anyone else. A member who vouches for you can record the first and last name they know you by. That note is private to them: you and other members never see it, and we use it to keep the platform honest. Like a name saved in their phone's contacts, it is their record, so it stays if you close your account.
6.2 Service providers who help us run the Platform — such as our cloud hosting and email delivery providers — process data on our behalf, under confidentiality, and only as needed to provide their service to us.
6.3 We may disclose data where we are required to by law, or to establish, exercise, or defend legal claims.
7. Where your data is held
The Platform is hosted on Microsoft Azure in its West Europe region, in the Netherlands, and our emails are sent through Microsoft's email service from Europe. If you email us, your message is held in our Microsoft 365 mailbox, which is stored in Australia. Cloudflare checks that sign-ups, sign-ins and waiting-list requests come from a person rather than a bot, which involves your IP address and browser information. Where your data moves between countries, we rely on the standard contractual terms in our providers' data protection agreements.
8. How long we keep it
We keep your account information for as long as you have an account. Because the Platform is built around signed agreements, we keep the agreements you accept and their signature evidence for as long as we may need to evidence or enforce them and for as long as the law requires — typically for the life of the agreement plus the period in which a related claim could be brought. Ledger records of contributions and earned tokens are permanent by design, as set out in the project agreements. When information is no longer needed for these purposes, we delete or anonymise it.
9. Your rights
Wherever you live, you have the right to: access the personal data we hold about you; ask us to correct it if it is wrong; ask us to delete it; ask us to restrict or object to how we use it; and ask for a copy in a portable form. Where we rely on your consent, you can withdraw it at any time.
We will always respond to these requests, but some limits apply: we may need to keep the agreements you have signed and their signature evidence even if you ask us to delete your data, because we are legally required to keep those records and need them to evidence the agreements; and the ledger record of tokens you have earned is permanent under the project agreements. Where a limit applies, we will explain it to you.
To exercise any right, contact us at hello@umbwela.com. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, or to the data protection regulator where you live, such as the Information Commissioner's Office (ICO) in the UK.
10. Security
We protect your data with appropriate technical and organisational measures, including storing passwords only in hashed form and limiting access to personal data. No system is perfectly secure, but we take reasonable steps to keep your information safe.
11. Children
The Platform is for people aged 18 and over. It is not intended for children, and we do not knowingly collect data from anyone under 18.
12. Cookies and browser storage
Umbwela itself sets no cookies. To keep you signed in, and to remember display preferences such as light or dark mode, the Platform uses your browser's own storage on your device. We do not use advertising, analytics, or cross-site tracking of any kind.
13. Changes to this policy
We may update this policy from time to time. The current version is always the one shown on the Platform, and we will take reasonable steps to tell you about any significant change.
14. Contact
For any question about this policy or your data, or to exercise your rights, contact us at hello@umbwela.com. This policy is governed by the laws of Queensland, Australia.
Last updated: 25 October 2026.