Privacy Policy

We collect only what we need to run the service:

• Account & organization data: your name, email address, password (stored only as a secure hash), workspace name, and preferences such as language.
• Support content: tickets, tasks, messages, contacts, and any files you or your end-customers submit through email, live chat, or the app.
• Technical data: log data such as IP address, browser type, and timestamps, collected automatically to keep the service secure and reliable.
• Billing data: if you buy a paid plan, we store which plan you are on, whether the subscription is active, when the current period ends, and the identifiers Stripe gives us for your customer and subscription records. We never receive or store your card details — see below.
• Website statistics: when you read our public website we record the page, the language, the host name of the site that referred you, whether you are on a phone or a computer, and any campaign tag that was in the link you followed. In place of your IP address we store a one-way hash of it. The address itself is never written down — it exists for as long as it takes to compute the hash, and the daily secret that made the hash is destroyed after two days, after which nobody can trace it back. There is no analytics inside the Muhveli app itself.

We use your data to:

• Provide, operate, and maintain the Muhveli service.
• Send and receive email on your behalf and route each reply into the correct ticket thread.
• Keep the service secure, prevent abuse, and troubleshoot problems.
• Communicate with you about your account and service-related matters.
• Count how many people read which pages of our public website, so we know what is worth writing. These figures are aggregate — we look at pages, not at people.

We process personal data under the EU General Data Protection Regulation (GDPR). Our legal bases are the performance of our contract with you, our legitimate interest in operating and securing the service, and, where required, your consent. For the support data you process through Muhveli, you are the controller and we act as your processor.

Counting visits to our public website rests on our legitimate interest under Article 6(1)(f) in knowing what people read. That interest is a narrow one, so the processing is kept narrow to match: first-party only, aggregate, never shared, and unlinkable from one day to the next. The single part that goes further — the cookie that lets us recognise a returning reader — runs on your consent under Article 6(1)(a) and nothing else. Refuse it and the site behaves identically; your visit is simply counted anonymously.

To run Muhveli we rely on a small number of carefully chosen service providers. Each receives only the data needed for its function. We use no analytics, advertising, or tracking provider of any kind, and our public website loads no third-party code at all:

• Hetzner Online GmbH — hosting and databases. All application data is stored on servers located in a data center in Finland.
• Postmark (ActiveCampaign, LLC) — sending and receiving transactional email. Email content and delivery metadata pass through Postmark.
• Stripe (Stripe Payments Europe, Ltd.) — payment processing and subscription billing for our paid plans. Stripe is the payment processor and acts as controller for the payment data it collects. Card details are entered on Stripe's own hosted payment pages and never pass through Muhveli: we do not see, receive, or store card numbers, expiry dates, or security codes at any point. What we hold is the plan you bought and the identifiers pointing at your record in Stripe.
• Cloudflare — the anti-bot check on our sign-up form, and nowhere else. It exists to stop bulk fraudulent sign-ups and sets no tracking cookie.

Muhveli is hosted on servers located in Finland (Hetzner). Some sub-processors, such as our email provider, may process limited data outside the EU/EEA under appropriate safeguards such as the EU Standard Contractual Clauses.

We keep your data for as long as your account is active. Support content is retained according to your own needs and settings. Backups are kept for a limited period and then automatically overwritten.

Website visit records are deleted after 14 months — long enough to compare one year against the last, and no longer. The daily secret behind the visitor hashes is deleted after two days. Both are enforced by a job that runs every night, not by a promise to remember.

Under the GDPR you have the right to access, correct, and erase your personal data, to restrict or object to its processing, and to receive a copy in a portable format. You also have the right to lodge a complaint with your supervisory authority — in Finland, the Data Protection Ombudsman (tietosuojavaltuutettu).

You can close your account and request deletion of your data at any time by contacting us or using the account controls in the app.

Please note: once your data has been deleted, it cannot be recovered. Deletion is permanent and irreversible — we are unable to restore tickets, tasks, messages, or any other content after deletion has taken place.

The Muhveli app uses only the strictly necessary cookies required to keep you signed in and the service secure. We use no advertising or third-party tracking cookies anywhere, and there is no analytics inside the product itself.

On our public website we measure how many people read which pages. We built that measurement ourselves and it runs on the same server in Finland as the rest of Muhveli — no Google Analytics, no third-party script, no data leaving the EU. By default it stores nothing on your device and cannot recognise you from one day to the next. Telling a returning reader from a new one does require a first-party cookie, and that single cookie is the only thing our cookie banner asks you about.

Our Cookie Policy lists every cookie we set, how long each lasts, and exactly how the cookieless counting works.

We may update this Privacy Policy from time to time. Material changes will be communicated through the service. The date at the top shows when it was last revised.