Privacy Policy
Not yet reviewed by a solicitor. These terms apply as written, but are pending professional legal review and will be revisited on incorporation.
This policy explains what personal data the Umbwela platform collects, why, and what rights you have. Umbwela is built to collect as little about you as possible. We do not sell your data, we do not use it for advertising, and most of what we keep, we keep only because you have signed agreements that we must be able to evidence.
1. Who is responsible for your data
The Umbwela platform (the "Platform") is operated by David Manning, trading as Umbwela, who is the data controller for the personal data described in this policy. You can contact us about privacy at hello@umbwela.com.
2. Our approach
We designed Umbwela around data minimisation. Publicly, you appear to other users only as a nickname and an avatar — not your real name. We do not ask for your phone number, your postal address, your date of birth, or any payment card details. We collect the limited information below only to run the Platform and to keep proper records of the agreements you enter into.
3. What we collect
3.1 Account information: your email address (to create your account, sign you in, and send you essential messages such as document-signing links), your password (which we store only in a securely hashed form), and the nickname and avatar you choose as your public identity.
3.2 Identity for agreements: your first name, last name, and legal name. These are held privately and used for the legal agreements you accept on the Platform — your legal name is recorded as part of the signature evidence for each document you sign, which is what makes that signature meaningful.
3.3 Optional information: a general location (such as country or city) if you choose to provide it. We do not collect a street address.
3.4 Your activity on the Platform: the projects you take part in, the contributions you make, and the tokens and ledger records that result from them.
3.5 Signature evidence: when you accept an agreement (for example the Platform Terms, or a project's Non-Disclosure, Contributor, or Project Governance Agreement), we record evidence that you accepted it — your identity (legal name, nickname, and account identifier), the document and its version, the date and time, the consent wording shown to you, your IP address, and your browser or device information. This is standard for electronic signatures and is what allows the agreement to be relied on later.
3.6 Technical information: the minimum needed to keep you signed in and to keep the Platform secure, such as a session cookie and basic security logs.
4. What we do not do
We do not collect your phone number, postal address, date of birth, or payment card details. We do not track you across other websites, we do not use your data for advertising, and we never sell your personal data to anyone.
5. Why we use your data, and our lawful basis
5.1 To provide the Platform and your account — because it is necessary to perform our contract with you.
5.2 To keep records of the agreements you accept, including the signature evidence — because we have a legal obligation to keep proper records and a legitimate interest in being able to evidence and enforce those agreements.
5.3 To keep the Platform secure and prevent misuse or fraud — because we have a legitimate interest in protecting the Platform and its users.
5.4 To send you essential service messages — because it is necessary to perform our contract with you.
6. Who can see your data
6.1 Other members of your project can see your nickname, avatar, your contributions, your token stake as recorded in the ledger, and the fact that you have accepted the project's agreements. This is how a project works. Your email and your private identity details are not shown to other members in this way.
6.2 Service providers who help us run the Platform — such as our cloud hosting and email delivery providers — process data on our behalf, under confidentiality, and only as needed to provide their service to us.
6.3 We may disclose data where we are required to by law, or to establish, exercise, or defend legal claims.
7. Where your data is held
We use reputable cloud infrastructure to host the Platform. Some of our providers may process data outside the United Kingdom. Where they do, we rely on appropriate safeguards recognised under UK data protection law. [Confirm hosting regions and transfer safeguards with your provider before launch.]
8. How long we keep it
We keep your account information for as long as you have an account. Because the Platform is built around signed agreements, we keep the agreements you accept and their signature evidence for as long as we may need to evidence or enforce them and for as long as the law requires — typically for the life of the agreement plus the period in which a related claim could be brought. Ledger records of contributions and earned tokens are permanent by design, as set out in the project agreements. When information is no longer needed for these purposes, we delete or anonymise it.
9. Your rights
Under UK data protection law you have the right to: access the personal data we hold about you; ask us to correct it if it is wrong; ask us to delete it; ask us to restrict or object to how we use it; and ask for a copy in a portable form. Where we rely on your consent, you can withdraw it at any time.
We will always respond to these requests, but some limits apply: we may need to keep the agreements you have signed and their signature evidence even if you ask us to delete your data, because we are legally required to keep those records and need them to evidence the agreements; and the ledger record of tokens you have earned is permanent under the project agreements. Where a limit applies, we will explain it to you.
To exercise any right, contact us at hello@umbwela.com. If you are not satisfied, you can complain to the Information Commissioner's Office (ICO), the UK regulator, at ico.org.uk.
10. Security
We protect your data with appropriate technical and organisational measures, including storing passwords only in hashed form and limiting access to personal data. No system is perfectly secure, but we take reasonable steps to keep your information safe.
11. Children
The Platform is for people aged 18 and over. It is not intended for children, and we do not knowingly collect data from anyone under 18.
12. Cookies
We use only the cookies needed to keep you signed in and to keep the Platform working and secure. We do not use advertising or cross-site tracking cookies.
13. Changes to this policy
We may update this policy from time to time. The current version is always the one shown on the Platform, and we will take reasonable steps to tell you about any significant change.
14. Contact
For any question about this policy or your data, or to exercise your rights, contact us at hello@umbwela.com. This policy is governed by the laws of England and Wales.
Last updated: 11 August 2026.