Who is responsible for your data?
This policy covers muffinpay.com, waitlist.muffinpay.com and every other MuffinPay website that links to it (together, the “sites”), and the emails we send you from them.
The sites are operated by MuffinPay (“MuffinPay”, “we”, “us”). We decide how your personal data is used, which makes us the data controller under the GDPR and UK GDPR, the controller under the UAE and Saudi data-protection laws, and the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023.
For anything about your data, including complaints, write to our privacy and grievance contact at info [at] muffinpay.com. We reply within 30 days, and sooner where the law requires it.
What data do we collect?
When you join the waitlist or contact us, you give us:
- Your name, email address and mobile or WhatsApp number, with its country code
- How you heard about MuffinPay, and the invite code you used, if any
- Messages you send us by email
We create, or receive automatically:
- Your sign-up number, place in line, personal invite code and the number of friends who joined with it
- The date and time you joined, the page you joined from and the campaign tags on the link you followed (for example utm_source=instagram)
- Technical data that any website receives — IP address, browser and device type — which our hosting and security providers process to deliver and protect the sites
- If you accept analytics or marketing cookies: how you use the sites. See the Cookie Policy.
We do not ask for payment details, identity documents or bank information on the waitlist, and we do not collect sensitive personal data.
Why do we use it, and on what legal basis?
| Purpose | Legal basis |
|---|---|
| Hold your place on the waitlist, give you an invite code and count your referrals | Steps you ask us to take before using a service (contract); your consent under the DPDP Act |
| Email or message you about your place, your rewards and the launch | Your consent, which you can withdraw at any time |
| Tell an inviter that a friend joined with their code (first name only) | Legitimate interest in running the referral programme you joined |
| Prevent duplicate, fake or abusive sign-ups and keep the sites secure | Legitimate interest; legal obligations |
| Measure and improve the sites, and our campaigns | Your consent, given through the cookie bar |
| Meet legal, tax and regulatory duties, and handle disputes | Legal obligation; legitimate interest |
We do not use your data for automated decisions that have legal or similarly significant effects on you.
Is my data sent to other countries?
Yes. Our providers store data in data centres in several countries, including the United States, the European Union and India. Where the law requires it, we rely on safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and contractual protections that meet UAE, Saudi Arabian and Indian rules. You can ask us for a copy of these safeguards.
How long do we keep it?
- Waitlist details: until 24 months after MuffinPay launches in your country, or until you ask us to delete them, whichever is sooner
- Emails you send us: up to 3 years, unless we need them longer for a dispute
- Analytics data: up to 14 months in Google Analytics, and as set out in the Cookie Policy for other tools
- Records we must keep by law: for the period the law sets
What are my rights?
Wherever you live, you can ask us to show you the data we hold about you, correct it, delete it, or stop sending you messages. Write to info [at] muffinpay.com from the email you joined with, or reply “remove” to any of our emails. Depending on where you live, you also have these rights:
| Where you live | Your rights | Where to complain |
|---|---|---|
| European Union and EEA | Access, correction, erasure, restriction, objection, portability, and withdrawal of consent at any time | Your national data-protection authority |
| United Kingdom | The same rights as above under the UK GDPR | The Information Commissioner’s Office (ico.org.uk) |
| United Arab Emirates | Access, correction, erasure, restriction, objection and portability under Federal Decree-Law No. 45 of 2021 | The UAE Data Office |
| Saudi Arabia | Access, correction, destruction and a copy of your data under the Personal Data Protection Law | The Saudi Data & AI Authority (SDAIA) |
| India | A summary of your data and how it is used, correction, completion, erasure, grievance redressal, and nominating someone to act for you, under the DPDP Act, 2023 | Our grievance contact first, then the Data Protection Board of India |
| United States, including California | To know, access, correct and delete your data, and to opt out of sale or sharing. We do not sell or share data, and we honour the Global Privacy Control signal | Your state attorney general or privacy agency |
| Canada | Access, correction and withdrawal of consent under PIPEDA | The Office of the Privacy Commissioner of Canada |
We will not treat you differently for using your rights. We may need to confirm your identity before acting on a request.
Can children use MuffinPay?
No. The sites and the waitlist are for people aged 18 or over. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it.
How do we protect it?
We use encrypted connections (HTTPS) on every page, restrict access to waitlist data to the people who need it, use providers with strong security certifications, and review our safeguards regularly. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.
Will this policy change?
We update this policy when our services or the law change. The date at the top shows the latest version. If a change is significant, we will tell you by email before it takes effect.
How do I contact MuffinPay about privacy?
Email info [at] muffinpay.com. We reply within 30 days.