Privacy policy

1. Who is responsible for your data

Momen is the controller of the personal data described here. To ask a question or make a request about your data, use the contact form on the home page and mention that your message is about privacy.

2. What we collect

If you send a project enquiry (no account needed):

• Your name, email address, and message.
• Optionally your company, the service you are interested in, and your budget range.
• A keyed one-way hash of your network (IP) address, used only to limit spam and repeated submissions. We do not store the address itself, and the hash cannot be turned back into it.

If you are a client with a portal account:

• Account details: name, email address, company and logo, your role, and your notification preferences.
• Your password, which is stored only as a salted hash by our authentication provider, and the session cookies that keep you signed in.
• Work records you create or that we create for you: tickets, briefs and their revisions, comments, approvals and change requests, delivery and completion records, notifications, and an activity history of who did what and when.
• Files you upload to a ticket: documents, images, and videos. Videos can be MP4, MOV, or WebM up to 250 MB.
• Records of the emails we send you (for example, that a notification was delivered, or that an address bounced).

Technical data: our servers keep short-lived operational logs containing event names, error codes, and identifiers so we can keep the service running and investigate problems. They are not meant to contain the content of your messages or files. We do not use advertising or analytics trackers on this site.

We do not knowingly collect special-category data, and you should not upload it to the portal unless we have agreed that you will.

3. Why we use it

• To reply to your enquiry and decide whether and how we can work together.
• To provide the portal: sign you in, show you only your own company's work, record briefs and approvals, and let you and us exchange messages and files.
• To send service emails about your work, such as new comments, approval requests, and status changes, according to your notification preferences. We do not send marketing email through the portal.
• To keep the service secure and reliable: preventing abuse and spam, diagnosing faults, and keeping a record of who approved what.
• To meet legal and accounting obligations and to establish or defend a legal claim.

We do not sell your data, we do not use it for advertising, and we do not use it to train AI models.

4. Google Drive and Google user data

Video files that clients upload to a ticket are stored in a Google Drive account owned by Momen. This is done through Google’s Drive API, authorized once by Momen as the account owner. Clients do not sign in with Google and the portal does not read or store any client’s Google account data.

• The portal requests only the narrow “drive.file” permission. With it, the portal can create, read, and delete only the files it created itself. It cannot see any other file in the Drive account.
• Videos are shown to you only after the portal checks that you are signed in and entitled to that ticket. Drive links are never given to browsers, and the files are not shared publicly.
• We use this access only to store, play back, and remove the videos that clients upload, and for no other purpose.

The portal’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google user data for advertising, we do not sell it, and no person reads it except where necessary to provide support, investigate abuse, or comply with the law.

5. Who we share data with

We use the following service providers to run the site. They process data only on our instructions and under their own terms:

• Supabase — the database, sign-in, and private file storage for documents and images. Our project is hosted in Ireland (EU).
• Vercel — hosting for the website and portal application.
• Resend — sending service emails. Emails may load fonts from Google Fonts when you open them.
• Google (Drive) — storage for uploaded videos, as described above.

Some of these providers may process data outside your country, including outside the EU or UK, using the safeguards they publish, such as standard contractual clauses. We do not share your data with anyone else unless the law requires it or you ask us to.

Within the portal, each client sees only their own company’s records and files. Internal notes that we mark private are never shown to clients.

6. Cookies

We use only the essential cookies that keep you signed in to the portal and protect your session. There are no advertising or analytics cookies, so there is no cookie banner to accept.

7. How we protect it

• Traffic is encrypted in transit over HTTPS.
• Files are kept in private storage. Access is checked on every request against your account, your company, and the file's audience.
• Database rules enforce that one client can never read another client's records.
• Administrative access is limited to Momen, and operational logs are kept free of message and file content.

No system is perfectly secure. If a breach affects your data in a way that the law says we must report, we will tell you and the relevant authority.

8. How long we keep it

• Enquiries that do not lead to work are kept only as long as needed to follow up, and are then archived or deleted.
• Portal records are the official record of the work we do together, so they are kept for the length of our relationship and a reasonable period afterwards for accounting, dispute, and legal purposes.
• Operational logs are kept for a short period and then removed.
• When a file is removed or an account is closed, we delete the underlying data unless we must keep it by law or to defend a claim. Backups age out on their normal schedule.

9. Your choices and rights

You can ask us to give you a copy of your personal data, correct it, delete it, or restrict or object to how we use it. If we are relying on your consent, you can withdraw it at any time. Depending on where you live, you may also have the right to complain to your local data protection authority.

Signed-in clients can update their profile, password, and notification preferences in the portal settings. For anything else, use the contact form. We may need to verify your identity before acting on a request.

10. Children

The website and portal are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16.

11. Changes to this policy

If we change what we collect or who we share it with, we will update this page and its effective date. If a change materially affects signed-in clients, we will tell them through the portal or by email.