This Privacy Policy explains how [Company legal entity] collects, uses, discloses, and protects personal information when you visit our website, create an account, or use the Muster service.

1. Who we are

Muster is operated by [Company legal entity], a company registered in [Jurisdiction] with its registered office at [Registered address].

For personal information processed through our website and the account areas of the service, we act as the data controller. Where you connect a third-party provider and we process content on your instructions, we act as a processor and the terms of our Data Processing Addendum apply.

2. Information we collect

We collect information in three ways: information you give us, information we collect automatically when you use the service, and information we receive from providers you choose to connect.

Account information: your name, work email address, authentication credentials, organisation name, role, and billing contact details.
Usage data: pages viewed, features used, referring pages, device and browser type, approximate location derived from IP address, and event timestamps.
Connected provider data: repository, project, deployment, and issue metadata that you authorise us to read from the providers you connect. We request read-only scopes wherever a provider offers them.
Support and communications: messages you send us, and records of correspondence with our support team.
Cookies and similar technologies: as described in our Cookie Policy.

We do not intentionally collect special categories of personal data, and we ask that you do not submit them through the service.

3. How we use information

We use personal information to create and administer your account, authenticate users, generate project health scores and reports, process payments and manage subscriptions, respond to support requests, send service, security, and billing notices, detect and prevent abuse, and analyse aggregate usage so we can improve performance and reliability.

We send marketing communications only where you have opted in or where otherwise permitted by applicable law. Every marketing email includes an unsubscribe link, and opting out does not affect service or billing notices.

4. Legal bases for processing

Where [applicable data protection law] applies, we rely on the following legal bases:

Performance of a contract: to provide the service you have signed up for and to administer billing.
Legitimate interests: to secure the service, prevent fraud and abuse, and improve our product, balanced against your rights and expectations.
Consent: for optional cookies and for marketing communications, which you may withdraw at any time.
Legal obligation: to meet accounting, tax, and lawful disclosure requirements.

5. Sharing and disclosure

We do not sell personal information and we do not share it for cross-context behavioural advertising.

We disclose personal information only to service providers that host our infrastructure, process payments, deliver email, and provide support tooling on our behalf, each bound by written confidentiality and data protection terms; to professional advisers such as auditors and lawyers; to authorities where we are legally required to do so; and to an acquirer in connection with a merger, acquisition, or sale of assets, subject to this policy.

A current list of subprocessors is available at [subprocessor list URL]. We give at least [30] days notice before adding a new subprocessor so you may object.

6. International transfers

We may transfer personal information to, and store it in, countries other than the one in which you reside. Where we do, we rely on an adequacy decision, or on standard contractual clauses together with supplementary technical and organisational measures appropriate to the transfer.

You may request a copy of the transfer mechanism we rely on by contacting us at [privacy@example.com].

7. Data retention

We retain personal information for as long as your account is active, and afterwards only for as long as needed for the purposes described in this policy, to resolve disputes, and to comply with our legal obligations.

Account records are deleted or irreversibly anonymised within [30] days of account closure, and backups containing them are purged on a rolling [35] day cycle. Aggregate statistics that cannot be linked to an individual may be retained indefinitely.

8. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, least-privilege access controls, audit logging, environment separation, and periodic review of our security practices and those of our subprocessors.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a personal data breach affecting you, we will notify you and the relevant supervisory authority as required by applicable law.

9. Your rights

Subject to applicable law, you have the right to:

access the personal information we hold about you, and request a copy in a portable format;
have inaccurate or incomplete information corrected;
request erasure of your personal information;
restrict or object to certain processing, including processing based on legitimate interests;
withdraw consent at any time, without affecting processing carried out before withdrawal; and
lodge a complaint with your supervisory authority.

To exercise any of these rights, contact us at [privacy@example.com]. We respond within the period required by applicable law and may ask you to verify your identity before we act.

If you are a resident of [state or region], you also have the right to know the categories of personal information we collect and the purposes for which we use them, and to opt out of any sale or sharing of personal information. As stated above, we do not sell or share personal information.

10. Children’s privacy

The service is intended for business use and is not directed to children under [16]. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at [privacy@example.com] and we will delete it.

11. Changes to this policy

We may update this policy to reflect changes to our practices, our service, or applicable law. When we do, we post the revised version here with a new last updated date.

Where the changes are material, we notify you by email or through an in-product notice at least [30] days before they take effect.

12. Contact us

For questions about this policy or about how we handle personal information, contact [privacy@example.com], or write to [Company legal entity], [Registered address].

If you are located in the [EEA or UK], our representative for the purposes of [applicable data protection law] is [representative name and contact details].

Placeholder content

This page ships with the template as sample copy. It is written to mirror the structure of a standard privacy policy, but it is not legal advice and creates no binding obligations. Replace every section, and each bracketed placeholder, with text drafted or reviewed by your own legal counsel before you publish.