Privacy policy

What this document covers

This is the company-wide policy. It covers this website, the mail you send us, and anything else that is not specific to one product.

Each product has its own notice, because each one collects different things.

TimeTracer privacy notice
CRM privacy notice (in development, holds no data)
SmartDoc privacy notice (in development, holds no data)
AutoSEO privacy notice (in development, holds no data)

Where a product notice says something different from this document, the product notice is the one that applies to that product.

Who we are

MuslimSpot is the data controller for everything described here. We build business software and we run the servers it runs on, in Lauterbourg, France.

Privacy questions, requests and complaints go to privacy@muslimspot.com and are read by a person who can act on them. We have no statutory Data Protection Officer, because our size and the nature of our processing do not require one.

This website collects almost nothing

This website is a set of static files. There is no application server, no session, no login and no database behind it. Everything below follows from that.

What the web server records

One line per request, as every web server does. That line holds your IP address, the time, the page you asked for, the response, and the user agent your browser sent. We use it for security and for finding broken links. It is not joined to anything else, not used to build a profile and not shared.

Cookies: none

This website sets no cookies. Not a necessary cookie, not a preference cookie, not an analytics cookie. There is nothing to consent to, so there is no consent banner. Your browser may remember things about the site, which is your browser rather than us.

Third-party requests: none

Every file this page loads comes from this domain, including the stylesheet, the scripts, the fonts and the images. There is no font service, no script from a content delivery network, no embedded video and no social media widget.

Analytics: none

No analytics on this website.
No advertising network, advertising pixel or conversion tracking.
No third-party fonts. Both typefaces are served from our own server.
No session recording, heatmaps or chat widget.
No cookies, which is why there is no cookie banner.
No selling or sharing of personal data.

We do look at the web server’s own log to see whether something is broken. That is the whole of our measurement, and it is why we cannot tell you how many people read any of this.

When you write to us

We have whatever you sent and the address you sent it from, in a mailbox on our own mail server. We keep correspondence so that a conversation can be continued. The basis is our legitimate interest in answering our own mail.

Correspondence is used to answer you and for nothing else. Asking us to delete a thread is enough to have it deleted.

Company mail is held on our own server. Application mail that our products send, such as a password reset or an optional digest, goes through SendGrid, which is in the table below.

Where data is stored

On one machine that we own and administer, in a data centre in Lauterbourg, France, inside the European Union. The website, the mail server and the product databases are all on it. Connections to it are encrypted in transit.

A nightly backup goes to a private object storage bucket, so that a hardware failure is recoverable. That copy is the one place data leaves our machine.

Everyone we rely on

Four companies, and these are all of them. Adding another means changing this table first.

Every third party that can see any customer data, what they do, what they see, and where.
Who	What they do for us	What they can see	Where
Contabo GmbH	Owns the data centre and the physical machine our server runs on. They have physical custody of the disks. They are not given access to the application or the database.	Everything on the machine, in the sense that whoever holds the hardware could in principle reach it. Nothing is handed to them.	Lauterbourg, France (European Union)
Cloudflare, Inc. (R2 object storage)	Holds the nightly off-box backup, so that a failure of our machine is recoverable. The bucket is private and is not readable without our keys.	A copy of the database, uploaded files and screenshots, as they exist at the time of the nightly run.	Cloudflare's own network. The bucket is created with Cloudflare's automatic region selection, so we cannot state that every copy stays inside the EEA. Outside the EEA.
Twilio SendGrid (Twilio Inc.)	Sends application e-mail: the optional TimeTracer digest, and account mail such as a password reset. Mail you send to a muslimspot.com address does not go through them. That runs on our own mail server.	The recipient's e-mail address and the contents of the message sent to them.	United States and other locations in Twilio's network. Outside the EEA.
GitHub, Inc. (a Microsoft company)	Hosts the desktop application release files. When the desktop app checks for or downloads an update, it fetches the file from GitHub.	The IP address and user agent of the computer downloading an update, as any web server would. No account data and no screenshots.	United States and other locations in GitHub's network. Outside the EEA.

Transfers outside the European Economic Area

Three of the four are United States companies and may process data outside the EEA. Where they do, we rely on the European Commission’s Standard Contractual Clauses as incorporated in each provider’s data processing terms.

How long we keep things

Web server logs: kept on the server while they are useful for security review, then rotated away. Not copied into the off-box backup.
Correspondence: kept while it might reasonably be continued, and deleted on request.
Product data: set out in each product’s own notice.
Backups: fourteen daily copies and eight weekly copies, with anything a nightly sync removes parked for a further fourteen days against our own mistakes. So a deletion is immediate in the live system and the last backup copy of it ages out in about ten weeks.

You have the right to see what we hold about you, to have it corrected, to have it deleted, to restrict what we do with it, to get a copy in a usable format, to object to processing based on a legitimate interest, and to withdraw any consent you gave. All of it is free and none of it requires a reason.

Write to privacy@muslimspot.com. We will acknowledge it and answer within the month the Regulation allows.

You can complain to a supervisory authority instead of or as well as coming to us. Our processing happens in France, so that is the Commission Nationale de l’Informatique et des Libertés (CNIL). You may also use the authority in the country where you live or work.

We make no automated decisions about you with a legal or significant effect, and we do not profile you.

Security

The server denies inbound traffic by default and opens only the ports it needs. The administrative interfaces and the databases are not reachable from the internet, and that was verified by trying from outside rather than by reading a configuration file. Operating system security updates are applied automatically. Repeated failed logins are blocked. Passwords, where a product has them, are stored as hashes.

We are a small team running one machine. Very few people and systems can reach anything, and there is no separate security function.

Report a vulnerability to security@muslimspot.com. Reporting one in good faith is not a breach of our terms.

If there were a breach, we would notify the supervisory authority within seventy-two hours as required, and tell the people affected directly and in plain terms, without waiting for the full picture.

Children

Our products are business tools for adults and are not directed at children. We do not knowingly collect data about anyone under sixteen. If you think we have, tell us and we will delete it.

Changes

A change that matters, such as a new processor, a new category of data or a change in retention, gets this page updated, the dates at the top changed, and account holders told by email before it takes effect. Corrections and clarifications get the reviewed date updated.

We do not keep a public version history of this page yet. If you need to know what it said on a given date, ask and we will tell you from the repository, where every change to it is recorded with its date.