GDPR and data processing

MuteHint is committed to compliance with the General Data Protection Regulation (GDPR), the UK GDPR, and the Swiss Federal Act on Data Protection. This page covers your rights as an EU/EEA/UK resident and our obligations as the data controller.

Call audio is not processed by MuteHint. Audio captured during your conversations, and the live transcript of what was said, go directly from your device to the third-party LLM provider you have chosen, using your own API key. MuteHint has no access to that data and is not a processor of it. Your relationship with that provider is governed by your own contract with them.

MuteHint does process and store on its servers:

• Account identifiers: your name and email address, and your Google sign-in identifier if you use Google.
• Subscription and license data: your plan and its status.
• Billing metadata: purchase and renewal records from Lemon Squeezy (no payment-card data).
• Devices: the devices you sign in on.
• Session records: for each session, its time, length and profile, the hints shown to you (the AI-generated suggestions) and the context text you typed or pasted in. The hints and the context text are stored for plans that include session history; on the Free plan they are not stored.
• Technical logs: IP addresses, user-agent strings and request metadata.
• Website analytics: pseudonymous product-analytics events, only if you accept analytics. See Cookies and local storage.

Your API keys stay on your own computer and are not sent to MuteHint.

MuteHint is run by its founders and is not yet a registered company. Every purchase is sold and handled by Lemon Squeezy, the Merchant of Record. MuteHint is the data controller for personal data collected through our website and services. Our data protection contact is privacy@mutehint.com.

• Contract: Processing your account data to provide the service you subscribed to.
• Legitimate interests: Product analytics, security monitoring, fraud prevention, and direct marketing to existing customers, balanced against your rights.
• Legal obligation: Retaining billing and tax records as required by applicable law (typically 7 years).
• Consent: Non-essential cookies and marketing emails to non-customers. You can withdraw consent at any time.

• Right of access: You can request a copy of all personal data we hold about you at any time.
• Right to rectification: You can ask us to correct inaccurate or incomplete personal data we hold about you.
• Right to erasure: You can ask us to delete your personal data (“right to be forgotten”) subject to certain conditions. This includes your session records: the hints shown to you and the context text you typed.
• Right to portability: You can request your data in a structured, machine-readable format to transfer to another service.
• Right to object: You can object to our processing of your personal data in certain circumstances, including for marketing.
• Right to restrict processing: You can ask us to pause the processing of your personal data while a complaint is being resolved.

To exercise any of your GDPR rights, email us at privacy@mutehint.com with your request. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

You also have the right to lodge a complaint with your local data protection authority if you believe we have not handled your data appropriately.

MuteHint engages the following sub-processors, each bound by data-protection obligations no less protective than our DPA. We will notify you at least 30 days before adding or replacing a sub-processor.

• Vercel Inc. (USA): website and API hosting.
• Supabase, Inc. (USA / EU regions): database and authentication.
• Lemon Squeezy (USA): payment processing and Merchant of Record.
• Resend (USA): transactional email.
• Upstash, Inc. (USA): Redis caching and rate-limiting.
• PostHog Inc. (USA / EU region): product analytics.
• Google LLC (USA): Google OAuth identity.

MuteHint is based in the United States. Where personal data of EU, UK, or Swiss users is transferred outside the EEA/UK/Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (Module 2: Controller-to-Processor) and, for UK data, the UK International Data Transfer Addendum. For Swiss data, equivalent FADP safeguards apply.

• Account data: active period plus up to 24 months after closure.
• Session records (session details, hints shown and context text): kept until you ask us to delete them or your account data is deleted. No shorter fixed period is set.
• Subscription and billing records: minimum 7 years (tax and accounting law).
• Product analytics: up to 24 months identifiable; indefinitely in aggregate.
• Support communications: up to 36 months.
• Local device data: until you delete it or uninstall the app.

We will notify affected users and relevant supervisory authorities without undue delay (and within 72 hours where required) after becoming aware of a personal data breach. The notification will include the nature of the breach, categories and approximate number of data subjects and records affected, likely consequences, and mitigation measures.

MuteHint is sold to individuals, and MuteHint acts as the data controller for the account and session data described on this page. If your organisation needs a data processing agreement before its staff use MuteHint, email privacy@mutehint.com.

For GDPR enquiries, DPA requests, and breach reports: