Privacy Policy

This Privacy Policy explains what data Munara Ltd ("Munara", "we", "us", "our") collects, why we collect it, how we use it, and what rights you have. It applies to the Munara.io website, cloud service, and agent software.

Munara Ltd is the data controller for personal data collected via the cloud service and website. We are based in England and Wales and process personal data in accordance with the UK GDPR and the Data Protection Act 2018.

1. Data We Collect and Why

1.1 Agent software (on your hardware)

The Munara agent runs entirely on hardware you control. All data about your monitored devices — sensor readings, device status, event logs, camera images — is stored locally on your hardware. We do not receive or store this data unless you explicitly use a cloud backup feature.

1.2 Account and registration data

When you create a Munara cloud account, we collect:

1.3 Agent telemetry (cloud-connected agents only)

When you connect an agent to the Munara cloud service, the agent sends periodic heartbeat messages containing:

• Agent UUID and software version;
• Site name and geographic coordinates (as configured by you);
• Aggregate endpoint counts (total, OK, warning, critical) — not individual device names or readings.

This data is used to display your agent status in the cloud dashboard and to detect connectivity issues. It does not include any data from the devices you are monitoring.

1.4 Cloud backup data

If you use the cloud backup feature, an encrypted copy of your agent's configuration (device list, alert rules, site settings) is uploaded and stored by Munara. This backup is encrypted before transmission using a key derived from your credentials. Munara stores the ciphertext but does not have access to the plaintext configuration.

1.5 Website and usage data

When you visit the Munara.io website we may collect standard server log data, including your IP address, browser type, referring URL, and pages visited. This is used solely for security monitoring and aggregate analytics. We do not use third-party tracking or advertising cookies.

2. How We Use Your Data

We use the data we collect to:

• Provide, operate, and maintain the Munara cloud service;
• Authenticate you and manage your account;
• Display your agent status and site information in the cloud console;
• Store and retrieve encrypted configuration backups at your request;
• Send transactional emails (account confirmation, password reset, service notices);
• Investigate security incidents and abuse;
• Comply with our legal obligations.

We do not use your data for advertising, profiling, or automated decision-making that produces legal or similarly significant effects.

3. Data Sharing and Third Parties

We do not sell your personal data. We share data only in the following limited circumstances:

• Cloud infrastructure providers: We host our cloud service on AWS (Amazon Web Services) in the EU (eu-west-1 region). Data stored there is subject to appropriate data processing agreements.
• Transactional email: We use a third-party email provider to send account and service emails. Only your email address and the content of service messages are shared for this purpose.
• Legal requirements: We may disclose data where required by law, court order, or to protect the rights and safety of Munara, our users, or others.

Any third-party processor we use is bound by a data processing agreement and may not use your data for their own purposes.

4. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data is retained for the duration of your account and deleted within 90 days of account closure;
• Agent heartbeat data is retained for 90 days of rolling history;
• Cloud backups are retained until you delete them or close your account;
• Server logs are retained for up to 90 days for security purposes.

5. Security

The following measures are in place to protect your data:

• All data in transit is encrypted using TLS 1.2 or higher;
• Cloud backups are encrypted client-side before transmission — we cannot read the contents;
• Passwords are stored using a one-way cryptographic hash;
• Agent-to-cloud communication uses signed tokens and mutual authentication;
• Access to production systems is restricted to authorised personnel.

No system is completely secure. If you discover a security vulnerability, please report it responsibly to security@munara.io.

6. Your Rights

Under the UK GDPR you have the following rights in relation to your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct inaccurate or incomplete data.
• Right to erasure: You can ask us to delete your personal data, subject to any legal retention obligations.
• Right to restriction: You can ask us to restrict processing of your data in certain circumstances.
• Right to data portability: You can ask us to provide your data in a structured, machine-readable format.
• Right to object: You can object to processing based on our legitimate interests.

To exercise any of these rights, contact us at privacy@munara.io. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7. Cookies

The Munara.io website uses only strictly necessary cookies — specifically, a session cookie used to maintain your logged-in state. We do not use tracking cookies, analytics cookies, or advertising cookies. No consent banner is required because we use only essential cookies.

The Munara agent's local web interface also uses a session cookie solely to maintain your authenticated session on your local network. This cookie never leaves your local device.

8. Children's Privacy

The Service is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

9. International Transfers

We store data within the European Economic Area (AWS eu-west-1, Ireland). Where any transfer outside the UK or EEA is necessary, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date above. For material changes, we will notify you by email or via a notice on the website before the change takes effect. We encourage you to review this policy periodically.