Privacy Policy

1. Who we are

Muloo Reporting is a client reporting platform operated by Muloo (Pty) Ltd ("Muloo", "we", "us", "our"), a company registered in South Africa.

• Registered company: Muloo (Pty) Ltd
• Company registration number: 2020/546441/07
• VAT number: 4500305655
• Income tax number: 9572406198
• Registered address: 54 Old Sir Lowry's Pass Road, Cape Town, South Africa
• Data protection contact: jarrud@muloo.co

For the personal information we process to operate Muloo Reporting, Muloo (Pty) Ltd is the responsible party under POPIA. Where our clients connect their own accounts and end-customer data for reporting, Muloo acts as an operator / processor on that client's instructions, and the client is the responsible party / controller.

2. Scope of this policy

This policy explains how we handle information across (a) this website, and (b) the Muloo Reporting application, including the data we access from third-party platforms you connect — such as HubSpot, Google Analytics, Google Ads and LinkedIn — to produce reporting. It is written to meet the requirements of the Protection of Personal Information Act, 2013 (POPIA) and, where applicable, the EU/UK General Data Protection Regulation (GDPR).

3. Data we collect

3.1 Account & contact data

When you register or contact us, we collect your name, work email, organisation, role, and authentication credentials (stored as hashes, never in plain text).

3.2 Usage & device data

We collect standard log data — IP address, browser type, pages viewed and timestamps — to secure and operate the service.

3.3 Connection credentials

When you connect a platform, we store the access and refresh tokens issued by that platform's OAuth flow. Tokens are encrypted at rest and used only to retrieve the data required for your reporting.

3.4 Cookies

We use strictly-necessary cookies for authentication and session management. We do not use third-party advertising cookies on this platform.

4. Connected platform data

Muloo Reporting retrieves data from the platforms you authorise, using each platform's official API and approved, read-only, reporting-scoped permissions. We access only what is needed to build reporting. Depending on which platforms you connect, this may include:

Where this data includes personal information (for example, CRM contact records), we process it on our client's behalf and on their instructions, solely to provide the reporting service. We do not use connected platform data to build advertising profiles, and we do not sell it.

5. How we use data

• To provide, operate and maintain the Muloo Reporting platform.
• To retrieve, unify and model data from the platforms you connect.
• To generate dashboards, attribution and reports for you and your clients.
• To authenticate users and secure the service.
• To respond to support requests and communicate service information.
• To comply with legal obligations.

6. Lawful bases

Under GDPR we rely on: contract (to provide the service you sign up for), legitimate interests (to secure and improve the platform), legal obligation (compliance), and consent where required. Under POPIA we process personal information on the corresponding justifications in section 11, including performance of a contract, legitimate interest, and consent.

7. Sharing & sub-processors

We do not sell personal information. We share it only with service providers who help us run the platform, under contract and appropriate safeguards:

We may also disclose data where required by law, to protect our rights, or in connection with a business transfer, subject to this policy.

8. International transfers

Our sub-processors may process data outside South Africa or the EEA. Where they do, we rely on lawful transfer mechanisms — such as adequacy decisions or Standard Contractual Clauses — and POPIA section 72 conditions for trans-border information flows.

9. Retention

We keep personal information only as long as needed for the purposes above or as required by law. Where you remove Muloo Reporting's access to a connected platform (LinkedIn, HubSpot or Google), we stop retrieving data from it, delete the stored tokens, and delete or anonymise the reporting data sourced from it within three (3) months. You can also permanently delete your Muloo Reporting account at any time from within the platform — account deletion takes effect immediately and removes your account and associated data.

10. Security

We apply appropriate technical and organisational measures, including encryption of credentials at rest, encrypted transport (TLS), least-privilege access, and access controls scoped per client workspace. No system is perfectly secure, but we work to protect your data and to notify affected parties and the Information Regulator of any breach as required by POPIA.

11. Your rights

Subject to applicable law, you may request to access, correct, delete, restrict or object to our processing of your personal information, and to data portability. You may also permanently delete your account at any time from within the Muloo Reporting platform, which takes effect immediately. Under POPIA you may also lodge a complaint with the Information Regulator (South Africa). Under GDPR you may lodge a complaint with your local supervisory authority. To exercise any right, contact us at jarrud@muloo.co.

Where Muloo acts as operator/processor for a client, requests from that client's end-customers should be directed to the client (the responsible party), and we will assist them in responding.

12. Children's data

Muloo Reporting is a business tool and is not directed at children. We do not knowingly collect personal information from children under 18.

13. Changes to this policy

We may update this policy from time to time. Material changes will be posted here with a revised "Last updated" date.

14. Contact us

For any privacy question or request, contact:

• Muloo (Pty) Ltd — Data protection contact
• Email: jarrud@muloo.co
• Address: 54 Old Sir Lowry's Pass Road, Cape Town, South Africa
• Website: www.wearemuloo.com