MUUD Privacy Policy

This Privacy Policy explains how MUUD collects, uses, shares and protects personal data when schools, companies and people use the MUUD website (https://muud.app), the MUUD applications for phone, tablet and web, including school.muud.app and business.muud.app, and related services (the "Services"). Capitalized terms not defined here have the meaning given in the MUUD Terms of Service.

Summary

• Your school or employer decides. When you use MUUD through a school or company, that organization is the controller of your data and MUUD processes it on its behalf and on its instructions.
• Free text stays private. What a student writes in free text is never shown to school staff. Staff see indicators and alerts, so that a trained adult can check in with the student.
• No selling, no ads, no AI training. We do not sell personal data, show advertising, or use your data to train AI models.
• Hosted in the United States. All data processed through the Services is stored in the United States. Our team in Chile accesses it remotely.
• Your rights. You can ask to access, correct, delete or export your data, among other rights, by writing to soporte@muud.app or through our European representative, DataRep.

1. Who We Are

MUUD SpA ("MUUD", "we", "us"), Chilean tax ID (RUT) 77.634.166-5, registered office at Av. Presidente Kennedy 5600, Of. 507, Vitacura, Santiago, Chile, provides the Services. For customers whose Order is signed with MUUD Inc., a Delaware corporation wholly owned by MUUD SpA, MUUD Inc. is the contracting entity; both apply this Policy.

Contact for privacy matters: soporte@muud.app, or the data request form linked as "Delete account" in the footer of https://muud.app.

Data protection officer. MUUD has not appointed a data protection officer, because none of the conditions of GDPR Art. 37(1) or LOPDGDD Art. 34 applies to its processing. Privacy matters are handled internally by MUUD's Privacy Officer through the contact above. For the same reasons of role and scope, MUUD has not appointed an encarregado under the Brazilian LGPD (Section 13.3).

Representative in the EU/EEA, the United Kingdom and Switzerland. Under GDPR Art. 27, UK GDPR Art. 27 and Art. 14 of the Swiss FADP, MUUD has appointed Data Protection Representative Limited, trading as DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland. See Section 12.1 for how to contact DataRep in your country.

2. Scope and Our Role

MUUD acts in two different roles, and this Policy explains both.

Where MUUD is a processor, the school or employer's own privacy notice also applies, and requests about your data will be handled together with that organization (Section 12).

This Policy does not cover protected health information processed for healthcare providers in the United States under a HIPAA Business Associate Agreement. That information is governed by the agreement with the provider and by the provider's Notice of Privacy Practices.

3. Personal Data We Process

Technical data from all App users: device type and model, operating system, app version, language, IP address, timestamps, error reports and security logs. We use it to operate, secure and support the Services.

Camera and microphone. The App asks for access to the camera only so that students can scan the QR code that signs them in. The camera image is used on the device to read the code and is not stored or sent to MUUD. The App asks for access to the microphone only if a user chooses to dictate instead of typing, in the emotions journal or when reflecting with Muudy, the check-in assistant. The audio is converted to text by the speech recognition service of the device's operating system or, in the web version, of the browser (for example, Apple or Google). MUUD receives only the resulting text, which is treated like any other free-text entry, and does not receive, store or analyze the audio. Both permissions are optional, are requested only when the feature is used, and can be withdrawn at any time in the device settings.

What we do not collect. The App does not access precise geolocation, contacts or photos, does not use advertising identifiers, and does not offer login through social networks. MUUD does not use biometric data, such as facial images, voice or physiological signals, to infer emotions: emotional information in MUUD comes only from what users choose to report.

4. Sensitive Data and What School Staff Can See

Free text and alerts are treated as sensitive. Free-text entries, messages exchanged with the check-in assistant and early-alert records may reveal information about a person's emotional state. MUUD treats them as sensitive personal data under every applicable law (special category data under GDPR Art. 9, "dados pessoais sensíveis" under the LGPD, "datos sensibles" under Chilean and Mexican law) and applies heightened confidentiality, access restrictions and security to them. For schools and employers, the legal basis for this processing is established by the organization as controller. When a student registers with a course code, the App also asks for their express consent to this processing before the first check-in; when the school creates accounts in bulk, the school verifies the required consents before sending us the roster.

What each person can see.

• The student, employee or Individual User sees their own check-ins, conversations and free-text entries.
• Designated staff of the school or employer see indicators and alerts derived from check-ins, and aggregated reports for groups. They never see the content of free-text entries or of conversations with the assistant.
• MUUD personnel access personal data only when necessary to operate, secure and support the Services, or to answer a request from the customer, and access is limited to a small number of authorized people.

5. AI-Assisted Features

MUUD's conversational check-in assistant, Muudy, the summaries of check-in history and the generation of indicators and alerts use large language models from third-party providers acting as MUUD's subprocessors (Section 8): Anthropic, PBC as the primary provider, and OpenAI, L.L.C. only as a backup for the school and workplace Services if Anthropic's service is unavailable.

• Users are told in the App that they are talking to an automated assistant, not a person. Replies are generated in real time without prior human review.
• We send the providers only what is needed to generate each reply, summary or indicator. The providers process it on MUUD's behalf, under contractual terms that prohibit them from using it to train their models, and retain it only for the limited periods set in those terms for security and abuse monitoring.
• MUUD does not use personal data to train AI models.
• Indicators and alerts are signals for trained adults. No decision with legal or similarly significant effects for a person is taken solely by automated means: a person at the school or employer decides whether and how to follow up. You may ask for human review of any output that concerns you and express your point of view (Section 12).

6. Why We Use Personal Data and on What Legal Basis

When MUUD acts for a school or employer, we use personal data only to provide, secure and support the Services the organization contracted, following its instructions under the Data Processing Addendum: creating accounts, running check-ins and the check-in assistant, generating indicators, alerts and reports for designated staff, sending password-recovery and alert-notice emails, providing support, and producing de-identified aggregated statistics to evaluate and improve the Services. The organization determines the legal basis, which is typically the performance of its educational or public-interest mission, its legitimate interests, a legal duty of care, or consent, including the consent of parents where the law requires it.

Alert-notice emails contain no student data: they only tell a designated staff member that their group has alerts, and the details are viewed inside the App.

When MUUD acts as controller, we rely on these purposes and legal bases:

We do not use personal data for advertising, sell it, or combine it with data from third parties to build profiles. If we ever want to use personal data for a new purpose incompatible with those above, we will inform you and, where required, ask for your consent first.

Mexico: primary and secondary purposes. For data subjects in Mexico, the purposes in the table are primary purposes necessary for the relationship with MUUD, except B2B commercial outreach and the teacher newsletter, which are secondary purposes. You can refuse the secondary purposes at any time by writing to soporte@muud.app or by using the unsubscribe link, without affecting the primary purposes.

7. Children and Adolescents

MUUD is used by students, including children, only through schools that have contracted the Services. Children can only get an account through their school, either created by the school in bulk or by registering with a course code the school provides, and we do not knowingly collect personal data from a child outside a school deployment.

• Notices and consent. The school, as controller, gives parents and guardians the notices the law requires and obtains any required consent or authorization. When a student registers with a course code, the App asks for the student's express consent to the processing of sensitive data; this does not replace parental consent where the law requires it for the student's age. When the school creates accounts in bulk, it verifies the required consents before sending the roster. MUUD provides the school with the information and template notices it needs. The main age thresholds are: under 13 in the United States (COPPA) and the United Kingdom; under 14 in Spain and in Chile, where Law No. 21.719 also requires parental consent for sensitive data of adolescents under 16; under 16 in EU member states that keep the GDPR default, or the lower age they set; under 12 in Brazil, with specific protections up to 18; and under 18 in Mexico.
• United States (COPPA). For students under 13, MUUD relies on the school's authorization, given for the educational use and benefit of the school and for no other commercial purpose. Parents can review their child's information, ask for its deletion and refuse further collection by contacting the school or writing to soporte@muud.app; we act on those requests together with the school. MUUD keeps children's personal data only as long as reasonably necessary for the purpose for which it was collected, under the retention schedule in Section 10, and then deletes it.
• Best interest of the child. Children's data is processed in their best interest, with privacy by default: no advertising, no commercial profiling, no public profiles, no social features between students, and no disclosure of free-text content to adults at the school.
• If something went wrong. If we learn that a child's data was collected without the required notice, consent or authorization, we suspend processing, inform the school and delete the data unless the situation is remedied or a legal retention obligation applies.

8. Who Receives Personal Data

We do not sell or rent personal data, and we do not share it for advertising. We share it only with:

• Your school or employer, to the extent described in Section 4.
• Our subprocessors and service providers, listed below, under written contracts that require them to process data only on our instructions, keep it confidential and protect it.
• Authorities, when a law, court order or binding request of a competent authority requires it, or to protect the life or physical safety of a person. We inform the school or employer unless the law prohibits it.
• Professional advisers and auditors, such as lawyers and compliance auditors, under duties of confidentiality.
• A buyer or successor, in a merger, acquisition or sale of assets, who must keep applying this Policy and the commitments made to schools; schools will be told in advance and may require deletion of their data.

Authorized Distributors that resell MUUD in some countries receive the contact and billing data of the customer organization. They access users' data in the Services only if the customer authorizes it in writing, and in that case they act as MUUD's subprocessors under a written data processing agreement.

Subprocessors (data processed for schools and employers)

Service providers for MUUD's own purposes

Apple and Google receive data as independent controllers when you download the App or make a purchase in their stores and, if you choose to dictate, when the speech recognition of your device's operating system or browser processes your audio, in each case under their own privacy policies. Institutional customers receive at least 30 days' notice of any new subprocessor and may object, as set out in the Data Processing Addendum.

9. International Transfers

All data processed through the Services is stored in the United States. MUUD SpA is established in Chile, and its authorized personnel access the data remotely from Chile. For users outside those countries, this means that personal data is transferred to the United States and Chile. We protect these transfers as follows:

• From the EU/EEA: the European Commission's Standard Contractual Clauses (Decision 2021/914), included in our Data Processing Addendum and in our contracts with subprocessors, supported by transfer impact assessments; or the EU-U.S. Data Privacy Framework where the recipient is certified.
• From the United Kingdom: the UK International Data Transfer Addendum to the Standard Contractual Clauses.
• From Switzerland: the Standard Contractual Clauses with the amendments recognized by the Swiss Federal Data Protection and Information Commissioner. Personal data from Switzerland is disclosed to the United States and Chile.
• From Brazil: the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024), under LGPD Art. 33.
• From Chile: the safeguards required by Law No. 19.628 and, from December 1, 2026, the transfer rules of Law No. 21.719, including contractual clauses that ensure an adequate level of protection.
• From Mexico: communications to MUUD and its subprocessors are remisiones to processors under the LFPDPPP, made under contracts that bind them to this Policy and to the controller's instructions, and do not require your consent.

You can ask for a copy of the relevant safeguards by writing to soporte@muud.app.

10. How Long We Keep Personal Data

We may keep data for longer only when the law requires it or to establish or defend a legal claim, and only for as long as that need lasts. When the retention period ends, we delete or irreversibly anonymize the data.

11. How We Protect Personal Data

We apply technical and organizational measures appropriate to the sensitivity of the data, including: encryption in transit and at rest; access to production data restricted to a very small number of authorized personnel, on a need-to-know basis, with individual accounts; separation between the school database and the workplace database; logging and review of access; due diligence and data processing agreements with every subprocessor; confidentiality obligations and privacy training for all personnel; a written incident response procedure, including notice to affected customers within 72 hours of becoming aware of a personal data breach; secure deletion of data and devices; and a compliance program aligned with the GDPR, SOC 2 and HIPAA security frameworks. No system is completely secure, but we work to prevent, detect and respond to incidents, and we will notify you and the competent authorities when the law requires it.

12. Your Rights and How to Exercise Them

Depending on where you live, you have some or all of these rights: to know whether we process your data and to access it; to correct it; to delete it; to object to or restrict its processing; to receive it in a portable format; to withdraw consent at any time, without affecting earlier processing; not to be subject to decisions based solely on automated processing, and to obtain human review; to refuse secondary purposes (Mexico); and to lodge a complaint with a supervisory authority. Exercising your rights is free of charge, and we will not treat you differently for doing so.

How to make a request. Write to soporte@muud.app, use the data request form linked as "Delete account" in the footer of https://muud.app, or, from the EU/EEA, the United Kingdom or Switzerland, contact our representative DataRep (Section 12.1). Parents and guardians can make requests for their children, and you can act through an authorized agent with proof of authorization.

Verification. To protect your data, we verify your identity, or your authority to act for someone else, using the information already associated with the account where possible. We use the information provided only for that purpose.

If you use MUUD through a school or employer, that organization controls your data. We will forward your request to it without undue delay and help it respond, or respond directly when the organization instructs us to.

Response times. We respond within the time required by the law that applies to you:

If we deny a request, we will explain why and how to appeal. U.S. residents can appeal by writing to soporte@muud.app with "Appeal" in the subject; we answer within 60 days.

12.1 Our Representative in the EU/EEA, the United Kingdom and Switzerland

Data Protection Representative Limited, trading as DataRep, represents MUUD SpA under GDPR Art. 27, UK GDPR Art. 27 and FADP Art. 14. You can contact DataRep by email at datarequest@datarep.com, quoting "MUUD SpA" in the subject line; through the webform at www.datarep.com/data-request; or by post at the most convenient address below. Letters must be addressed to "DataRep", not to MUUD SpA, or they may not arrive, and should refer clearly to MUUD SpA. MUUD may ask for evidence of your identity before acting on a request.

13. Information for Specific Countries

13.1 European Union, EEA, United Kingdom and Switzerland

The GDPR, the UK GDPR and the Swiss FADP apply. Where MUUD is controller, the legal bases are those in Section 6. You have the right to object at any time to processing based on legitimate interests, and to direct marketing without giving reasons. There is no automated decision-making within the meaning of GDPR Art. 22. MUUD is not established in the EU and therefore has no lead supervisory authority: you can complain to the authority of your country of residence, work or the place of the alleged infringement.

13.2 Spain

In addition to the GDPR, the LOPDGDD applies. Data of students under 14 is processed with the consent of those holding parental authority, or on another legal basis established by the school under Spanish education law. You can complain to the Agencia Española de Protección de Datos (www.aepd.es).

13.3 Brazil

The LGPD and the ECA Digital (Law No. 15.211/2025) apply. You have the rights in LGPD Art. 18: confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary or excessive data, portability, deletion of data processed on the basis of consent, information about sharing, information about the possibility of refusing consent and its consequences, revocation of consent, and review of automated decisions (Art. 20). MUUD has not appointed an encarregado. For school and workplace customers in Brazil, MUUD acts as operator on the customer's behalf, and the customer, as controller, is the point of contact for its data subjects. For the limited processing MUUD carries out as controller (customer and prospect contact data), MUUD maintains a communication channel for data subjects and for the ANPD at soporte@muud.app, which receives complaints and communications, provides clarifications and adopts the necessary measures, performing the functions described in LGPD Art. 41, paragraph 2. Data of children and adolescents is processed in their best interest, with the protections described in Section 7.

13.4 Chile

Law No. 19.628 applies and, from December 1, 2026, Law No. 21.719. You have the rights of access, rectification, erasure (supresión), objection, portability and blocking, and the right not to be subject to decisions based solely on automated processing. From December 1, 2026, you can complain to the Agencia de Protección de Datos Personales if we do not respond or you disagree with our response.

13.5 Mexico: Privacy Notice (Aviso de Privacidad)

The controller (responsable) for the data MUUD processes on its own behalf is MUUD SpA, with domicile at Av. Presidente Kennedy 5600, Of. 507, Vitacura, Santiago, Chile. For school and workplace deployments, the responsable is your school or employer, and MUUD acts as encargado. The data we process, its purposes (primary and secondary), the sensitive data involved and the recipients are described in Sections 3 to 8. MUUD does not make transfers that require your consent. Where MUUD is controller, sensitive data is processed only with your express written consent, given in the App. You can exercise your ARCO rights (access, rectification, cancellation and opposition), revoke your consent, or limit the use or disclosure of your data by writing to soporte@muud.app with your name, a copy of an identification document or proof of representation, a clear description of the data and the right you want to exercise, and any document that helps locate the data. We will respond within 20 business days and carry out the decision within 15 business days. Changes to this notice will be published on https://muud.app/politica-de-privacidad and, if material, notified by email or in the App.

13.6 United States

Students. MUUD acts as a school official under FERPA, relies on school authorization under COPPA for students under 13 (Section 7), and complies with applicable state student privacy laws, including California's SOPIPA, Illinois' SOPPA and Washington's RCW 28A.604: no targeted advertising, no sale of student data, and no profiling for non-educational purposes.

State consumer privacy laws. Residents of states with consumer privacy laws, including California, Colorado, Connecticut, Virginia and others, have the rights described in Section 12, including to know, access, correct, delete and port their data, and to appeal a denial. In the last 12 months we collected the categories of personal information described in Section 3: identifiers, customer records, internet and network activity, professional information, and sensitive personal information (account login and emotional wellbeing information). We use sensitive personal information only to provide the Services, as permitted by law. We disclosed these categories for business purposes only to the service providers in Section 8. We do not sell or share personal information, and we do not use it for targeted advertising or for profiling with legal or similarly significant effects; because we do not sell or share it, there is nothing to opt out of, and we treat browser opt-out signals such as Global Privacy Control as a confirmation of that choice. We do not disclose personal information to third parties for their direct marketing purposes (California Civil Code 1798.83).

13.7 Other Countries

In Argentina, Colombia, Peru and any other country where MUUD is used, we apply the local data protection law, and you can exercise the rights it grants you through the channels in Section 12 and complain to your local authority.

14. Cookies

The App does not use cookies or similar technologies for tracking or advertising. The Site uses strictly necessary cookies to function. If the Site uses analytics cookies, they are only set after you accept them, and they are kept for no more than 13 months. You can refuse or delete cookies in your browser settings at any time; strictly necessary cookies cannot be disabled without affecting the Site.

15. Changes to This Policy

We will update this Policy when our practices or the law change. For material changes, we will notify institutional customers by email and users in the App at least 30 days before the changes take effect, and ask for new consent where the law requires it. The date at the top shows when it was last updated, and prior versions are available on request.

16. Contact

MUUD SpA, RUT 77.634.166-5
Av. Presidente Kennedy 5600, Of. 507, Vitacura, Santiago, Chile
Privacy and data requests: soporte@muud.app
Data request and account deletion form: "Delete account" link in the footer of https://muud.app
Telephone: +56 9 2691 3974
Representative in the EU/EEA, the United Kingdom and Switzerland: DataRep, datarequest@datarep.com (Section 12.1)

© 2026 MUUD SpA. All rights reserved.