Privacy Policy

MUNDash (“MUNDash,” “we,” “us,” or “our”) is a cloud-based platform for Model United Nations delegation management.

For privacy-related inquiries, contact us at legal@mundash.com.

We collect the following categories of personal data:

• Account data: Name, email address, profile picture/avatar, and authentication credentials.
• Usage data: IP address, browser user-agent, session tokens, and access timestamps, collected automatically when you use the service.
• Delegation data: Delegation name, member roles, evaluation scores, conference participation history, committee assignments, and awards.
• Billing data: Subscription plan, billing cycle, and billing email. Payment card details are processed exclusively by our payment provider (Lemon Squeezy) — we never store or see full card numbers.

• To create and manage your account and delegation workspace.
• To process subscription payments and send billing receipts.
• To deliver transactional emails (invitations, password resets, billing alerts).
• To provide and improve the features of the platform.
• To detect and prevent fraud, abuse, or security incidents.

We do not sell your data to third parties.

For users in the European Economic Area (EEA) and where applicable under GDPR (Regulation 2016/679):

• Performance of a contract (Art. 6(1)(b)): Processing necessary to provide the service you subscribed to.
• Legitimate interests (Art. 6(1)(f)): Security monitoring, fraud prevention, and service improvement.
• Legal obligation (Art. 6(1)(c)): Retention of billing records as required by applicable law.

We share your data only with the following sub-processors, each bound by appropriate data protection agreements:

• Lemon Squeezy — payment processing and subscription management.
• Resend — transactional email delivery.
• Cloudflare R2 — storage of user-uploaded files such as profile images and delegation logos.
• Neon — managed database hosting.
• Fly.io — application hosting and infrastructure.

Our infrastructure is currently operated by providers located in the United States. If you are located in Latin America, the European Economic Area, or elsewhere outside the United States, your personal data will be transferred to and processed there.

We rely on contractual safeguards (such as Standard Contractual Clauses where applicable) with our sub-processors to protect your data in transit and at rest. If we migrate to infrastructure in a different region, this policy will be updated accordingly.

• Account and delegation data is retained for the duration of your active subscription plus 30 days after account deletion (to allow recovery if requested).
• Billing and transaction records are retained for up to 7 years to comply with applicable financial regulations.
• Session and security logs are retained for up to 90 days.

Depending on your location and applicable law, you may have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (“right to be forgotten”), subject to legal retention obligations.
• Portability: Receive your data in a structured, machine-readable format.
• Restriction / Objection: Ask us to limit or stop certain processing activities.

To exercise any of these rights, email legal@mundash.com. We will respond within 30 days.

MUNDash uses only essential, session-based cookies required for authentication and security. We do not use advertising, tracking, or analytics cookies. No third-party cookie banners or consent management is needed beyond this disclosure.

The service is intended for students, educators, and Model United Nations participants. Users must meet the minimum age required under the laws of their jurisdiction to enter into a binding agreement, or have any required parental or institutional authorization. We do not knowingly collect personal data from anyone who does not meet these requirements. If you believe such data has been provided, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. The updated version will always be available on this page. For material changes, we may notify users by email or through the application.

Data controller: MUNDash

Contact: legal@mundash.com