Privacy Policy

Last updated: 2 June 2026

1. Controller

UMAN BV (Belgium) is the data controller for personal data collected through uman.rfud.io. Contact: privacy@uman.rfud.io.

2. What we collect

• Account: email, display name, optional avatar, city, Instagram handle.
• Orders: name, shipping address, billing info, order history.
• Tribes & proofs: tribe details, submitted proof posts and descriptions.
• Technical: IP address, browser, pages visited (aggregated analytics).
• Email: send logs, bounces, unsubscribes.

3. Why we use it (legal basis)

• Contract — to ship orders, manage accounts, run tribes.
• Legal obligation — invoicing, tax, food safety records.
• Legitimate interest — service emails, fraud prevention, aggregated analytics.
• Consent — marketing emails, non-essential cookies. Withdrawable any time.

4. Retention

Order data is kept for 7 years (Belgian accounting law). Account data is kept until you delete your account. Marketing consent is kept until withdrawn. Email logs are kept for 12 months.

5. Sharing

We share data only with processors needed to run the service: payment provider, shipping carrier, email infrastructure, hosting (EU region). We do not sell personal data.

6. Your rights (GDPR)

You may access, rectify, erase, restrict, or port your data, object to processing, and withdraw consent. Email privacy@uman.rfud.io and we respond within 30 days. You may lodge a complaint with the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be).

7. Security

Data is encrypted in transit, stored on EU-hosted infrastructure with row-level access controls. We review access regularly and notify affected users of any breach within 72 hours.