Data Processing Terms

1. Roles

• Merchant data. For the customer information a merchant sends, Munja acts as the merchant's service provider (processor): it processes that information only to show offers, record choices and deliver leads, as these terms and the merchant's settings direct.
• Partner copy. When a customer chooses an offer, the partner receives its own copy of the customer's name and email and becomes independently responsible for it.
• Munja's records. Munja is independently responsible for consent records, fraud prevention, billing and security records.

2. What is processed

Customer name, email, ZIP code and the order details the merchant chooses (used only for matching and not stored, except the ZIP code). Phone numbers are discarded. Merchants must not send the categories listed in the Acceptable Use Policy.

3. Munja's commitments

• Process customer information only to provide Munja, and never sell it.
• Limit access to people who need it to run the service, under confidentiality duties.
• Keep it secure: encryption of contact details at rest (AES-256-GCM), HTTPS in transit, hashed email and network addresses in consent records, two-factor sign-in for business accounts, and logged admin actions.
• Delete it on the schedule in the privacy policy, and when a customer's deletion request is verified.
• Help with customer rights requests we receive or that you pass to us at privacy@getmunja.com.
• Notify affected merchants and partners of a security breach involving their customer information without undue delay after we confirm it, with the facts we have and the steps we are taking.

4. Subprocessors

Our hosting provider (United States), Supabase (database, United States), Stripe (payments and payouts) and Resend (email). Ask privacy@getmunja.com for the hosting provider’s name and terms. We will update this list before adding a new subprocessor that handles customer information.

5. Your commitments

Merchants confirm they have the notices and consents needed to send customer information to Munja. Partners use what they receive only as the Partner Terms allow and handle it securely.

6. Limits

These terms are subject to the limitation of liability in the Terms of Service. Munja holds no security or privacy certification and does not claim one.