Datenschutzerklärung / Privacy Policy

1. Data Controller

Mota GmbH, Stresemannstraße 86, 22769 Hamburg, Deutschland ("we", "us") operates this website at muchomota.com. For privacy inquiries, contact us at data@muchomota.com.

2. What This Site Collects

muchomota.com is a static marketing site. It needs no account and shows no advertising.

• Hosting and server logs: the site runs on our own server, rented from Hetzner Online GmbH (Gunzenhausen, Germany) and located in Finland. The web server logs each request (IP address, time, requested page, referring page, browser user agent, status code) for security and abuse prevention. The logs rotate weekly and are deleted after about six months (27 weeks). Legal basis: Art. 6(1)(f) GDPR (running a secure site).
• Visitor statistics (Umami): we count visits with Umami, which we host ourselves at analytics.muchomota.com on the same server. Umami sets no cookies and stores nothing on your device. It records the page address (including any query string and campaign tags), page title, referring site, browser, operating system, device type, screen size, language, country, region and city, page-load timings and which buttons were clicked. Your IP address is used to look up the location and, together with your browser details and a salt that changes regularly, to form a pseudonymous visit identifier; the IP address itself is not stored. The raw statistics stay on our server; we e-mail ourselves an aggregated weekly summary. We keep the statistics for as long as we use them to compare traffic over time. Legal basis: Art. 6(1)(f) GDPR (understanding which pages are read).
• Referral cookie: only if you arrive through a link that contains ?ref= or ?via=, the site stores that referral code in a cookie named mota_ref on .muchomota.com for 90 days, so the person who referred you can be credited if you sign up. No other cookie is set by this site. Legal basis: Art. 6(1)(f) GDPR (crediting referrals).
• Fonts: the site loads its fonts from Google Fonts (fonts.googleapis.com, fonts.gstatic.com). Your browser connects to Google's servers for this, which transmits your IP address to Google Ireland Limited and possibly Google LLC in the USA. Legal basis: Art. 6(1)(f) GDPR (consistent typography).
• Booking a call: if you book a call on the contact page, we receive your name, e-mail address, notes and chosen time. We store the booking, send ourselves a notification e-mail with these details, and create a Google Calendar event with a Google Meet link; Google e-mails you the invitation. Legal basis: Art. 6(1)(b) GDPR (steps you asked for before a contract).
• Blog images: some blog posts show images served by Substack's image service (substackcdn.com). Opening those pages makes your browser fetch the images from Substack Inc. (USA), which receives your IP address. Legal basis: Art. 6(1)(f) GDPR (showing the images that belong to the essays).
• Newsletter and links: the newsletter is run by Substack at www.blog.muchomota.com; you subscribe on Substack's site, under Substack's privacy policy. Links to YouTube, Run It Once, Lobbyze and other sites take you to services with their own privacy policies.

3. The App and Sign-in (app.muchomota.com, auth.muchomota.com)

This policy also covers the app. If you create an account, we process: your e-mail address, username and, if you give it, your name and Discord handle; your password, stored as a hash; if you sign in with Google or Discord, the e-mail address and name they pass to us; the SharkScope player names you add and the tournament results we fetch for them from SharkScope; if you connect Lobbyze, the Lobbyze e-mail and password (stored encrypted) and session data needed to sync your schedules; the settings and numbers you enter; billing data through Stripe (card details are handled by Stripe, not us) or Luxon Pay; and account e-mails, which we send through Resend. Legal basis: Art. 6(1)(b) GDPR (providing the service you signed up for) and Art. 6(1)(c) GDPR for invoices we must keep.

Our sign-in system logs account and sign-in events (for example registration, sign-in, failed sign-in, sign-out, e-mail verification, password and profile changes), each with time, IP address and event type, for security, and deletes them after 90 days. The separate proof of residence for VAT is described in section 4. App pages load fonts and scripts from Google Fonts, unpkg.com, cdn.plot.ly and cdn.jsdelivr.net, which receive your IP address. We keep account data while your account exists, and billing records for as long as German tax law requires.

Some of these recipients are outside the EU/EEA (Google, Stripe, Resend, Substack and the script CDNs). For US companies certified under the EU-US Data Privacy Framework the transfer relies on that adequacy decision; otherwise on the EU standard contractual clauses.

4. Proof of Your Country of Residence for VAT

When you create an account and when you start a purchase (Stripe checkout or a Luxon Pay invoice), we store the IP address of the device you use, the time, the country that our GeoIP database (MaxMind GeoLite2; the version is recorded with each entry) assigns to that address at that moment, the reference of the checkout session or invoice and, where you enter one, the country of your billing address. VAT law requires us to establish and document where our customers live (§3a(5) UStG; Art. 24b and 24f of Implementing Regulation (EU) No 282/2011) and to keep those records (§147 AO). Legal basis: Art. 6(1)(c) GDPR and, where we choose the IP address as one of the permitted means of proof, Art. 6(1)(f) GDPR (being able to prove the correct VAT treatment of your purchase). We use this data for no other purpose.

Entries for purchases that were never paid, and for accounts that never bought anything, are deleted after 30 days. Entries behind a paid purchase are kept for 10 years from the end of the calendar year of the last purchase they back, then deleted. This also applies if you delete your account (Art. 17(3)(b) GDPR); we then remove only the link to your account.

5. Your Rights Under GDPR

You have the right to access, rectify, erase, port, and restrict processing of your personal data, and to withdraw consent at any time. Where we rely on legitimate interest (Art. 6(1)(f) GDPR), you can object to the processing at any time (Art. 21 GDPR). Records we must keep under tax law (section 4) are erased once their retention period ends. Contact data@muchomota.com to exercise your rights. You also have the right to lodge a complaint with a supervisory authority (in Germany: the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit).

6. Cookies

This marketing site sets one cookie, mota_ref, and only when you arrive through a referral link (see section 2). The analytics set none. The app and sign-in pages use the cookies needed to keep you signed in.