Muvemate

Legal

Privacy Policy

Last updated: 16 July 2026

This Privacy Policy explains how Muvemate ("we", "us", "our"), a trading name of Web Vault Pro Ltd, collects and uses your personal data when you use our app (the "Service"). We are the data controller for the purposes of the UK GDPR and the Data Protection Act 2018.

1. Who we are

Web Vault Pro Ltd, trading as Muvemate. For any privacy questions or to exercise your rights, contact us at privacy@muvemate.com.

2. What data we collect

  • Account data — your email address, name (if provided) and authentication identifiers.
  • Property data — properties, notes, checklist progress, offers and documents you add.
  • Connected inbox data — if you connect Gmail or Outlook, message metadata and content related to your property purchase, used solely to surface relevant threads inside the app. See Section 12 — Google user data and inbox monitoring for full details.
  • Billing data — subscription status and Stripe customer identifier. We do not store your card details; these are handled by Stripe.
  • Technical data — IP address, browser type and basic session logs used for security and to keep the Service running.

3. Why we use it (legal bases)

  • Contract — to provide the Service you have signed up for.
  • Legitimate interests — to secure the Service, prevent abuse, and improve reliability.
  • Consent — where you explicitly connect a third-party inbox or opt in to a feature.
  • Legal obligation — to keep records required by tax and company law.

4. AI features

Pro features such as Ask AI, survey analysis and email triage send the relevant content to our AI model providers for processing. Content is used only to generate the response you requested and is not used to train models.

5. Sharing and subprocessors

We only share data with providers that help us run the Service:

  • Supabase — authentication, database and file storage (EU region).
  • Stripe — payment processing for Pro subscriptions.
  • Google and Microsoft — sign-in and, if you connect an inbox, read access to messages you authorise.
  • AI model providers — powering AI features.

6. International transfers

Some subprocessors are based outside the UK/EEA. Where that is the case, transfers are protected by the UK International Data Transfer Addendum or Standard Contractual Clauses.

7. How long we keep it

We keep your data for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where we are legally required to retain limited billing records.

8. Your rights

You have the right to access, correct, delete, restrict and port your personal data, and to object to certain processing. To exercise any of these rights, email privacy@muvemate.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies

We use only strictly necessary cookies to keep you signed in. See our Cookie Notice for details.

10. Security

We use encryption in transit, access controls and row-level security on our database. No service can guarantee absolute security, but we take reasonable measures appropriate to the risk.

11. Changes

We may update this policy from time to time. Material changes will be highlighted in the app or notified by email.

12. Google user data and inbox monitoring

This section explains how Muvemate accesses, uses, stores, and shares data from your Gmail or Microsoft Outlook inbox when you choose to connect it, and how our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements. If you do not connect an inbox, none of the processing in this section applies to you.

12.1 What we connect to

  • Google Gmail — via Google OAuth with the limited scopes needed to read messages.
  • Microsoft Outlook / Office 365 — via Microsoft OAuth with the limited scopes needed to read messages.

The connection is always initiated by you and you can disconnect it at any time from Muvemate Settings or by revoking access in your Google or Microsoft account.

12.2 How we access Google user data

We access Google user data only after you complete the Google OAuth consent flow, and only for the scopes you approve on the consent screen. Muvemate currently requests the following Google scopes:

  • userinfo.email — to confirm the address of the account you connected.
  • gmail.readonly — read-only access to your Gmail messages so we can surface those relevant to your property transaction.

We do not request write, send, modify, or delete scopes. We do not access your Google Drive, Calendar, Contacts, Photos, or any other Google product.

12.3 How we use Google user data

We use Google user data solely to provide Muvemate's inbox intelligence features:

  • Matching emails to properties or contacts you have added to Muvemate (for example, detecting when a solicitor replies to an LPE1 enquiry).
  • Classifying messages by type (solicitor correspondence, estate-agent updates, survey threads).
  • Surfacing unread or action-required items inside the app.
  • Generating summaries or suggested drafts using AI only when you explicitly request them.

We do not use Google user data for advertising, we do not sell it, and we do not use it to build profiles for any purpose outside of Muvemate.

12.4 How we store Google user data

  • OAuth access and refresh tokens, stored encrypted at rest.
  • Message metadata (sender, recipients, subject, date, message/thread identifiers) for matched messages.
  • Local copies of message content for matched messages, so we can display them inside the app and run classification or summarisation.
  • Classification labels, summary text and any drafts you create within Muvemate.

All data is stored in our EU-hosted backend with encryption in transit and at rest, and row-level security so your data is accessible only to your account.

12.5 How we share Google user data

We share Google user data only with the subprocessors listed in Section 5, strictly to provide and improve the Service. When you request an AI summary or draft, the relevant message content is sent to our AI model providers to generate the response; those providers are contractually prohibited from using the data for their own purposes and from training models on it. We never transfer Google user data to third parties for advertising or any independent purpose.

12.6 Retention and deletion

  • While connected — we retain synced message data and tokens so the feature can update your inbox view.
  • On disconnect — we delete stored tokens and synced message content within 30 days.
  • On account deletion — all inbox data, tokens and synced messages are deleted, except where limited retention is legally required.

12.7 Your controls

  • Muvemate Settings — disconnect Gmail or Outlook.
  • Google account — Security > Third-party apps with account access, revoke Muvemate.
  • Microsoft account — Privacy > Apps and services, revoke Muvemate.

12.8 Google API Services Limited Use disclosure

Muvemate's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • We use Google user data only to provide or improve user-facing features that are prominent in Muvemate's user experience.
  • We do not transfer Google user data to third parties except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with user notice.
  • We do not use Google user data for serving advertisements, including retargeting, personalised or interest-based advertising.
  • We do not allow humans to read Google user data, unless we have your affirmative consent to view specific messages, doing so is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data has been aggregated and anonymised for internal operations.
  • We do not use Google user data to train or improve generalised or non-personalised AI or machine-learning models.

12.9 Microsoft data

Where you connect a Microsoft account, Muvemate accesses Microsoft Graph data only to read email messages relevant to your property transaction, on the same terms described in this Section 12.

12.10 Keeping this policy up to date

We keep this Privacy Policy and our in-product privacy notifications up to date to reflect how Muvemate uses Google user data. Material changes will be highlighted in the app and, where appropriate, notified by email before they take effect.