Privacy policy

YourADI Limited is a company registered in the Republic of Ireland. MUDhub is a registered business name of that company, and the same data protection contact answers for both.

Depending on your relationship with the platform we act either as a data controller or as a data processor. Section 2 explains which.

Managing agents and their staff

We are the data controller for your account, your billing details and the business data you give us in order to be a customer. We decide the purposes and means of processing that information.

Directors, unit owners, tenants and contractors

We are a data processor. The managing agent is the controller of the records held about you: your unit, your service charge account, your correspondence, the documents about your development. We process that data only on the agent’s documented instructions and under a data processing agreement.

This matters when you want to exercise a right. If you are a unit owner or a director, the agent decides what happens to your data, so a request should go to them first. Section 10 sets out what we do when one reaches us instead.

• From managing agents: Name, work email address, phone number, the name and address of the agency, the PSRA licence number where you give it, and billing details.
• From portal users: Directors and unit owners who sign in to the portal give an email address and are linked to a unit by their managing agent. We hold what the agent has recorded about that unit and its ownership.
• Uploaded by the agent: The records an agency keeps about the developments it manages: owners and units, budgets, service charges, arrears, bank statements, work orders, contractors and documents such as minutes, insurance policies and sale packs.
• From the contact form: Your name, email address, phone number if you give one, your organisation, the PSRA licence number if you quote one, and the message itself. Nothing else is collected from that form and it is not used to build a marketing list.
• Automatically: Standard server logs kept for security and diagnosis, and the session cookie that keeps you signed in. See section 9.

Where you give a PSRA licence number, we may check it against the public register kept by the Property Services Regulatory Authority. That is a check on a business credential, and we do not treat the number on its own as proof of anything.

• Contractual necessity, Article 6(1)(b): To provide the platform to an agency that has subscribed to it, and to keep the account working.
• Legitimate interests, Article 6(1)(f): To keep the service secure, prevent fraud and abuse, diagnose faults, verify that somebody claiming to be a licensed agent is one, and answer enquiries sent to us. We balance these against your interests before relying on them.
• Legal obligation, Article 6(1)(c): To keep accurate financial and tax records as Irish law requires of us as a company.
• Consent, Article 6(1)(a): For anything optional. We do not currently run analytics or send marketing email, so there is nothing here to consent to today. If that changes we will ask first, and you will be able to withdraw at any time.

Where we are a processor rather than a controller, the legal basis for holding a unit owner’s data is the managing agent’s, not ours.

• Operating, maintaining and securing the platform.
• Running the things an agency uses it for: budgets, service charge apportionment, collections, arrears, banking reconciliation, work orders, compliance dates and documents.
• Sending transactional email, such as sign-in links, password resets and portal invitations.
• Answering support requests and enquiries.
• Diagnosing faults and improving reliability.
• Detecting and preventing fraud, abuse and unauthorised access.
• Meeting our own legal, tax and regulatory obligations in Ireland.

We do not sell personal data, we do not share it for advertising, and we do not use the data an agency holds in the platform to train machine learning models.

We use a small number of vetted providers under contractual safeguards, including data processing agreements. The list is short on purpose, and it is the whole list:

• Supabase: The PostgreSQL database, authentication and file storage. Hosted in the EU.
• Vercel: Application hosting and delivery of the website and application.
• Resend: Delivery of transactional email such as sign-in links and portal invitations.

There is no payment processor in this list, because MUDhub does not take service charge payments. There is no SMS provider, no analytics provider and no advertising network, because the platform does not use any. If we add a sub-processor we will update this page.

We aim to process personal data inside the European Economic Area, and the database and file storage are hosted in the EU. Where a sub-processor processes data outside the EEA, we rely on appropriate safeguards: standard contractual clauses approved by the European Commission, or an adequacy decision where one applies. You can ask us for details of the safeguards that apply to a specific transfer.

• Account data: For as long as the agency uses the platform. On closure the workspace is deactivated.
• Financial records: Invoices and transaction records that we are required to keep are retained for seven years, to meet Irish Revenue and statutory record keeping requirements.
• Data an agency holds about its developments: The agent decides, because the agent is the controller. On termination we return or delete it on their instruction. Bear in mind that company law and the Multi-Unit Developments Act impose their own retention periods on an OMC.
• Contact form enquiries: Kept while we deal with the enquiry and for a reasonable period after, so we can pick up a conversation where it left off. Ask us and we will delete yours.

We use only the cookies the application needs to work: an authentication token that keeps you signed in, and tokens that protect forms against cross-site request forgery. The platform cannot function without them, so there is no banner asking you to accept them.

We do not use analytics or advertising cookies. There is no Google Analytics on this site and no third-party tracker. If we ever add one it will be optional, it will ask first, and you will be able to withdraw.

Our email provider records standard delivery events for transactional messages, meaning whether a message was delivered, bounced or was reported as spam. We rely on those to keep sign-in email arriving. We do not send marketing email from MUDhub, so nothing is wrapped in click tracking.

The cookie policy sets this out in more detail.

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Have inaccurate or incomplete data corrected.
• Have your data erased, subject to the retention periods in section 8.
• Restrict or object to processing, including any direct marketing.
• Receive your data in a structured, machine-readable format.
• Withdraw consent at any time where processing relies on it, without affecting what was lawful before.

If you are a unit owner, tenant or director, your managing agent is the controller of your records, so send your request to them first. If you send it to us we will tell you promptly and pass it to the agent, and we will help them answer it.

You can also complain to the Irish Data Protection Commission at dataprotection.ie, or by post at 21 Fitzwilliam Square South, Dublin 2, D02 RD28.

• Hosting on secure cloud infrastructure within the EEA.
• Encryption in transit (TLS 1.2 or better) and at rest.
• Row level security on every table: The database itself refuses to return one agency's rows to another, rather than relying on the application to remember to filter them.
• An append-only ledger: Accounting entries cannot be edited or deleted after they are posted. A correction is a new entry.
• Role-based access limiting staff access to what is needed.
• Logging and audit trails.

No method of transmission or storage is completely secure. If a personal data breach occurs that poses a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours and, where required, tell affected users without undue delay. As a processor we will notify the managing agent without undue delay so that they can meet their own obligation.

MUDhub is a business tool for property professionals and the owners and residents of managed developments. It is not directed at children and we do not knowingly collect their personal data. If a child’s data reaches the platform and is brought to our attention, we will remove it or refer it to the controlling agent for removal.

We may update this policy to reflect changes to the platform, to our sub-processors or to the law. Where a change is material we will give reasonable notice by email or in the application before it takes effect. The version number and dates at the top of this page always say which version is in force.

For any question about this policy, to make a data subject access request, or to exercise any right above: