Privacy

Last updated: September 2026

Your privacy matters to us. This policy explains how Alright Mucka Limited (trading as Mucka), company number 16713216, ("Mucka", "we", "our", or "us") collects, uses, and protects your personal information when you use our services.

Alright Mucka Limited is the data controller for the personal data described in this policy, unless otherwise stated. We are registered with the Information Commissioner's Office (ICO) under reference ZC023304.

1. Information We Collect

Information you provide directly

Account details: name, email address, phone number, and business information
Content you create: quotes, invoices, job details, and client records
Photos and attachments: images you attach to jobs, invoices, receipts, and project records via the in-app camera or photo library. Stored in our secure file storage and retained for the lifetime of the parent record unless deleted by you.
Voice data: when you use voice commands or the in-app voice agent, your speech is streamed to our voice processing provider for transcription and response generation. Audio recordings are stored by our voice provider and may be reviewed by our team to monitor quality and improve the accuracy and reliability of our voice systems.
Phone calls answered by the AI receptionist: when our AI receptionist answers a call for a business using Mucka, the call is recorded and a written transcript is made. Callers hear a recorded notice that the call may be recorded before the receptionist greets them. Recordings are held in encrypted storage and deleted automatically 90 days after the call. The transcript and a written summary are kept with the business's own records for as long as their account is open, so they have a record of what was discussed and agreed. For these calls the business using Mucka is the data controller and we act as a data processor on their behalf, on the terms described in section 3.3.
Payment information: subscription billing is processed by our payment provider (Stripe). Mucka does not see, store, or process card numbers: all card data is collected and held by Stripe under their PCI-DSS Level 1 compliance.
AI assistant interactions: messages you send to the in-app AI assistant, together with the business context needed to answer them (such as your current jobs, clients, or recent activity), are processed by our AI provider to generate responses. You can delete AI conversation history at any time via Settings → Account.
WhatsApp messages (where enabled): if your account has WhatsApp integration enabled, inbound and outbound business messages are exchanged via the Meta WhatsApp Business Cloud API and pass through Meta's infrastructure.
Gmail (where connected): if you connect your Gmail account, we access your emails, including their senders, recipients, subjects, dates, text and attachments, to match them to your customers and jobs and to send the emails you approve. See Section 5.2.
Communications: messages you send to us or through the platform
Marketing preferences: your consent choices for receiving promotional communications, including SMS and email marketing
End-customer data: contact details (including names and phone numbers) of your clients that you input into the platform for the purpose of managing quotes, invoices, job communications, and other service-related activities

Information we collect automatically

Device information and browser type
Usage data and interaction patterns
IP address and approximate location derived from it
Push notification tokens (mobile app only): when you grant notification permission on iOS or Android, we receive a device token from Apple Push Notification service or Firebase Cloud Messaging. Tokens are stored against your account and used solely to deliver push notifications. They are removed when you sign out or revoke notification permission.
Precise location (opt-in, mobile app only): if you enable the On Time Tracker feature, we collect precise device location approximately every 2 minutes during your declared working hours, used only to warn you when it's time to leave for your next job. Location data is not retained beyond the active session unless you explicitly attach it to a job. You can disable On Time Tracker at any time in app settings.
Session recording (opt-out): We record how the app is used, including screen layouts, taps, scrolls and navigation between screens. These recordings are masked: text and form inputs are hidden before the recording leaves your device, so they do not capture customer names, addresses, job notes, prices or any information you type. We use them only to understand how Mucka is used and to find and fix problems. Recordings are processed by Amplitude on servers in the EU and are linked to your Mucka user ID. You can opt out at any time in Settings.

2. How We Use Your Information

We use your information for the purposes set out below. For each purpose, we have identified the lawful basis we rely on under UK GDPR Article 6.

Purpose	Lawful Basis
Providing, maintaining, and improving our services	Performance of a contract (Art. 6(1)(b))
Processing payments	Performance of a contract (Art. 6(1)(b))
Personalising your experience	Legitimate interests (Art. 6(1)(f)), to improve our services and make them more relevant to you
Responding to support requests or enquiries	Performance of a contract (Art. 6(1)(b)) / Legitimate interests (Art. 6(1)(f))
Sending service communications (e.g., account alerts, job status updates, payment confirmations)	Legitimate interests (Art. 6(1)(f)), necessary for the operation of the service
Sending promotional SMS and email marketing	Consent (Art. 6(1)(a)), in accordance with the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"). See Section 3
Sending SMS and other communications to end-customers on behalf of tradespeople	Legitimate interests or consent (as determined by the tradesperson as data controller). See Section 3
Analysing trends and usage for internal business purposes	Legitimate interests (Art. 6(1)(f)), to understand how our services are used and improve them
Ensuring legal compliance and enforcing our Terms of Service	Legal obligation (Art. 6(1)(c)) / Legitimate interests (Art. 6(1)(f))

3. SMS and Electronic Marketing Communications

3.1 Types of SMS Communications

We may send you the following types of text messages (SMS):

Service messages (sent on the basis of legitimate interests or contractual necessity, so no marketing consent is required):

Account verification and security alerts
Job status updates and appointment reminders
Payment confirmations and invoice notifications
Service disruption notices

Promotional messages (sent only with your prior consent under UK PECR):

Product updates, new features, and service enhancements
Special offers, discounts, and promotions
Tips and content related to running your trade business
Event invitations and announcements

3.2 Consent for Promotional SMS and Email

We will only send you promotional SMS or email marketing where you have given us your specific, informed, and freely given consent to do so. You may provide consent by:

Ticking a clearly labelled opt-in box during account registration or at a later point within the platform
Responding affirmatively to an in-app consent request

We will never treat pre-ticked boxes, silence, or inactivity as consent.

Soft opt-in: Where you are an existing customer of Mucka AI and we obtained your contact details in the course of providing our services to you, we may send you promotional messages about our own similar products and services without requiring fresh opt-in consent, provided that:

(a) you were given a clear opportunity to opt out when your details were first collected; and

(b) every subsequent message includes a simple way to opt out.

This is in accordance with Regulation 22(3) of the Privacy and Electronic Communications (EC Directive) Regulations 2003.

3.3 SMS and Communications Sent on Behalf of Tradespeople

Where a tradesperson using our platform instructs us to send SMS messages or other communications to their end-customers (e.g., appointment reminders, quote notifications, job completion updates, or review requests), the following applies:

Data controller: The tradesperson is the data controller for their end-customers' personal data. Mucka acts as a data processor on the tradesperson's behalf for these communications.
Lawful basis: It is the tradesperson's responsibility to ensure they have a lawful basis (such as legitimate interests or consent) for sending these messages to their customers.
Data processing terms: We process end-customer data in accordance with the data processing terms set out in our Terms of Service.
Promotional messages to end-customers: If a tradesperson wishes to send promotional SMS to their end-customers via our platform, they must ensure they have obtained valid PECR-compliant consent from those individuals before instructing us to send such messages. We will not knowingly send promotional SMS to end-customers without confirmation from the tradesperson that appropriate consent has been obtained.
Opt-out: All SMS sent to end-customers on behalf of tradespeople will include a clear opt-out mechanism (e.g., reply STOP). Opt-out requests will be processed within 24 hours.

3.4 How to Opt Out of Marketing Communications

You can opt out of promotional SMS at any time by:

Replying STOP to any promotional text message
Updating your communication preferences in your Mucka account settings
Contacting us at privacy@mucka.ai

You can opt out of promotional emails at any time by:

Clicking the unsubscribe link in any marketing email
Updating your communication preferences in your Mucka account settings
Contacting us at privacy@mucka.ai

Opting out of promotional messages will not affect service messages that are necessary for the operation of your account.

We will process your opt-out request within 48 hours of receipt.

3.5 SMS Frequency and Charges

We will not send more than 4 promotional SMS messages per calendar month unless you have explicitly opted in to a higher frequency.

Standard message and data rates from your mobile provider may apply. Mucka does not charge you for receiving SMS.

3.6 Consent Records

We maintain records of:

When and how consent was obtained for promotional communications
Opt-out requests and the date they were actioned
The content and timing of messages sent

These records are retained for the duration of your account and for a period of 24 months following account closure or withdrawal of consent, in order to demonstrate compliance with UK PECR and UK GDPR.

4. How We Share Your Information

We do not sell your personal data. We may share your information with:

Service providers: We use third-party service providers to help us deliver our services. These include:

Payment processors: to process payments securely on our behalf
Hosting and infrastructure providers: to store and serve our platform
Analytics and session-recording provider (Amplitude): to help us understand how our services are used. Amplitude processes this data on servers in the EU.
SMS delivery provider (Twilio): to deliver text messages to end-customers on behalf of tradespeople using our platform
Email marketing provider (Mailchimp / Intuit): to deliver promotional email and SMS marketing communications to our users

All service providers are bound by contractual obligations to process your data only on our instructions and to maintain appropriate security measures. Where a service provider processes personal data on our behalf, we have data processing terms in place that meet the requirements of UK GDPR Article 28. For tradespeople using our platform, data processing terms governing our handling of end-customer data are set out in our Terms of Service.

A current list of named sub-processors is available on request by contacting privacy@mucka.ai.

Affiliates and contractors: under strict confidentiality and security obligations.

Legal authorities: when required by law or to protect rights and safety.

Business transfers: in the event of a merger, acquisition, or asset sale, your personal data may be transferred as part of that transaction. We will notify you of any such change.

5. Google API Services: Limited Use Disclosure

You can choose to connect three Google services to Mucka: Google Calendar, Google Business Profile and Gmail. Each one is optional, and Mucka only accesses a Google service after you have connected it and agreed to the access Google shows you. This section explains what we access from each service, why, and what we do with it.

Mucka's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

5.1 Google Calendar and Google Business Profile

We use data obtained from Google Calendar and Google Business Profile only to provide and improve the calendar sync and review management features you have explicitly connected within Mucka.
Where Mucka processes this data with AI, that processing is performed by third-party AI providers (Anthropic, OpenAI and ElevenLabs) under contractual terms that prohibit the use of your data to train their models.
We retain this data only while the relevant integration is connected, and delete it when you disconnect Google Calendar or Google Business Profile from within Mucka.

5.2 Gmail

If you connect your Gmail account, Mucka matches your customer emails to the right customer and job, and lets you send quotes, invoices and replies from your own Gmail address.

The access we ask for, and why. When you connect Gmail, Google asks you to allow Mucka to:

Read, compose and send email (Google's gmail.modify permission). We need this to read your emails, work out which customer and job each one is about, save draft replies in your Gmail drafts, and carry out the inbox actions you choose in Mucka.
Send email on your behalf (Google's gmail.send permission). We need this to send quotes, invoices and replies from your own Gmail address. Mucka only sends an email once you have approved it.

Mucka never deletes or archives your emails on its own. If you choose Archive, Move or Delete in Mucka's inbox, Mucka applies it in Gmail exactly as Gmail would: Delete moves the email to your Gmail Trash.

The Gmail data we access. When you first connect, Mucka reads your last 30 days of email (up to 250 emails), and after that checks for new email every few minutes. For each email it reads:

the sender, recipients, subject, date and the labels Gmail has applied
the text of the email
attachments, such as a supplier invoice or a photo a customer has sent

How we use it. We use Gmail data only to provide the email features you have turned on in Mucka:

matching each email to the right customer and job, and showing it there
summarising emails and email threads for you
picking out details such as names, addresses, dates and job details, so you can approve adding them to your Mucka records
drafting replies for you to check, edit and approve, which are saved in your Gmail drafts until you send them
sending the quotes, invoices and replies you have approved from your Gmail address
reading supplier invoices and receipts you receive so they can go onto a job or into your books
answering you when you ask Mucka about your email, in the app, by voice, on a phone call or over WhatsApp

What we store, and where. Mucka stores, on servers in the European Union and encrypted in transit and at rest:

your Gmail address and name, the permissions you granted, and the access keys Google gives us, which we encrypt separately
your emails: the sender, recipients, subject, date, Gmail labels, a short preview and the full text
attachments, in private storage (files over 10 MB are listed but not downloaded)
a short summary of each conversation, what it is about and how urgent it is
for emails from a customer, the subject and the start of the text on that customer's record
draft replies and suggestions waiting for your approval
copies of supplier invoices and receipts, so you can add them to a job or your books

Who it is shared with. We do not sell Gmail data. We share it only with:

Our AI provider, which processes the parts of your emails it needs to match, summarise and draft replies and to pick out details. Its contract with us prohibits it from using your data to train its models. This processing takes place outside the UK and the EU, under the safeguards described in Section 6.
Our hosting provider, which stores the data for us in the European Union.
ElevenLabs, Twilio and Meta, only when you ask Mucka about your email by voice, on a phone call or over WhatsApp. The parts Mucka reads out or sends to you are processed by ElevenLabs (voice), Twilio (phone calls) and Meta (WhatsApp) to deliver that answer to you. If you have turned on WhatsApp reminders, some suggestions from your email, such as an urgent reply waiting for approval, are sent to you on WhatsApp too.
Your accounting software (such as Xero, QuickBooks, FreeAgent or Sage), if you have connected it: when you approve adding a supplier invoice from an email, we send its details, such as the supplier, total, VAT and date, to your account there.

How long we keep it. We keep Gmail data only while Gmail is connected to Mucka. When you disconnect Gmail in Mucka or close your Mucka account, we delete it from our systems straight away and withdraw Mucka's access at Google. If you remove Mucka's access from your Google Account instead, Mucka deletes its copy the next time it checks your mailbox, usually within a few minutes. Any remaining copies in our backups or with our AI provider are removed within 30 days.

What we delete: your stored emails and attachments, the email text on customer records, summaries, suggestions and receipt copies you have not approved, and Google's access keys.

What we keep, because it is your business's own record rather than a copy of your mailbox: anything you approved. That means replies you sent, details you saved to a customer or job (such as a phone number, address or key safe code), payments you recorded, and supplier bills you added to your accounting software along with the receipt behind them. These are kept as described in Section 10. Draft replies Mucka saved in your Gmail stay there until you delete them.

Staying in control. You can disconnect Gmail at any time in Mucka under Settings → Connections → Integrations → Email → Disconnect. You can also remove Mucka's access from your Google Account at https://myaccount.google.com/permissions, which stops Mucka reading or sending your email straight away. Either way, your Gmail data is deleted as described above.

5.3 Our Limited Use commitments

These commitments apply to all data we receive from Google APIs, including Gmail data:

We use it only to provide and improve the user-facing features you have enabled in Mucka.
We do not transfer it to anyone else except as needed to provide or improve those features, for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets with your consent.
We do not use it for advertising, and we never sell it.
We do not allow humans to read it except with your explicit consent (for example, when you ask our support team to look at a particular email), where it is necessary for security purposes such as investigating abuse, or where it is required by law.
We do not use it to develop, improve or train generalised or non-personalised AI or machine learning models, and our AI providers do not either.

6. International Data Transfers

Some of our service providers (including Twilio, Mailchimp and ElevenLabs) are based in the United States. Where we transfer personal data outside the United Kingdom, we ensure that appropriate safeguards are in place, including:

Transfers to countries that have received a UK adequacy decision from the Secretary of State
The UK International Data Transfer Agreement (UK IDTA) or the UK Addendum to the EU Standard Contractual Clauses
Other legally recognised transfer mechanisms

Audio from calls answered by the AI receptionist is processed by ElevenLabs in the United States. ElevenLabs' US entity is certified under the UK Extension to the EU-US Data Privacy Framework, which the UK government recognises as providing an adequate level of protection for personal data transferred from the UK. The UK IDTA described above continues to apply to our other US-based providers.

You may request further details about the safeguards we use for international transfers by contacting us at privacy@mucka.ai.

7. Your Rights and Choices

Under UK GDPR, you have the following rights in relation to your personal data:

Right of access: to request a copy of the personal data we hold about you
Right to rectification: to request that we correct inaccurate or incomplete data
Right to erasure: to request that we delete your personal data, subject to certain exceptions
Right to restrict processing: to request that we limit how we use your data
Right to data portability: to request a copy of your data in a structured, commonly used, machine-readable format
Right to object: to object to processing based on legitimate interests, including direct marketing
Right to withdraw consent: where we process your data based on consent (including marketing consent), you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal

To exercise any of these rights, contact us at privacy@mucka.ai. We will respond within one month of receiving your request, as required by UK GDPR.

If you are dissatisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Data Security

We implement technical and organisational safeguards to protect your data, including:

Encryption (in transit and at rest)
Secure authentication and access controls
Regular security assessments and monitoring

However, no method of transmission over the internet is 100% secure.

9. Cookies and Tracking

We use cookies and similar technologies for:

Essential cookies: required to operate the service
Analytics cookies: to understand how our site is used
Preference cookies: to remember your settings
Advertising cookies: set by Google Ads and the Meta Pixel, so we can measure which adverts brought people to us. These are only set if you accept non-essential cookies.

You can manage cookie preferences in your browser settings.

10. Data Retention

We retain your personal data for as long as your account is active and for the following periods after account closure:

Account and service data: for up to 12 months after account closure, unless a longer period is required by law
Marketing consent records: for 24 months after account closure or withdrawal of consent, to demonstrate compliance
Financial and transaction records: as required by applicable tax and accounting legislation (typically 6 years under HMRC requirements)
End-customer data processed on behalf of tradespeople: deleted or returned in accordance with our data processing terms upon termination of the tradesperson's account
Gmail data: deleted from our systems as soon as you disconnect Gmail or close your account, or within minutes of you removing Mucka's access from your Google Account, with any remaining copies in backups or with our AI provider removed within 30 days. Anything you approved from an email, such as a sent reply or a detail saved to a job, is kept as part of your account records. See Section 5.2.

You can request data deletion at any time by contacting privacy@mucka.ai.

11. Children's Privacy

Mucka is designed for business operators and their authorised employees. The platform is not directed at children, and we do not knowingly collect personal data from anyone under the age of 13. If you believe a child has provided personal data to us, please contact privacy@mucka.ai and we will delete it.

12. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or through the service. We encourage you to review this policy periodically.

13. Contact Us

For privacy-related enquiries, contact us at:

Email: alright@mucka.ai
ICO Registration Reference: ZC023304