This policy explains what happens to personal data when you use the Mountin website at mountin.ai. The Mountin platform runs in your company's workspace at <workspace>.mountin.ai. What the platform does with data is governed by the agreement between Mountin and the company that holds the workspace, not by this policy.
1. Who is responsible
MountinRahul Ravindran PalaparambilGormannstr. 18D10119 Berlin, Germany
Email: rahul@mountin.io
Questions about this policy and requests about your data go to the address above.
2. What this policy covers
The website is a set of static pages: the homepage, the blog, the contact page, the demo booking page and the sign-in page. It sets no cookies of its own, runs no analytics and keeps no user accounts. Personal data reaches us only when you book a demo, write to us or sign in to your workspace, plus the server logs that every website produces. We make no automated decisions about you and build no profiles from website data.
We process personal data under the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The site is for businesses and is not directed at children.
3. Hosting and server logs
The site is served by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, from its network, which includes servers in the EU. Each request produces a log entry with your IP address, the time, the page requested, the referring page and your browser's user agent string. Cloudflare uses these entries to deliver the pages and to keep the site secure, for example to block attacks. We do not store them ourselves.
Fonts, images and scripts are served from the site itself, so loading a page contacts no other provider. All pages are delivered over HTTPS, so what you send to the site, to the booking calendar and to your workspace is encrypted in transit.
Legal basis: our legitimate interest in running a reliable and secure website, Art. 6(1)(f) GDPR. Cloudflare processes the data on our behalf under its data processing addendum, including the EU standard contractual clauses, and is certified under the EU-US Data Privacy Framework.
4. Booking a demo
The demo page offers a booking calendar provided by Google Calendar. The calendar loads only after you choose to show it. When it loads, your browser connects to Google and sends what every web request carries, including your IP address, and Google may set cookies in its own domain. When you book a slot you enter your name, your email address and anything you add in the notes. Google stores the booking in our calendar and emails the invitation to you and to us.
We use the booking to hold the demo and to follow up on it.
Legal basis: for the booking, the steps you ask us to take before a possible contract, Art. 6(1)(b) GDPR; for the connection to Google, your consent, given when you show the calendar, Art. 6(1)(a) GDPR. You can withdraw it by not using the calendar and booking by email instead.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, with Google LLC, USA, as a further processor. Google processes the data under its data processing terms and is certified under the EU-US Data Privacy Framework.
5. Writing to us
When you email us, we keep the message and your contact details to answer it and to handle what follows from it. Our email runs on Google Workspace, provided by Google Ireland Limited as named above, under a data processing agreement.
Legal basis: Art. 6(1)(b) GDPR where the email concerns a contract or a step towards one, otherwise our legitimate interest in answering inquiries, Art. 6(1)(f) GDPR.
6. Signing in
The sign-in page sends the workspace name, your email address and your password straight from your browser to your workspace at <workspace>.mountin.ai. They never pass through the website's servers. From that point on, the agreement between Mountin and the company that holds the workspace applies, with Mountin as the processor acting on that company's instructions.
7. Cookies
The website sets no cookies and stores nothing in your browser. The booking calendar may set Google's cookies once you load it, as described in section 4. Your workspace sets a session cookie on its own domain after you sign in, which the platform agreement covers.
8. Recipients and transfers outside the EU
We share personal data only with the providers named above, which process it on our behalf under Art. 28 GDPR agreements, and with authorities where the law requires it. We do not sell personal data and do not use it for advertising.
Cloudflare and Google may process data in the United States. Both are certified under the EU-US Data Privacy Framework, which the European Commission recognises as providing adequate protection (Art. 45 GDPR), and both also commit to the EU standard contractual clauses (Art. 46 GDPR).
9. How long we keep data
Server logs are handled by Cloudflare as described in section 3; we keep none ourselves.
Demo bookings and emails stay for as long as the conversation runs and, where it leads to a contract, for the term of that contract. Where commercial and tax law requires it, invoices and business correspondence are kept for up to ten years.
We delete or anonymise data once none of these reasons remains.
10. Your rights
Under the GDPR you can ask us for:
- access to the personal data we hold about you (Art. 15),
- correction of inaccurate data (Art. 16),
- erasure (Art. 17),
- restriction of processing (Art. 18),
- a copy of the data you gave us, in a portable format (Art. 20).
Where processing rests on your consent, you can withdraw it at any time with effect for the future (Art. 7(3)).
Right to object
Where we process data on the basis of legitimate interest, you can object for reasons arising from your particular situation (Art. 21). We then stop, unless we can show compelling legitimate grounds that override your interests.
You can also lodge a complaint with a data protection supervisory authority (Art. 77), for example the one for your place of residence or the one responsible for us, the Berlin Commissioner for Data Protection and Freedom of Information (datenschutz-berlin.de).
To exercise these rights, email rahul@mountin.io.
11. Changes
We change this policy when the website or the law changes. The current version is the one on this page, dated at the top.