Privacy Policy

1. Who we are

Meltylum (meltylum.com) provides free icebreaker tools for remote teams. For any privacy question, request, or complaint, contact us through our contact page - we usually reply within 2 business days.

2. What we collect

We collect and process only the minimum data required to operate the tools, prevent abuse, and respond to you. No cookies. No advertising. No sale of data.

• Waitlist: email address and signup source. Used to notify you about the bot. Legal basis: consent. One-click unsubscribe in every email.
• Contact: name, email, message. Used to reply. Legal basis: consent and legitimate interest.
• Anonymous analytics: aggregate usage (views, copies, rooms created), coarse country (derived from IP header), device type. No personal identifiers. Legal basis: legitimate interest. Honors DNT. Raw data deleted after 90 days.
• Live vote rooms: room content, votes (tied to a random UUID token stored in your browser localStorage), host control token. Rooms and data auto-expire and delete after ~24 hours.
• Anti-abuse & rate limiting: We process your IP address (provided by Vercel) to compute a one-way cryptographic hash (SHA-256, no salt). This hash is used temporarily to enforce rate limits on room creation, form submissions, and voting. The hash is stored with rooms or in short-lived memory only; it cannot easily be reversed to an IP and is deleted with the associated data. Not used for profiling.

3. Cookies and browser storage

We set no cookies. No consent banner is needed because there is nothing to consent to. We use your browser’s local storage only for strictly functional data:

• Your live-vote token and your own pick per room.
• The host’s room key so refreshing does not lose control.

Clearing your browser storage removes all of it. Our hosting provider (Vercel) measures aggregate visits and performance with cookieless analytics - see section 4.

4. Processors - who else touches data

• Vercel (hosting and analytics): serves the site and measures aggregate visits and web performance. No advertising use.
• Database hosting: stores waitlist emails, contact messages, anonymous counts, and ephemeral live rooms.

We do not sell personal data, we serve no ads, and we share nothing with data brokers. Processors act only on our instructions under their data processing terms.

5. How long we keep it

• Live rooms: deleted automatically about a day after expiry.
• Anonymous statistics: raw rows deleted after 90 days.
• Contact messages: deleted after 12 months.
• Waitlist emails: kept until you unsubscribe (every email includes a one-click unsubscribe) or until the list is retired.

6. Your rights

Wherever you live, you can ask us what we hold about you and request correction or deletion - write via our contact page. Residents of the EU/UK can also complain to their supervisory authority; California residents: we do not sell or share personal information as defined by the CCPA.

7. Children

Meltylum is built for workplace teams, not for children under 13 (or 16 in some jurisdictions). We do not knowingly collect data from children; if you believe a child sent us personal data, contact us immediately and we will delete it.

8. Data controller and contact

Meltylum is operated by its founders in Spain. The data controller is Meltylum. For any privacy request, access, correction, deletion, or complaint, use our contact page. We respond within 2 business days. You can also reach us at privacy@meltylum.com (replies go to the contact system).

EU/UK residents may lodge a complaint with your local data protection authority. California residents: we do not sell or share your personal information.

9. Security and international transfers

We implement reasonable technical and organizational measures to protect your data (encryption in transit, access controls, automatic deletion). Data may be processed in the United States by our processors (Vercel and database provider) under standard contractual clauses or equivalent safeguards that meet GDPR standards.

10. Changes to this policy

We may update this Privacy Policy as our tools or legal obligations evolve. We will update the “Last updated” date at the top of this page. Material changes will be communicated via the site or contact methods where appropriate. Your continued use after changes constitutes acceptance.