How we handle your information

Who we are

UmmahUp is committed to protecting your privacy. UmmahUp is powered by MEBIGX SHPK. We are the data controller for the personal information collected through this website.

For privacy questions, contact us at: [email protected]

If you need the full registered address, please email us. We will provide it for legitimate legal or regulatory purposes.

What we collect

We keep data collection to the minimum needed to run the waitlist and improve the site:

• Waitlist information: your email address and related waitlist details needed to send updates and honor your preferences.
• Technical information: IP address, browser details, and timestamps. This is used for security, abuse prevention, and diagnosing issues.
• Cookies and similar technologies: essential cookies required for the site to work, and analytics cookies if you consent to them.
• Usage data: page views and interactions, only when analytics consent is granted.

Is providing information mandatory?

You do not have to give us any personal information to browse the site. Providing an email address is voluntary, but required to join the waitlist. If you do not provide an email, we cannot add you to the waitlist or send updates.

Some technical information (such as an IP address and browser details) is automatically collected when you use the site. Essential cookies and local storage are also required for the site to work. You can refuse analytics cookies through the cookie banner.

How we use your information

We use your information only for the following purposes:

• To send you waitlist and product-related updates by email.
• To confirm your email address and welcome you.
• To process unsubscribe and resubscribe requests.
• To keep the service secure and prevent abuse.
• To understand how the site is used, with your consent where required.
• To comply with legal obligations.

Legal basis for processing

Where data protection law requires a legal basis, we rely on:

• Consent: for sending waitlist updates and for analytics cookies where required.
• Legitimate interests: for keeping the site secure, preventing fraud, and understanding aggregated site usage.
• Performance of a service: for operating the waitlist and delivering emails you asked for.

Analytics and tracking tools

We use Google Analytics 4 to understand how visitors use our website. When you consent to analytics, GA4 may collect:

• Page views and session duration.
• Device and browser information.
• Your IP address and approximate location.
• Interactions with pages and elements.

We use Google Consent Mode to respect your choices. Analytics is only loaded when you grant consent, and you can withdraw consent at any time through the cookie banner or the “Cookie preferences” link in the footer. Google operates under the EU-U.S. Data Privacy Framework (DPF); its privacy practices are covered by Google's own policies.

Cloudflare Web Analytics

We use Cloudflare Web Analytics to measure essential, aggregate site performance and traffic metrics, such as page load times and overall visitor counts. Cloudflare Web Analytics operates without cookies, without local storage, and without any personal tracking identifiers. It does not fingerprint visitors and processes zero personally identifiable information (PII).

Cookies and analytics

We use a small number of cookies:

• Essential cookies and local storage: these are needed for the cookie consent banner, the waitlist form, and remembering your region preference. They cannot be turned off.
• Analytics cookies: we use an analytics provider to understand how the site is used, but only load it after you grant consent. In some regions you can opt out; in others you must opt in.

While Google Analytics 4 requires your consent before it loads, Cloudflare Web Analytics is cookieless and first-party. It runs by default, without requiring consent, for the purposes of security, traffic measurement, and platform stability. This applies consistently across all regions, including the European Union and the European Economic Area (EU/EEA), because it does not use cookies, local storage, or any personal identifier.

You can change your choices at any time using the cookie banner, the “Cookie preferences” link in the footer, or the Cookie Policy.

Who we share data with

We do not sell your personal information. We share data only with service providers that help us operate the site, store data, send emails, provide analytics, and keep the service secure. We only share the minimum needed, and each provider is contractually bound to protect it.

International data transfers

Some of our service providers are based in the United States, the European Economic Area, and other countries. When your personal data is transferred internationally, we use appropriate safeguards, such as standard contractual clauses and adequacy decisions, to protect your information.

Automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects. If we ever introduce such processing, we will tell you first.

How long we keep your data

We keep personal data only as long as necessary:

• Waitlist information: until you unsubscribe or request deletion.
• Cookie preferences: 12 months, then we ask again.
• Coarse location estimate: 24 hours, then deleted.
• Session call-to-action clicks: until the browser is closed.
• Analytics data: 26 months (Google Analytics default) or until you clear cookies or withdraw consent.
• Cloudflare Web Analytics: non-persistent, aggregate-only performance metrics (no persistent user identifiers retained).
• Rate-limit and security data: up to one hour from the last attempt, then automatically deleted.
• Server logs and security data: kept for a limited period and then deleted.

Your rights

Depending on where you live, you may have rights such as:

• Access to the personal information we hold about you.
• Correction of inaccurate information.
• Deletion of your personal information.
• Data portability.
• Objection to or restriction of certain processing.
• Withdrawal of consent at any time.
• Unsubscribing from emails through the link in any email we send.
• The right to lodge a complaint with the competent data protection authority. For our processing, the relevant authority is the Information and Privacy Agency (IPA).

To exercise any of these rights, email us at [email protected]. We will respond as promptly as the law allows.

Lodging a complaint

If you believe your rights have not been respected, you have the right to lodge a complaint with the competent data protection authority. For our processing, the relevant authority is the Information and Privacy Agency (AIP). Its contact details are available on the AIP's official website.

EU residents: you may also lodge a complaint with your national data protection authority or the European Data Protection Board.

US residents: you may file complaints with the Federal Trade Commission or your state's Attorney General. California residents may also contact the California Privacy Protection Agency.

Before filing a formal complaint, we encourage you to contact us first at [email protected]. Most issues can be resolved directly within 30 days.

Data breaches

In the event of a personal data breach, we will:

1. Assess the risk — evaluate the likelihood and severity of risk to your rights.
2. Notify the authority — report to the competent data protection authority within 72 hours of discovery, where required by law.
3. Notify you — without undue delay when a breach is likely to result in a high risk to your rights, including the nature of the breach and the measures taken.

For breach-related inquiries, contact: [email protected].

Data protection

We use industry-standard administrative and technical measures to protect your personal information. No online system is completely secure, and we cannot guarantee absolute security. We do not link analytics data to your waitlist email address.

Children's privacy

UmmahUp is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us so we can delete it.

Changes to this policy

We may update this privacy policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. If the changes are significant, we will notify you by email or through a notice on the site.

Contact us

Questions, concerns, or requests about this policy? Reach us at: [email protected]