Mumble Note

GDPR overview

Concrete and reasonably detailed. Section 12.2 of the privacy policy is devoted to EEA residents. It names Narya.ai Inc. as the data controller, with feedback@narya.ai as the contact point, sets out six legal bases (consent, contractual necessity, legitimate interests, legal compliance, public interest and vital interests), and details eight rights: access, rectification, withdrawal of consent, erasure, restriction, portability, objection, and complaint to a supervisory authority, with a link to the EDPB directory. Transfers outside the EEA rely on adequacy decisions under Article 45 or on standard contractual clauses. A separate section covers the California CCPA. Two gaps stand out: no Article 27 EU representative is designated, although the policy expressly addresses EEA residents, and no Data Processing Agreement is published. The policy is dated 15 May 2025 and is governed by California law.

Who owns the data?

Under the Terms of Service, Narya.ai Inc. does not own the Input you upload — audio, text and images remain yours — and you own the Output the service returns, including all intellectual property rights in it. In exchange, you grant the publisher a worldwide, royalty-free, sublicensable licence, in perpetuity, to copy, modify, distribute and create derivative works from your recorded audio, transcription text and related data. That licence covers five stated purposes: delivering the service, maintenance and diagnostics, improving Mumble and its corporate affiliates' products and services, actions you authorise in writing, and legal obligations. Ownership stays with you; the licence you grant over it is broad and permanent.

Reuse rights

Yes. The Terms state that, subject to compliance with them and with applicable law, you may use the Output for any purpose, and that you hold all rights, title and interest in it. No prior permission, fee or attribution is required, so transcripts, summaries, to-do lists and rewritten drafts can be published, shared with clients or fed into other tools freely. The only carve-out is the Materials — the interface, graphics, design, code and software of the service itself — which remain the publisher's property and may not be reused. On the vendor side, the privacy policy lists service delivery, communications, marketing and targeted advertising served inside the app, experience improvement, safety and security, legal compliance, and technology development and research. Audio, pictures and text may be processed by third-party AI providers, and data may be shared with the corporate group, service providers, third-party SDKs and, where legally required, authorities.

Data retention & training

Hosting summary

The privacy policy states that the servers storing personal information related to Mumble are presently located in the United States, and that by using the service you accept transmission and storage there. Data may also be shared with third parties located outside the United States, subject to compliance with applicable cross-border transfer rules. For EEA residents, transfers out of the EEA rely on European Commission adequacy decisions under Article 45 or on standard contractual clauses. The publisher describes technical and organisational safeguards including encryption and desensitisation, while explicitly declining to guarantee that no transmission or storage can ever be compromised. The FAQ adds that notes are stored encrypted in the cloud, that no plain-text version is kept anywhere except on the device, and that on-device models are planned. No hosting region can be chosen by the customer, and no hosting provider is named in the policy; DNS resolution points to Amazon infrastructure in the United States, which is an infrastructure observation rather than a vendor statement.