Microcommit

Privacy Policy

Last updated: 5 December 2025

This Privacy Policy describes how Conjecture Ltd ("we", "us", or "our") collects, uses, and shares your personal data when you use the microcommit.io website (the "Service").

We are committed to protecting your privacy and processing your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (GDPR), and other applicable data protection laws.

1. Data Controller

The data controller responsible for your personal data is:

  • Company: Conjecture Ltd
  • Contact: Eva Behrens
  • Address: 201 Borough High St., London SE1 1JA, United Kingdom
  • Email: eva@conjecture.dev

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

  • Email address
  • Name
  • Profile picture (if provided via authentication services)

2.2 Authentication Data

Depending on how you sign in, we may collect:

  • Google OAuth: Your Google account ID and profile information
  • Email OTP: Your email address and one-time passwords (temporarily stored)

2.3 Usage Data

When you use our Service, we collect:

  • Your responses to actions
  • Subscription and communication preferences
  • Initiatives you've followed

2.4 Technical Data

We automatically collect certain technical information:

  • IP address
  • Browser type and version
  • Device information
  • Pages visited and interactions with the Service
  • Date and time of visits

3. How We Use Your Information

We use your personal data for the following purposes:

  • Service Delivery: To create and manage your account, authenticate you, and provide the core functionality of the Service
  • Communication: To send you weekly actions, service updates, security alerts, and account notifications
  • Initiative Participation: To facilitate your participation in initiatives' actions and share your responses with the relevant initiatives
  • Analytics: To understand how users interact with our Service and improve its functionality
  • Security: To detect, prevent, and address technical issues, fraud, or security threats
  • Legal Compliance: To comply with applicable laws and regulations

4. Legal Basis for Processing

Under the UK GDPR and EU GDPR, we process your personal data on the following legal bases:

  • Contract Performance: Processing necessary to provide you with the Service, including account creation, authentication, and delivering weekly actions
  • Legitimate Interests: Processing for analytics, security, and service improvement, where our interests do not override your fundamental rights
  • Consent: Where you have given explicit consent, such as for marketing communications. You may withdraw consent at any time
  • Legal Obligation: Where processing is necessary to comply with legal requirements

5. Data Sharing and Third Parties

5.1 Third-Party Initiatives

Important: microcommit.io is a service that connects supporters with various initiatives. In addition to Conjecture Ltd, independent third-party initiatives can register on our Service and create actions for supporters to respond to.

When you follow an initiative through our Service, we may share the following information with that initiative:

  • Your name
  • Your email address
  • Your responses to their actions (including any comments or feedback you provide)

Third-party initiatives are independent data controllers. Each initiative is responsible for their own use of your data in accordance with their own privacy policies and applicable laws. We do not control how these initiatives use your data once it has been shared with them.

Before following any initiative, we strongly recommend that you:

  • Review the initiative's privacy policy
  • Understand how they will use your personal data
  • Contact the initiative directly if you have questions about their data practices

You can unfollow an initiative at any time through your account settings. However, data that has already been shared with an initiative may be retained by them according to their own data retention policies. To request deletion of your data from a specific initiative, you should contact that initiative directly.

5.2 Third-Party Service Providers

We use the following third-party services to operate our Service:

  • Google OAuth: For user authentication. Google's privacy policy applies to data they collect: policies.google.com/privacy
  • Gmail: For sending transactional and notification emails
  • PostHog: For analytics and understanding how users interact with our Service. PostHog's privacy policy applies: posthog.com/privacy

5.3 Legal Requirements

We may disclose your personal data if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

6. International Data Transfers

Your personal data may be transferred to and processed in countries outside the United Kingdom and European Economic Area, including the United States, where some of our service providers are located.

When we transfer your data internationally, we ensure appropriate safeguards are in place, including:

  • Transfers to countries with adequacy decisions from the UK or EU
  • Standard Contractual Clauses approved by the UK Information Commissioner's Office or European Commission
  • Other legally approved transfer mechanisms

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including:

  • Account data: Retained while your account is active and for 30 days after account deletion request
  • Authentication tokens: Email OTPs expire after 10 minutes
  • Usage data: Retained while your account is active
  • Analytics data: Retained in anonymized form for service improvement

We may retain certain data for longer periods where required by law or for legitimate business purposes such as fraud prevention.

8. Your Rights

Under the UK GDPR and EU GDPR, you have the following rights regarding your personal data:

  • Right of Access: You may request a copy of the personal data we hold about you
  • Right to Rectification: You may request correction of inaccurate or incomplete data
  • Right to Erasure: You may request deletion of your personal data (subject to legal retention requirements)
  • Right to Restrict Processing: You may request that we limit how we process your data
  • Right to Data Portability: You may request a copy of your data in a structured, machine-readable format
  • Right to Object: You may object to processing based on legitimate interests or for direct marketing
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, please contact us at eva@conjecture.dev. We will respond to your request within one month.

Right to Lodge a Complaint

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with a supervisory authority:

  • UK: Information Commissioner's Office (ICO) - ico.org.uk
  • EU: Your local data protection authority

9. Cookies and Tracking Technologies

We use cookies and similar technologies to:

  • Maintain your authentication session
  • Remember your preferences
  • Analyse usage patterns through PostHog

You can control cookies through your browser settings. However, disabling certain cookies may affect the functionality of the Service.

10. Children's Privacy

Our Service is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If you become aware that a child has provided us with personal data, please contact us and we will take steps to delete such information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

For significant changes that affect how we process your personal data, we will provide notice through the Service or by email before the changes take effect.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

  • Data Protection Contact: Eva Behrens
  • Email: eva@conjecture.dev
  • Address: 201 Borough High St., London SE1 1JA, United Kingdom

For general enquiries, you can also reach us at contact@microcommit.io.