Draft
Privacy policy
Last updated 12 November 2026. This document is still being reviewed and may change before hosted sign-up opens.
This policy covers hosted Murmura (the service at app.murmura.co.uk and the Murmura apps when connected to it) and this website. It does not cover a copy of Murmura that an organisation runs on its own server; ask that organisation.
Who is responsible for your data
Murmura is run by Dusk Engineering Services Ltd, a company registered in England and Wales.
- What you and your colleagues put into Murmura (messages, files, notes, recordings) belongs to your organisation. Your organisation decides what is kept and who sees it, and we handle it on its behalf under our data processing agreement. Questions about that content should go to your organisation first.
- Your account, sign-in and security records, and billing are our responsibility. The rest of this policy is mostly about those.
What we hold
| What | Details |
|---|---|
| Your account | Name, email address, your password stored as a salted scrypt hash (we cannot read it), your two-factor secret and backup codes if you turn two-factor on, and which organisations and workspaces you belong to and in what role. |
| Your profile | Whatever you choose to add in a workspace: handle, picture, job title, pronouns, phone number, status. |
| Content | The messages, replies, reactions, files, notes, polls and call recordings you post, and your drafts, reminders and scheduled messages. |
| Sign-in sessions | For each place you are signed in: the browser or app, IP address, when you signed in and when it was last used. You can see and end these in Preferences. |
| Security records | A log of sign-ins and of administrative actions (for example changing someone's role or exporting data), with the time and IP address. |
| Server logs | For each request to the service: time, IP address, the address requested and the browser or app. |
| Notifications | If you turn notifications on, the address your browser or phone gives us to deliver them to. |
| Billing | For organisations on a paid plan: the plan, its status, and the references our payment provider gives us. Card details go straight to the payment provider and never reach us. |
| Emails to us | If you write to us, your email address and what you send. |
Why we use it
- To provide Murmura to you and your organisation: signing you in, delivering messages, sending account emails such as password resets. The legal basis is our contract with your organisation and with you.
- To keep it secure and stop abuse: sessions, security records, server logs and rate limits. The legal basis is our legitimate interest in running a safe service.
- To meet legal duties, such as keeping tax records of payments.
We do not sell your data, show advertising, or use your content to train machine-learning models.
Cookies and similar
The app sets only the cookies it needs to work: one that keeps you signed in (for up to 30 days), one that remembers which workspace you last opened, and short-lived ones while you sign in through single sign-on or accept an invitation. Your display preferences are kept in your browser's own storage.
This website sets no cookies. Neither the website nor the app uses analytics or advertising trackers.
Who can see your data
- People in your workspaces see what you post in the rooms and conversations they are part of, and your profile.
- Your organisation's owners and admins manage accounts, can see the security log, and can export everything in the organisation's workspaces. That export includes private rooms and direct messages. They can also set how long messages are kept, and can place an account on legal hold so its messages cannot be deleted.
- Our staff can reach the servers to run and repair the service, and look at an organisation's content only when that is needed to fix a fault or deal with a report, or when the law requires it.
- The companies that help us run Murmura, listed on the sub-processors page.
- Authorities, only when the law requires it. Where we are allowed to, we will tell the organisation concerned.
Some things worth knowing about how Murmura works:
- Calls go directly between the people in them where the network allows, and otherwise pass through our relay server. We do not record calls. A call is only recorded if someone in it presses record, and the recording is then posted to the room like any other file.
- When someone posts a link, our server fetches that page to show a preview. The site sees our server's address, not yours.
- Notifications travel through the notification service of your browser or phone maker (for example Apple, Google or Mozilla). Browser notifications are encrypted so that service cannot read them. Phone app notifications carry a short heading, such as who a message is from, but not the message itself, which shows as "New message".
Where it is kept
Hosted Murmura runs on servers in the United Kingdom, and that is where accounts, content and backups are stored. If a provider we use handles data outside the UK, we make sure a lawful safeguard is in place first.
How long we keep it
| What | How long |
|---|---|
| Content | Until you or an admin deletes it, your organisation's retention rules remove it, or the organisation is deleted. |
| Your account and profile | Until you delete your account or your organisation removes it. Your messages then stay in the conversations they were part of, shown as written by "Deleted user". |
| Sign-in sessions | Until you sign out, or 30 days after you signed in. Your organisation can set a shorter time. |
| Security records | 12 months. |
| Server logs | 14 days. |
| Backups | Up to 30 days. Anything deleted from the service is gone from backups within that time. |
| Payment records | Six years, as UK tax law requires. |
Your choices and rights
- See and take a copy: Preferences has "Download my data", which gives you your profile and everything you have posted.
- Correct: change your name and profile in Preferences. To change the email address you sign in with, ask your organisation's admins or write to us.
- Delete: delete your account from Preferences. If your organisation has put your account on legal hold, it cannot be deleted until the hold is lifted.
- Object or restrict: you can ask us to stop or limit a use of your data.
For content that belongs to your organisation, ask your organisation's admins first; we will help them respond. For anything else, write to info@duskengineering.services. We reply within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Children
Murmura is for use at work and is not meant for anyone under 16.
Changes
If we change this policy in a way that matters, we will say so in the app or by email before the change applies. The date at the top shows when it last changed.
Contact
Dusk Engineering Services Ltd, info@duskengineering.services.