1. Who we are
Mobinars is operated by MOBINARS.COM Spółka z ograniczoną odpowiedzialnością (the "Controller"), with its registered office at ul. Glebowa 46A, 61-312 Poznań, Poland. The company is entered in the Register of Entrepreneurs of the National Court Register kept by the District Court Poznań — Nowe Miasto i Wilda in Poznań, 8th Commercial Division, under KRS 0001261884, NIP 7822973531, REGON 545526250.
Contact: privacy@mobinars.com, or by post at the address above.
2. What we collect
Account data
- Email address (required to sign in)
- Display name and avatar URL (optional, supplied by you or imported from Google sign-in)
- Phone number, if you add one to receive SMS reminders — verified by a one-time code before we store it
Webinar content you create
- Webinar titles, descriptions, scheduled times, landing-page configuration
- Recordings (audio + video) when you choose to record a session
- Chat messages and pinned messages exchanged during a session
- Co-host invitations and acceptance state
Audience and signup data
- Email addresses of attendees who register for your webinars
- Webinar event logs (joined, left, asked a question) used to power host analytics
- Meta advertising attribution cookies (
_fbc,_fbp) when an attendee opts in via the cookie banner
Operational data
- Server access logs (IP, user agent, timestamp) for security and abuse detection
- Usage events and session recordings of the dashboard (pages, clicks, scrolls and on-screen interface text; typed text and attendee data are masked) when you allow product analytics in the cookie banner; usage events on this website under the same choice
- Edge function invocation logs for debugging
- Subscription and billing records when you upgrade to a paid plan (handled by Dodo Payments)
3. Why we collect it
- Service delivery — running webinars, sending reminder emails, processing recordings
- Account security — authentication, abuse detection, fraud prevention
- Billing — invoicing and payment processing for paid plans
- Product analytics — usage statistics and session recordings to find what is hard to use; we do not sell personal data
- Legal compliance — responding to lawful requests, meeting tax / accounting obligations
4. Lawful bases (GDPR Art. 6)
- Contract — processing necessary to provide the service you signed up for
- Legitimate interests — security, abuse prevention, basic product analytics
- Consent — product analytics and session recordings, marketing analytics, advertising attribution cookies (you can withdraw at any time)
- Legal obligation — accounting records, lawful access requests
5. Sub-processors
We rely on the following sub-processors to operate the service. Each is contractually bound by a Data Processing Agreement and processes data only on our instructions.
- Cloudflare, Inc. (US, global edge) — application hosting, DNS, the primary database, and R2 object storage for recordings
- Hetzner Online GmbH (Germany) — LiveKit media servers (real-time audio/video)
- Resend (US) — transactional email delivery
- Dodo Payments — payment processing and billing, as merchant of record
- Google LLC (US) — Firebase Authentication: sign-in and account identity for every account, however you sign in
- Meta Platforms, Inc. (US) — advertising attribution, only when an attendee consents to marketing cookies
- Expo (650 Industries, Inc.) (US) — relays push notifications to the mobile app
- Functional Software, Inc. (Sentry) (US) — error and crash reporting for the web apps
- Mixpanel, Inc. (US; data stored in the EU) — product analytics and session recordings, only when you allow product analytics
6. International transfers
Some sub-processors are based outside the European Economic Area. Where this happens we rely on the EU Standard Contractual Clauses (2021) and, where applicable, supplementary measures such as encryption in transit and at rest.
7. Retention
We retain personal data only as long as necessary for the purposes above:
- Account data — for the life of your account; deleted within 30 days of account deletion
- Recordings — for the replay window of the host's plan, counted from the end of the session: 7 days on Free, 12 months on Creator, and no fixed limit on Business. Sooner if you delete the recording or your account. Once the window closes the replay is deleted permanently and cannot be restored.
- Attendee signups and webinar event logs — up to 24 months after the webinar ends, or until the hosting account is deleted
- Server and edge logs — up to 30 days
- Billing records — 5 years after the end of the tax year, as required by Polish accounting law
8. Your rights
Under GDPR you have the right to:
- Access — request a copy of all personal data we hold about you
- Rectification — correct inaccurate data
- Erasure — delete your account and associated personal data
- Portability — receive a machine-readable export of your data
- Restriction / objection — limit how we process your data
- Withdraw consent — for any processing that relies on consent
- Lodge a complaint — with your local supervisory authority (in Poland: UODO, uodo.gov.pl)
Account holders can self-serve access (export) and erasure (delete account) from Settings → Privacy. For all other requests, email privacy@mobinars.com. We respond within 30 days.
9. Cookies
We use a strict minimum of cookies. Strictly necessary cookies (session, CSRF) load without consent. Analytics and advertising cookies load only after you accept them in our cookie banner. You can change your choice at any time via the "Cookie preferences" link in the footer.
10. Security
We follow the practices documented on our Security page, including encryption in transit (TLS 1.2+), encryption at rest, role-based access, and audit logging.
11. Children
Mobinars is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact privacy@mobinars.com and we will delete it.
12. Changes to this policy
We will post material changes here and, where the change affects how we process your data, notify account holders by email at least 30 days before the change takes effect.