Privacy Policy

mwen.io (“mwen”, “we”, “us”, “our”) operates the website at mwen.io and the mwen browser extension (together, the “Service”).

For the purposes of the GDPR, mwen.io is the data controller for any personal data processed in connection with this website. For PIPEDA and Law 25, mwen.io is the organisation accountable for the personal information under its control. For the purposes of the Jamaica Data Protection Act 2020 and the Barbados Data Protection Act (Cap. 308D), mwen.io is the data controller responsible for personal data processed in connection with the Service.

Person responsible for the protection of personal information (Law 25 / PIPEDA): The person accountable for privacy compliance at mwen.io can be reached at privacy@mwen.io.

The mwen browser extension stores all identity credentials exclusively on your device, encrypted with AES-256-GCM. We do not collect, transmit, or retain your credentials. We have no user accounts and no analytics pipeline. The only personal data we may hold about you is your email address if you subscribe to our newsletter.

This policy explains in full what data we process, why, on what legal basis, and what rights you have. We are required by law to provide this information and we have written it in plain language.

We process personal data only in the following limited circumstances:

This website does not use tracking cookies, advertising pixels, third-party analytics scripts, or device fingerprinting. We do not monitor your browsing behaviour on or off this website.

We do not sell, share, or disclose your personal information for cross-context behavioural advertising purposes. There is no “sale” of personal information as defined under the CCPA/CPRA.

We do not sell, rent, or trade your personal information. We share data only in the following circumstances:

• Hosting infrastructure: Our website is served via third-party cloud infrastructure providers. Server log data passes through their systems. These providers act as data processors under agreements that require them to protect your data.
• Newsletter delivery: If you subscribe to our newsletter, your email address is processed by our email service provider acting as a data processor.
• Legal obligations: We may disclose data if required by law, court order, or governmental authority. We will notify you where legally permitted to do so.

Our hosting infrastructure and email service provider may process data in countries outside the European Economic Area (EEA), outside Canada, and outside Quebec. Where this occurs:

• For transfers from the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other appropriate safeguards under GDPR Chapter V.
• For transfers outside Canada, we ensure that the recipient provides comparable protection to that required under PIPEDA. Please note that personal information transferred to a foreign country may be accessible to courts, law enforcement, and national security authorities of that country under its laws.
• For transfers outside Quebec, we conduct a privacy impact assessment (PIA) as required by Law 25 and ensure a written agreement is in place providing adequate protection before any transfer occurs.
• For transfers of personal data outside Jamaica, we ensure appropriate safeguards are in place as required by the Jamaica Data Protection Act 2020 (ss. 45–50), including that the recipient country or organisation provides a level of protection essentially equivalent to that afforded under the DPA 2020.
• For transfers of personal data outside Barbados, we ensure appropriate safeguards are in place as required by the Barbados Data Protection Act (Cap. 308D, ss. 42–47), including that the recipient provides an adequate level of protection or that appropriate contractual safeguards are in place.

You may request details of the safeguards in place for international transfers by contacting us at privacy@mwen.io.

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law:

• Newsletter email addresses: Retained until you unsubscribe or submit a deletion request, whichever comes first. Deleted within 30 days of that event.
• Server logs: Retained for up to 30 days, then permanently deleted.

When retention periods expire, data is securely deleted or anonymised. We do not retain personal data “just in case.”

We do not make any decisions about you based solely on automated processing. We do not profile you. No decision with legal or similarly significant effect is made about you through automated means.

Depending on where you live, you have the following rights over your personal data. Where a right applies to you is noted in brackets. In practice, because we hold very little data about most users, many of these rights will be satisfied simply by confirming we hold nothing beyond server logs.

The CARICOM Model Privacy Bill and the OECS Data Protection Framework are model instruments that have influenced domestic legislation in the Caribbean. They are not directly binding on mwen.io, but the rights they contemplate are substantively covered by the Jamaica DPA 2020, Barbados DPA, and GDPR entries above. If you are in a CARICOM or OECS member state that has enacted its own data protection legislation, you may have additional rights under that law; the relevant national authority is your first point of contact.

To exercise any of these rights, contact us at privacy@mwen.io. We will respond within 30 days (or within the timeframe required by applicable law). We do not charge a fee for reasonable requests. For CCPA requests, you may also designate an authorised agent to submit a request on your behalf.

We apply technical and organisational measures appropriate to the risk to protect the personal data we hold. This includes encrypted connections (TLS), access controls on any data stores, and minimal data collection by design.

In the event of a personal data breach that presents a real risk of significant harm to you, we will notify you directly in accordance with our obligations under GDPR (Art. 34), PIPEDA (s. 10.1), and Law 25 (s. 3.5), without undue delay. We maintain an internal register of confidentiality incidents as required by Law 25 (s. 3.8).

Where the Jamaica Data Protection Act 2020 applies, we will also notify the Office of the Information Commissioner (OIC) within 72 hours of becoming aware of a breach, and notify affected individuals directly where the breach is likely to result in high risk to their rights and freedoms (Jamaica DPA 2020 ss. 36–37).

Where the Barbados Data Protection Act (Cap. 308D) applies, we will notify the Data Protection Commissioner of Barbados within 72 hours of becoming aware of a breach, and notify affected individuals directly where required (Cap. 308D ss. 37–38).

You have the right to lodge a complaint with your local supervisory authority if you believe we have not handled your personal data in accordance with applicable law. Relevant authorities include:

• EU / EEA: Your national data protection authority. A list is available at edpb.europa.eu.
• Canada: Office of the Privacy Commissioner of Canada (OPC) — priv.gc.ca.
• Quebec: Commission d'accès à l'information du Québec (CAI) — cai.gouv.qc.ca.
• California: California Privacy Protection Agency (CPPA) — cppa.ca.gov.
• Jamaica: Office of the Information Commissioner (OIC) — oic.gov.jm. The OIC supervises compliance with the Jamaica Data Protection Act 2020.
• Barbados: Data Protection Commissioner of Barbados — dataprotection.gov.bb. The Commissioner supervises compliance with the Barbados Data Protection Act (Cap. 308D).
• African Union / Malabo Convention: The African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) entered into force in June 2023 and is binding on its 16 ratifying member states. However, it operates through domestic implementing legislation in each state. If you are in a ratifying state that has enacted implementing law, your complaint should be directed to that state's national data protection authority. No pan-African supervisory body exists for individual complaints at this time.
• CARICOM / OECS member states: The CARICOM Model Privacy Bill and OECS Data Protection Framework are model instruments, not binding law. Rights arise from the domestic legislation of each member state. If you are in a CARICOM or OECS country that has enacted data protection law, your complaint should be directed to the relevant national authority.

We would always prefer the opportunity to address your concerns directly first — please contact us at privacy@mwen.io before filing a formal complaint.

The full source code of the mwen extension, protocol library, and SDK is publicly available on GitHub under the Apache 2.0 licence. The privacy claims in this policy about how the extension operates can be verified by reviewing the code directly.

We will update this policy when our practices change or when required by law. Material changes will be notified to newsletter subscribers by email. The effective date at the top of this page will always reflect the most recent revision. We will not apply material changes retroactively without providing prior notice.

For any privacy-related queries, requests to exercise your rights, or complaints, contact our privacy team: