Privacy policy
Last updated: 7 October 2026
Mova is a task and project management tool run by Munich Ventures at mova.munich.ventures. This policy explains what personal data Mova holds, why, who sees it and how to ask for it to be changed or removed.
Who can use Mova
Mova is not open to the public. An account exists only for a person an administrator has invited, or one the company's HR system has created. There is no public sign-up, and nobody can create an account by signing in with Google.
What we collect
We hold the following about the people who use Mova.
- Account details: name, email address, username, job title, a profile picture if you upload one, and your role and project memberships.
- Your password, stored only as a salted hash. We cannot read it.
- Your work: the issues, comments, documents, files, labels and views you create, and the activity trail of who changed what and when.
- Sign-in records: your session, the IP address and browser details attached to it, and, if you use Google sign-in, your Google account identifier.
- Notifications and the emails Mova sends you about your work.
- For employees whose accounts come from the company's HR system (People Munich): name, email address, job title, whether you still work here, and the dates and type of approved leave, which Mova shows as your availability.
- Connected apps: if you connect an AI assistant or another tool to Mova, the access token that lets it act as you.
Signing in with Google
If you choose "Continue with Google", Google tells Mova your email address, your name and a permanent identifier for your Google account. The request asks for the openid, email and profile scopes and nothing else.
Mova uses that information for one purpose: to match you to an account that already exists, or to an invitation sent to you, and sign you in. It does not read your mail, contacts, calendar, Drive files or any other Google data, and it does not create an account for an address that was not invited.
We do not sell this data, share it for advertising, or use it to train models. Mova's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
How we use it
- To sign you in and keep you signed in.
- To run the product: show you and your colleagues the work you are on, assign it, and keep a trail of changes.
- To notify you about things that involve you, by email and inside the app.
- To keep the service secure, and to find and fix faults.
We do not use your data for advertising and we do not sell it.
Who sees it
Inside Mova, what others see depends on projects. People on a project see its issues, comments and documents. A project marked private is hidden from administrators who are not on it. Company-wide documents are visible to everyone with an account. Your name, username, title and availability are visible to colleagues you share work with.
Outside Mova, data goes only to the services that run it:
- Our hosting provider, which stores the database and files.
- Our email provider, which delivers the messages Mova sends.
- Google, when you use Google sign-in. The page also loads the Inter typeface from Google Fonts, which means Google receives your IP address when a page loads.
- The company's HR system, People Munich, which sends us the details listed above and receives nothing about your work.
- An AI assistant or other tool, only if you connect it yourself. It can then read and write what you can, and it receives that data under its own provider's terms. You can disconnect it on your profile page at any time.
We disclose data to authorities only when the law requires it.
Cookies
Mova sets the cookies it needs to work: a session cookie that keeps you signed in, a token that protects forms from forgery, and, if you choose "remember me", a longer sign-in cookie. Your browser also stores your theme choice. There are no advertising or analytics cookies.
How long we keep it
We keep your data while your account is open. When someone leaves, an administrator or the HR sync deactivates the account. That removes access and keeps the person's name on the work they did, so the history of an issue still makes sense. Deactivation also revokes any connected apps.
On request we delete or anonymise your account details. Comments and issues you wrote may remain for your colleagues' benefit, attributed to a removed user.
How we protect it
Traffic to Mova uses HTTPS. Passwords are hashed. Uploaded files sit on private storage and open only through a signed, permission-checked link. Access to a project, document or file follows project membership, and access tokens can be revoked by you or an administrator. No system is perfectly secure.
Your choices
You can see and edit your name, title, username, picture and password on your profile page. You can ask us for a copy of the data we hold about you, to correct it, to delete it, or to stop using it in a particular way. Write to the address below. If you are in the European Economic Area, the UK or Switzerland, you also have the legal rights those laws give you, including the right to complain to your data protection authority.
Children
Mova is a workplace tool and is not meant for anyone under 16.
Changes to this policy
When we change this policy we update the date at the top. If the change is significant, we will tell people who use Mova.
Contact
Questions, requests and complaints about your data go to [email protected].