Privacy notice and your data rights

1. Who we are

This website is run by the Umbrella Corporation player organization (“Umbrella”, “we”). It is an unofficial, fan‑made project and is not operated by or affiliated with Capcom Co., Ltd. This notice explains how we handle personal information on this site, in the application form and the contact form, in the staff sign‑in, and when we write to you by email.

You can reach us with the contact form or on Discord.

2. What we collect

We collect only what the site needs to work and what you choose to give us. The site shows no advertising and sets no optional cookies, and its visitor statistics use no cookies at all.

Application form: the name you go by, your Discord username, your email address if you give one, the career area you choose, your time zone, anything you write in the optional “Why Umbrella” field, and the time you gave your consent.
Contact form: the name you give, your email address, the topic you choose, your message, and the time you gave your consent.
Email: when we write to you about your application or answer your message, your email address, our emails, and anything you send back.
Staff sign-in: when someone on Umbrella’s staff signs in with Discord, we store their Discord user ID, display name, username, a link to their profile picture, and their roles in Umbrella’s Discord, including whether they own or administer the server, which decide their access. We never see their Discord password.
Activity log: the admin panel records each application as it arrives (without its email address), each decision on it, each message as it arrives (by number and topic only), and every change staff make, with the time and, for staff, their IP address. Visitors’ IP addresses are never recorded there.
Technical data: Cloudflare, which carries every request to this site and protects it from attacks, and Fly.io, which hosts it, receive your IP address and the details of each request (time, page requested, referring page, and browser type). Our web server’s access log of the same details goes to Fly.io’s log service, for security and troubleshooting. To limit how many applications, messages and sign‑in attempts one connection can make, the site keeps a coded form of your IP address for up to two hours; it cannot be turned back into the address without the site’s secret key. Your IP address is never stored with your application, your message, or your session record.
Visitor statistics: Cloudflare Web Analytics counts the pages viewed and measures how quickly they load: the page and the page you came from, your browser and device type, your country, and the page’s loading times. Cloudflare says it uses no cookies or other storage in your browser and does not recognise individual visitors. It does not run at all for visitors in the European Union. Cloudflare also gives us totals of requests, page views and visits for everyone, counted from the requests it carries, with no script in your browser.
Cookies: see section 5 below.

3. Why we collect it

We use your application to review it, to contact you about it on Discord or, if you gave an email address, by email from our mailbox, and to place you with a division. Recruiters are told about each new application, with its details apart from your email address, and about each later status change (who viewed or decided it, and any reason given), in private staff channels on Discord. A copy of the activity log, staff sign‑ins included, is also posted to a private administrators’ channel. Discord hosts those channels under its own privacy policy. Staff sign‑in data is used only to decide who may use the admin panel, and the activity log only to keep a reliable record of decisions and changes.

We use a message from the contact form only to answer it. Staff are told on Discord that a new message has arrived, by its number and topic only; they read it in the admin panel and answer it by email from our mailbox. We use the visitor statistics only to see which pages are read and how quickly they load.

We rely on your consent (the checkbox on each form) for applications and messages, and on our legitimate interest in running a secure site for server logs, rate limits and the activity log, and in knowing which pages are read and how quickly they load, for the visitor statistics.

We do not sell information, use it for advertising, or share it outside Umbrella’s recruiting and administration staff, except with the services named in this notice: Cloudflare, Fly.io, Discord, GitHub and Google, which hosts the mailbox we write from.

Apart from Cloudflare’s visitor‑statistics script, the public website loads nothing from other companies’ servers: its fonts, images, and scripts all come from our own, delivered through Cloudflare and Fly.io. A link to Discord takes you to Discord, which handles your visit under its own privacy policy. In the admin panel, staff profile pictures load from Discord; staff without one see their initials, drawn by the site itself.

4. Storage and retention

Information is stored in the site’s own database and kept only as long as it is needed:

Applications are deleted 12 months after a recruiter decides on them, or 12 months after they arrive if no decision is made. Their details are removed from the activity log at the same time; only who decided, and when, remains.
Messages sent with the contact form are deleted 12 months after they arrive.
The activity log is kept for 24 months.
Each night an encrypted copy of the database is stored with Cloudflare R2 in the European Union, as a backup, and each copy is deleted after 30 days. Information deleted from the site can therefore remain in an encrypted backup for up to 30 more days. Only Umbrella’s administrators hold the key that opens it.
Notifications already posted to Discord are not deleted automatically. We remove them on request (see section 6).
Staff sign‑in profiles are kept until the person they belong to asks us to remove them.
We delete our email exchange with you about an application or a message within 12 months of our last email to you. Deleted emails can stay in Google’s systems for a short time after that.
Sessions end two hours after your last visit to a page. Your session record holds no IP address or browser details, and is deleted within three hours of your last visit.
The coded IP address used for rate limits is deleted within two hours.
Server access logs are not stored by the site itself. Fly.io and Cloudflare keep their logs for their standard retention periods. Cloudflare keeps the visitor statistics in full for 7 days and as a sample of about one visit in ten after that; we can see them for six months.
The site and its database run on Fly.io servers in Frankfurt, Germany. Recruitment and activity‑log notifications are posted to Discord, a US company, so those details are processed in the United States. The mailbox we write from is hosted by Google, a US company, so your email address and our correspondence may be processed there too. Fly.io and Cloudflare are US companies too, and may process request details and visitor statistics there. The nightly backup is made on a temporary GitHub Actions machine, which may run in the United States: it checks and encrypts the copy, sends it to Cloudflare R2, and is then deleted. Cloudflare, Fly.io, Discord, GitHub and Google each take part in the EU–U.S. Data Privacy Framework, with its UK Extension and the Swiss–U.S. framework, which the European Commission recognises as giving personal data adequate protection; the U.S. Department of Commerce lists them at dataprivacyframework.gov.

5. Cookies

The site sets only strictly necessary cookies: one keeps your session, one protects the site’s forms and the staff sign‑in, and one remembers that you have read the “Your privacy” notice. It sets no optional cookies, and its visitor statistics use none. Cloudflare, which carries every request, may set a security cookie of its own if it needs to check that a visitor is not a bot. The cookie policy lists every cookie.

6. Your rights

You can ask to see, correct, or delete the information we hold about you, to receive your application or message in a portable format, or to restrict how we use it. You can withdraw your consent to us processing your application or message at any time; this does not affect what we did before, and we then delete it, its Discord notifications and our email exchange with you. You can also object to our use of server logs, rate limits, the activity log and the visitor statistics, which rely on our legitimate interest. The visitor statistics cannot be linked to you, so we cannot pick out your visits in them; blocking scripts from static.cloudflareinsights.com in your browser stops them.

Contact the recruiting team on Discord or send us a message with the contact form, and we will act on the request within 30 days.

7. Contact and concerns

Questions about this notice, and reports of anyone claiming to recruit for Umbrella outside this website, go to the recruiting team on Discord or the contact form. If you believe we have handled your information badly, tell us and we will put it right. You can also complain to your local data‑protection authority.