Privacy notice

1. Who we are

This website is run by the Umbrella Corporation player organization (“Umbrella”, “we”). It is an unofficial, fan‑made project and is not operated by or affiliated with Capcom Co., Ltd. This notice explains how we handle personal information on this site, in the application form, and in the staff sign‑in.

2. What we collect

We collect only what the site needs to work and what you choose to give us. The site does no tracking or analytics, shows no advertising, and sets no optional cookies.

• Application form: the name you go by, your Discord username, the career area you choose, your time zone, anything you write in the optional “Why Umbrella” field, and the time you agreed to this notice.
• Staff sign-in: when someone on Umbrella’s staff signs in with Discord, we store their Discord user ID, display name, username, a link to their profile picture, and their roles in Umbrella’s Discord, including whether they own or administer the server, which decide their access. We never see their Discord password.
• Activity log: the admin panel records each application as it arrives, each decision on it, and every change staff make, with the time and, for staff, their IP address. Visitors’ IP addresses are never recorded there.
• Technical data: Cloudflare, which carries every request to this site and protects it from attacks, and Fly.io, which hosts it, receive your IP address and the details of each request (time, page requested, referring page, and browser type). Our web server’s access log of the same details goes to Fly.io’s log service, for security and troubleshooting. To limit how many applications and sign‑in attempts one connection can make, the site keeps a coded form of your IP address for up to two hours; it cannot be turned back into the address without the site’s secret key. Your IP address is never stored with your application or in your session record.
• Cookies: see section 5 below.

3. Why we collect it

We use your application to review it, to contact you about it on Discord, and to place you with a division. Recruiters are told about each new application, with its details, and about each later status change (who viewed or decided it, and any reason given), in private staff channels on Discord. A copy of the activity log, staff sign‑ins included, is also posted to a private administrators’ channel. Discord hosts those channels under its own privacy policy. Staff sign‑in data is used only to decide who may use the admin panel, and the activity log only to keep a reliable record of decisions and changes.

We rely on your consent (the checkbox on the form) for applications, and on our legitimate interest in running a secure site for server logs, rate limits, and the activity log.

We do not sell information, use it for advertising, or share it outside Umbrella’s recruiting and administration staff, except with the services named in this notice: Cloudflare, Fly.io and Discord.

The public website loads nothing from other companies’ servers: its fonts, images, and scripts all come from our own, delivered through Cloudflare and Fly.io, so no one else learns that you visited. A link to Discord takes you to Discord, which handles your visit under its own privacy policy. In the admin panel, staff profile pictures load from Discord; staff without one see their initials, drawn by the site itself.

4. Storage and retention

Information is stored in the site’s own database and kept only as long as it is needed:

• Applications are deleted 12 months after a recruiter decides on them, or 12 months after they arrive if no decision is made. Their details are removed from the activity log at the same time; only who decided, and when, remains.
• The activity log is kept for 24 months.
• Notifications already posted to Discord are not deleted automatically. We remove them on request (see section 6).
• Staff sign‑in profiles are kept until the person they belong to asks us to remove them.
• Sessions end two hours after your last visit to a page. Your session record holds no IP address or browser details, and is deleted within three hours of your last visit.
• The coded IP address used for rate limits is deleted within two hours.
• Server access logs are not stored by the site itself. Fly.io and Cloudflare keep their logs for their standard retention periods.
• The site and its database run on Fly.io servers in Frankfurt, Germany. Recruitment and activity‑log notifications are posted to Discord, a US company, so those details are processed in the United States. Fly.io and Cloudflare are US companies too, and may process request details there. Each does so under the safeguards set out in its own privacy policy.

5. Cookies

The site sets only strictly necessary cookies: one keeps your session, one protects the application form and the staff sign‑in, and one remembers that you have read the “Your privacy” notice. It does no tracking or analytics and sets no optional cookies. The cookie policy lists every cookie.

6. Your rights

You can ask to see, correct, or delete the information we hold about you, to receive your application in a portable format, or to restrict how we use it. You can withdraw your consent to us processing your application at any time; this does not affect what we did before, and we then delete the application and its Discord notifications. You can also object to our use of server logs, rate limits and the activity log, which rely on our legitimate interest.

Contact the recruiting team on Discord and we will act on the request within 30 days.

7. Contact and concerns

Questions about this notice, and reports of anyone claiming to recruit for Umbrella outside this website, go to the recruiting team on Discord. If you believe we have handled your information badly, tell us and we will put it right. You can also complain to your local data‑protection authority.