Loading
Legal
NextMUN is a non-profit with no advertising and nothing to sell. We collect what running a conference platform actually requires, and nothing beyond it.
In effect from 9 September 2026
NextMUN is built and run by Saad Alarifi, who is the data controller for everything described here. You can reach us at saadalarifi@nextmun.org.
Your account: name, username, email address, password, and optionally a country, a bio, a profile photo, a headline, links and your Model UN experience.
Your applications: every answer you give on a conference's application form, plus any file you upload with it.
Your activity: conferences you view recently, notifications, messages you send through the platform, and bug reports you file.
Technical records: your IP address, browser user agent and timestamps, kept against sessions, sign-in attempts, rate limits and the audit log.
If you organise: your conference details, your uploaded event license and commercial registration, and your Moyasar account name and API keys.
We never see or store card numbers, expiry dates or security codes. Payment details go from your browser directly to Moyasar. NextMUN receives only a payment reference, an amount, a status, and at most the card brand and last four digits.
We do not track you across other websites, and there is no advertising or analytics profiling on this platform.
To run your account and keep it secure. To pass your application to the conference you applied to. To tell you what happened to it. To let organisers manage their conference and their team. To detect abuse, enforce rate limits and investigate reports. To meet our own legal obligations.
The organisers of a conference you apply to see your application, your name, your email address, your country and your stated experience. They need it to decide and to run the event. They are independent of us and responsible for how they handle it.
A small number of processors handle data on our behalf, and only for that purpose.
We do not sell personal data, and we never will.
Account and application data stays while your account exists, because an application history is the point of the platform. Sessions, password reset tokens and email verification codes expire on their own and are short-lived. Rate limit records expire within their window.
Ask us to delete your account and we will remove your personal data, keeping only what we must for a legal or accounting reason, and anonymised records where a conference needs its own history to stay coherent.
You can see and correct most of your data from your profile. You can also ask us for a copy of it, ask us to correct or delete it, or object to a particular use.
Write to saadalarifi@nextmun.org and we will respond. If you are in a place with a data protection regulator and you are unhappy with our answer, you can complain to them.
We set only essential cookies for sign-in, verification, referral attribution and the introductory splash. There are no advertising or analytics cookies, so there is no optional tracking to consent to.
The learning page can contain a YouTube video. It does not load until you choose to load it; YouTube may then receive technical information under its own policy. Conference organisers may also link to external application forms or websites, which are outside NextMUN's control.
Passwords are hashed with Argon2id. Session tokens, password resets, board invitations and email codes are stored only as SHA-256 hashes. An organiser’s Moyasar secret key and your saved autofill answers are encrypted with AES-256-GCM under keys the database never holds. There is more detail on the security page.
If we change how we handle your data in a way that matters, we will say so on the platform rather than quietly editing this page.