Privacy notice

Who we are

MyMakes (app.mymakes.co.uk) is run by [Your name or company name], who is the data controller for the personal data described here. Questions about your data: [contact email, e.g. hello@mymakes.co.uk].

MyMakes is registered with the Information Commissioner's Office (ICO) under reference [ICO registration number].

What we hold, and why

We keep as little as the app needs to work. In full:

• Your login: your first name, email address and a scrambled form of your password (never the password itself), plus when you signed up. We need these to sign you in, to email you a sign-in link if you ask for one, and to send invites and the odd message about your account. Lawful basis: performing our contract with you.
• Sign-in records: a session for each device you're signed in on (lasting 30 days), and sign-in links you ask for by email (valid for 15 minutes, usable once). Lawful basis: performing our contract with you.
• Your workshop: everything you enter about your making, such as supplies, tools, products and what goes into them, makes, sales, where you sell and the fees there, restocks, removals, craft fairs, your hourly rate and VAT settings, and the names of the people in the workshop. This is your business data; we only process it to show it back to you and to work out costs and figures. Lawful basis: performing our contract with you.
• People in your workshop: when you invite someone, we keep their email address and who invited them until the invite is used or expires (7 days). Each record you log remembers who logged it, by name, so a workshop with more than one person can see who did what. Lawful basis: our legitimate interest in a workshop knowing its own history.
• Plan and billing: which plan the workshop is on. When payments are switched on, Stripe will hold your card details and billing address; we will only keep Stripe's reference for your subscription, never your card number. Lawful basis: performing our contract with you.
• Feedback: if you use Send feedback, we receive what you wrote, your email address and the screen you sent it from, by email. Lawful basis: our legitimate interest in improving the app.
• During the private beta: the email addresses of makers allowed to sign up, so that only they can. Lawful basis: our legitimate interest in running a closed beta.
• Technical logs: like any website, the servers keep short-lived logs of requests, which include your IP address, browser type and the page or action, so we can find and fix faults and spot abuse. Lawful basis: our legitimate interest in keeping the service working and secure.

Where it's stored

MyMakes runs entirely on Cloudflare. The shared database (logins, workshops, memberships, plans) and files (receipts, photos, exports) are stored in Cloudflare's Western Europe region. Each workshop's own records are stored in a Cloudflare data centre close to where that workshop was first used, which for UK makers is normally the UK or nearby in Europe.

Emails from MyMakes (sign-in links, invites, export links) are sent through Cloudflare's email service.

Your phone or laptop also keeps a small copy of some of your data so the app loads quickly and craft fair mode works without signal (see the cookie note).

Who processes it

Cloudflare, Inc. hosts the app, its databases, files and email sending, and processes personal data on our behalf under its data processing terms. Cloudflare is based in the USA; transfers of UK personal data to it are covered by the UK's International Data Transfer Addendum to the EU standard contractual clauses, and the data itself is stored in Europe as described above.

Stripe, Inc. will process payments when paid plans are switched on. Stripe will be the controller of the payment details it collects. Until then, no payment details are collected by anyone.

Nobody else. There are no analytics, advertising or tracking services in MyMakes.

Staff access to your workshop's data

To help you with a question or fix a fault, a member of MyMakes staff (at present, only the owner) may need to look at your workshop's data. When that happens:

• Access is through MyMakes's own support tools, which are read-only and protected by two separate logins. Nobody edits your records by hand.
• If something needs putting right (for example, after a fault wrote a wrong figure), it is done by a repair action in the app that records what it changed in your workshop's History, so you can see it.
• We only look when you have asked for help, or when we need to confirm a fault affects your workshop, and only at what the question needs.
• We never share what we see with anyone else, and we don't use your business data for anything other than running MyMakes for you.

How long we keep it

• Your login and your workshop's records: for as long as you have an account. You can delete a workshop, or your login, at any time from Workshops in the app (see below).
• A deleted workshop's records are deleted straight away. Cloudflare keeps a recovery copy of data for up to 30 days so that we could put things back after a serious fault; after that it is gone for good.
• When you delete your login, your sessions and sign-in links are removed and your name and email are replaced on our records, so you can't be identified. Records you logged in a workshop you have left keep the name you used at the time, because they are that workshop's history.
• Sessions last 30 days (renewed while you keep using the app); sign-in links 15 minutes; invites 7 days; export download links 7 days (the file is deleted after).
• Feedback emails are kept in our mailbox for up to 2 years.
• Technical logs are kept for a short period (currently up to 7 days).
• The beta allowlist is deleted when the beta ends.

Your rights

Under UK data protection law you can ask us for a copy of your personal data, to correct it, to delete it, to limit how we use it, or to object; and you can take your data with you. Most of this you can do yourself:

• Export: More → Export downloads everything your workshop has ever entered, as spreadsheets and files you can open anywhere.
• Correct: edit any record in the app; History shows what changed.
• Delete: More → Workshops → Delete this workshop removes the workshop and everything in it; Delete my login removes your login. You'll be offered an export first.
• Anything else, or if something doesn't work: email [contact email, e.g. hello@mymakes.co.uk]. We'll answer within a month.
• You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd be grateful for the chance to sort things out first.

Changes to this notice

If we change what we hold or how we use it, we'll update this page and, for anything significant, tell you by email before it takes effect.