Privacy Policy

01Controller

This policy covers the website mach.app, the MACH! app for iOS and Android, the web app at web.mach.app and our social media profiles. We process personal data to perform our contract with you (Art. 6(1)(b) GDPR), to comply with legal obligations (Art. 6(1)(c)), on the basis of legitimate interests (Art. 6(1)(f)) or with your consent (Art. 6(1)(a)). We do not use automated decision-making or advertising profiles.

02Website

When you visit mach.app, our server records technical data (IP address, date and time, page requested, referrer, browser and operating system) to deliver the site and protect it against attacks. Log files are kept only as long as necessary for these purposes. The site is hosted by Hetzner Online GmbH in Germany. It sets no cookies, uses no analytics and loads fonts from our own server. Links to app stores and social networks only transfer data once you click them.

03Account & sign-in

To use the app you need an account. We store your name, e-mail address, username, a hash of your password (never the password itself) and any optional profile details you enter. Sign-in runs on our own identity service (Keycloak) on our servers in Germany. If we offer sign-in with Google or Microsoft and you choose it, we receive your name, e-mail address and an identifier from that provider. The web app keeps you signed in using strictly necessary cookies or local storage.

04Using the app

To provide the features you use, we process projects, groups and roles, uploaded files (stored encrypted and visible only to permitted groups), read confirmations, messages, surveys, invitations, check-ins (who checked in whom and when) and site survey details including photos.

Working hours are stored only on your device and are never sent to us. The camera is used only to scan QR codes and, if you choose, to take photos; scanned camera images are not stored. Access to photos and files is limited to items you pick for upload. You can revoke all permissions in your device settings at any time.

05Production companies & crew

Projects are created and managed by production companies, which decide what is shared and with whom. For this project content the production company is the controller and we act as its processor (Art. 28 GDPR); we provide a data processing agreement on request. Crew members with questions about project content should contact the production company first – we will help it respond. We remain the controller for your account.

06Push notifications & e-mail

If you allow notifications, we store a device token and pass the notification text to Firebase Cloud Messaging (Google Ireland Ltd.) on Android or the Apple Push Notification service (Apple Distribution International Ltd.) on iOS. Data may be transferred to the USA. You can withdraw consent in your device settings at any time.

Service e-mails (invitations, new files, payment confirmations, deletion notices) are sent via SMTP2GO Ltd., New Zealand, which is covered by an EU adequacy decision. We do not send newsletters or marketing e-mails.

07Bookings & payment

Production companies book projects for a period of time. Payments are handled by Stripe Payments Europe Ltd., Dublin, Ireland. You enter card details directly with Stripe; we never receive them. We process company name, billing address, booked period and amount for invoicing and retain invoices for 10 years as required by German commercial and tax law.

08Error logs

Our servers and the app log technical events (time, error message, app version, device type, operating system and, where relevant, your user ID and IP address) so we can find and fix errors. Logs are stored on our own server in Germany, are not shared and are deleted automatically after 30 days.

09Service providers

Transfers outside the EU take place only on the basis of an adequacy decision (Art. 45 GDPR) or standard contractual clauses (Art. 46 GDPR). For our Instagram and YouTube profiles, Meta and Google process data under their own policies.

10Retention & deletion

• Account: until you request deletion; then removed within 30 days.
• Projects: deleted together with their files, messages and surveys once there has been no paid booking for more than a year, after 14 days' notice by e-mail to the production company.
• Invoices: 10 years.
• Error logs: 30 days.

To delete your account, use our deletion request form or e-mail jonas@mach.app.

MACH! is not directed at children under 16. We do not knowingly collect data from children; if you believe a child has provided us with data, please contact us and we will delete it.

11Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to withdraw consent at any time (Art. 15–20, 7(3) GDPR).

Just e-mail jonas@mach.app – we reply within one month. You may also lodge a complaint with a supervisory authority; ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

We will update this policy when MACH! or the law changes and inform registered users of material changes.