Privacy Policy

When you order or hold an account: your name, email address, billing address, company name and VAT identification number where applicable, and your account credentials. Payment card details are collected and processed directly by our payment provider; we never receive or store your full card number.

When you create an account or place an order: the IP address the account was created from, and the IP address, country and browser each order was placed from. We keep them with the account and with the order, to prevent fraud and abuse and as a record of the agreement, and our staff can see them. Our legal basis is our legitimate interest in preventing fraud and in being able to prove the agreement (GDPR Article 6(1)(f)). We keep them with the account and with its orders for as long as the account exists. The IP address of a signed-in session is kept only while the session lasts.

When you use the service: the IP addresses and network identifiers assigned to you, connection and traffic metadata (volumes, port statistics, timestamps), power and provisioning events, and the actions you take on your Mac from your account (restarts, password resets, SSH key changes). We use this to operate the service, to bill correctly, and to investigate abuse.

Usage readings from your Mac. Each Mac runs a monitoring agent that sends, once a minute, how busy its processor and graphics are and how much memory and disk is in use. We keep these readings for 30 days to show you your Mac's usage, to warn you or us when it runs out of memory or disk, and to keep the service running. They contain no files, application or process names, screen content or keystrokes, and are not shared with anyone. The legal basis is the performance of our contract with you.

When you contact support: the content of your messages, tickets and any information you choose to share with us.

When you use the contact form: the name, email address and message you type, and a bot check by Cloudflare Turnstile, which sees your IP address, your browser's user agent and connection details, and how the page behaved in your browser. It sets no advertising cookie and does not track you across sites; it is what keeps the form usable, so it runs without asking, on our legitimate interest in not being flooded (Art. 6(1)(f)). Cloudflare also uses these signals, as a controller in its own right, to improve its bot detection; its Turnstile privacy addendum (https://www.cloudflare.com/turnstile-privacy-policy/) explains how.

When you ask for a sign-in code or start a checkout: a bot check by Cloudflare Turnstile, which sees your IP address, your browser's user agent and connection details, and how the page behaved in your browser, to stop automated abuse. It answers only whether the visitor looks like a person, and we keep nothing from it. Our legal basis is our legitimate interest in protecting accounts and payments (GDPR Article 6(1)(f)). Cloudflare also uses these signals, as a controller in its own right, to improve its bot detection; its Turnstile privacy addendum (https://www.cloudflare.com/turnstile-privacy-policy/) explains how.

When you visit our website: server logs including IP address, browser type, and pages requested, and, with your consent where it is required, measurement data collected through Google Analytics, Lucky Orange and Cloudflare Web Analytics.

Visitor statistics. We count visits to macduty.com to see which pages are used and to keep the site working well. Cloudflare, which delivers our site, processes your IP address for every request it serves. From those requests we receive only totals, such as visits per page, country and day; we never receive your IP address for them. These statistics need no cookie and no script on your device: they come only from the requests your browser already sends to load a page. We do not store these totals ourselves: we read them from Cloudflare each time we look at them. Cloudflare keeps them for the period its analytics service retains data for our site, as set out in Cloudflare's documentation. Our legal basis is our legitimate interest in running and improving the site (GDPR Article 6(1)(f)). You have the right to object to this at any time (Article 21). Because we hold only totals and nothing that identifies you, we cannot pick out your visits in them; write to [email protected] and we will answer within one month and tell you what your objection changes.

Site performance measurement. Our pages load a small script from Cloudflare (Cloudflare Web Analytics) that measures how quickly they load and respond. It sends Cloudflare the address of the page and of the page you came from (without any query string), load and response times, measurements of how the page displays, including a short description of the page elements and files involved, the name and version of your browser and operating system, and, in some browsers, memory-use figures; Cloudflare also processes your IP address. It sets no cookie and stores nothing on your device, but it reads this information from your browser. We see only totals. Cloudflare keeps the data for the period its analytics service retains it for our site, as set out in Cloudflare's documentation. If your IP address shows that you visit from the European Economic Area, Switzerland or the United Kingdom, or does not show a country, the script loads only if you accept analytics in our cookie banner; our legal basis is your consent (GDPR Article 6(1)(a)), which you can withdraw at any time in Cookie settings. In other countries it loads by default, on our legitimate interest in a site that loads quickly and works (GDPR Article 6(1)(f)); you can turn it off at any time in Cookie settings, or object by writing to [email protected].

We also record how pages of our public website are used (the pages visited, clicks, scrolling and mouse movement) through Lucky Orange, to find what is hard to use. Lucky Orange receives your IP address and masks it. In the European Economic Area, Switzerland and the United Kingdom this happens only with your consent. Elsewhere it happens by default until you turn it off in Cookie settings, and our legal basis is our legitimate interest in a site that is easy to use (GDPR Article 6(1)(f)). Nothing is recorded in your account, the partner area, checkout or sign-up. What you type, passwords, keys, addresses, VAT numbers and payment details are hidden before a recording leaves your browser.

Fraud prevention: our payment provider may carry out risk checks on orders and share the outcome with us.

Hosting partners. If you rent a Mac that one of our hosting partners owns, the partner sees the payments made for that Mac and their amounts, by month only if you used its coupon code, and, if you did, that one more customer used the code. The partner never sees your name, email address or other details.

Where your order came from: if you accept analytics or marketing cookies, we keep in a first-party cookie for 90 days the campaign values (UTM) or advertising click identifier of the link you came through, the first page you visited and the site that sent you, and we record them on your order. We use them to see which channels lead to orders. If you decline, we do not store them.

How you heard about us: at checkout you can tell us, optionally, how you heard about us, by choosing from a list and, if you choose "Something else", in a few words of your own. The answer is kept as long as the order. The free-text answer is deleted after 12 months.

Unfinished orders. If you start an order and the payment does not go through, we may email you up to three reminders about that order within three days, on our legitimate interest in helping you finish what you started (GDPR Article 6(1)(f)). Each reminder has a link to stop them.

We do not access the contents of your Mac, your files or your workloads. To provide the service, each Mac is enrolled in our device management system and carries a technical administrator account of ours. We use them only to prepare the Mac, restart it, reset your password at your request and erase it when the service ends. Your login is generated by us, stored encrypted and shown only to you, in your account. Our staff access your Mac only where you ask us to for support, where it is strictly necessary to maintain or restore the service, or where the law or a competent authority requires it. When we access it for support, we tell you so in the ticket.

• To provide the service you ordered, to provision your Mac, and to give you support, performance of a contract (Art. 6(1)(b) GDPR).
• To take payment, issue invoices, and keep accounting records, contract and legal obligation (Art. 6(1)(b) and (c)).
• To keep the network secure, prevent fraud and abuse, and protect our IP reputation and other customers, legitimate interests (Art. 6(1)(f)).
• To respond to lawful requests from authorities, legal obligation (Art. 6(1)(c)).
• To send you service notices such as maintenance, incidents, renewals and payment issues, contract. These are not marketing and you cannot opt out of them while you hold an account.
• To send you occasional product news, consent (Art. 6(1)(a)), which you may withdraw at any time.

The site needs a small amount of storage to work at all: your theme, your currency, your session when you are signed in, and the security checks our payment provider runs. If you accept analytics or marketing cookies, we also keep for 90 days the campaign link or site that brought you (so we can record on your order which channel led to it). This storage is not strictly necessary, so it happens only with your consent. You can withdraw your consent at any time from the cookie settings.

Beyond that we use Google Analytics, Lucky Orange, Cloudflare Web Analytics, Reddit Pixel, Meta Pixel and SourceForge review badges. In the European Economic Area, the United Kingdom and Switzerland nothing of that kind is loaded until you choose: the first time you visit, a bar asks, and refusing is one click, the same size as accepting. Elsewhere it loads unless you turn it off.

You can change your choice at any time with Cookie settings, at the foot of every page. Your choice is stored in your own browser, for a year, and is never sent to us.

With your consent, we report to Google what was bought (an order number, the product and the net amount, never your name, email address, company, address or IP address) so that we can measure which pages and campaigns lead to orders and, if we advertise, so that Google Ads can count them. Google acts as our processor for this. Renewals and refunds of an order are reported the same way, and only when the order itself was; an order placed while consent was refused is never reported, then or later.

• Account and contact data: for the life of your account and for 3 years afterwards.
• Invoices and accounting records: 10 years, as required by Romanian law.
• Network and connection logs: 90 days, unless retained longer for an ongoing abuse or security investigation, or where required by law.
• Support correspondence: 3 years.
• Data on your Mac: erased on termination, in accordance with the retention periods set out in our Terms of Service. Erasure is secure and irreversible.

We share personal data only with processors and partners who need it to deliver the service:

• our payment provider, for payments, invoicing and fraud prevention;
• our email delivery provider, for transactional messages;
• our device management provider, to prepare, manage and erase the Macs;
• our hosting, monitoring, bot-protection and analytics providers;
• with your consent where it is required, the advertising platforms whose ads we run (Reddit Pixel and Meta Pixel): they learn that a browser which saw one of our ads visited our website and, if it did, asked to be told when a Mac is in stock, so we can tell which ads work. We never pass them your name or email address;
• with your consent where it is required, SourceForge (Slashdot Media), whose review badges the foot of our public website shows for SourceForge, Slashdot and Top Business Software: when a badge loads, their server receives your IP address, your browser type and the address of the page you are on. We send them nothing about you or your account, and the badges are never loaded on pages behind sign-in;
• our accountant and, where necessary, our legal advisers;
• competent authorities, where we are legally required to disclose.

Each processor is bound by a data processing agreement. For the advertising measurement above, we and the platform are joint controllers of the collection and transmission from our website, and the platform's own privacy policy governs what it does afterwards. We do not sell personal data, and we share nothing for advertising beyond that measurement.

Our facility and our Macs, with the data on them, are located in Romania, within the European Union. Where a processor operates outside the EU or EEA, the transfer is covered by an adequacy decision of the European Commission or by Standard Contractual Clauses. Details of the processors we use are available on request.

If you process personal data on your Mac, you are the controller of that data and we act as your processor in respect of the hosting infrastructure. A data processing agreement under Article 28 GDPR is available on request and, once signed, governs that processing, including our obligations on security, sub-processors, and assistance with data subject requests.

Under the GDPR you have the right to access your personal data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to receive your data in a portable format, and to withdraw consent where processing is based on it. Where you object to processing based on our legitimate interests, we will stop unless we have compelling grounds that override your interests.

To exercise any of these rights, write to [email protected]. We respond within one month. We may ask you to confirm your identity first.

If you believe we have handled your data unlawfully, you may complain to the Romanian supervisory authority, ANSPDCP (www.dataprotection.ro), or to the authority in your country of residence.

We apply appropriate technical and organisational measures, including physical access control to our facility, network segmentation between customers, encrypted administrative access, restricted internal access on a need-to-know basis, and logging of administrative actions. Your Mac is dedicated to you and is not shared with other customers. Security of the operating system and of anything you install on the Mac remains your responsibility.

If a personal data breach occurs that is likely to result in a risk to your rights, we notify the supervisory authority within 72 hours and inform you without undue delay where the risk is high.

We do not make decisions with legal or similarly significant effects about you by automated means alone. Automated fraud screening may flag an order for manual review; a person makes the final decision, and you may contact us to contest the outcome.

Our services are directed at businesses and professionals and are not intended for anyone under 16. We do not knowingly collect data from children.

We may update this policy. Material changes will be notified by email at least 15 days before they take effect, and the date at the top of this page always reflects the current version.