GDPR
Updated 24 October 2026
MacDuty is operated by AITEST S.R.L., a company registered in Romania, inside the European Union. This page explains how we handle data under the GDPR, in plain language.
Two roles, two documents
We handle two kinds of data, and our role is different for each.
| Data | Examples | Our role | Governed by |
|---|---|---|---|
| Data about you as our customer | Your account, billing details, support messages, network logs | Controller | Our Privacy Policy |
| Data you process on your Mac | Your files, databases, customer records, anything your software handles | Processor | Our data processing agreement |
If you put personal data on your Mac, you are its controller, and we host the infrastructure it runs on.
Where your data is
| Data | Location |
|---|---|
| Your Mac and its disk | Our facility in Romania, EU |
| Network and connection logs | Romania, EU, kept for 90 days |
| Account and billing data | Processed by us and the providers below; transfers outside the EU are covered by an adequacy decision or Standard Contractual Clauses |
The data on your Mac never leaves the European Union because of us.
What we can and cannot access
You have administrative control of your Mac. Each Mac also carries a technical account of ours and is enrolled in our device management system, used only to prepare it, restart it, reset your password on request and erase it at the end. We do not access its contents, your files or your workloads.
We access your Mac only:
- when you ask us to, for support,
- when it is strictly necessary to keep or restore the service, or
- when the law or a competent authority requires it.
When we access your Mac for support, we tell you so in the ticket.
Data processing agreement
If you process personal data on a MacDuty Mac, we sign a data processing agreement under Article 28 of the GDPR. It covers:
- processing only on your documented instructions
- confidentiality of everyone with access
- security measures
- how we use sub-processors, and how we tell you about changes
- assistance with data subject requests and breach notifications
- deletion or return of data at the end of the service
- information and audits to demonstrate compliance
To sign it, write to [email protected] with your company name and VAT number.
Sub-processors
These companies may process personal data on our behalf. SimpleMDM manages our Macs remotely on our instructions (preparing, updating and erasing them). None of the processors in the table below uses your data or the contents of your Mac for its own purposes. Anthropic, listed after the table, is the exception described there.
Cloudflare
- What it does for us
- Content delivery, protection of the website, file storage, aggregate visitor statistics for our own site (we receive totals only, never IP addresses), and measurement of page performance (Cloudflare Web Analytics), which runs without prior consent, on legitimate interest, for visitors reaching a Cloudflare data center outside the European Economic Area, Switzerland and the United Kingdom
- Where
- Global network, not limited to the EU
- Safeguard
- EU-US Data Privacy Framework and Standard Contractual Clauses
Google
- What it does for us
- Business email and documents; website analytics and ad measurement, only with your consent
- Where
- Google's global data centers
- Safeguard
- EU-US Data Privacy Framework and Standard Contractual Clauses
Hetzner
- What it does for us
- Hosting of the platform and its database
- Where
- Germany, EU
- Safeguard
- No transfer outside the EU
Lucky Orange
- What it does for us
- Session recordings and heatmaps of the website, only with your consent
- Where
- United States
- Safeguard
- Standard Contractual Clauses
Resend
- What it does for us
- Transactional email
- Where
- United States
- Safeguard
- EU-US Data Privacy Framework and Standard Contractual Clauses
SimpleMDM
- What it does for us
- Management of our Macs: enrollment, configuration and wiping
- Where
- Google Cloud, region not published
- Safeguard
- EU-US Data Privacy Framework and Standard Contractual Clauses
Stripe
- What it does for us
- Payments, invoicing and fraud prevention
- Where
- Stripe's global infrastructure
- Safeguard
- EU-US Data Privacy Framework and Standard Contractual Clauses
Twilio
- What it does for us
- SMS verification codes
- Where
- United States
- Safeguard
- EU-US Data Privacy Framework, Binding Corporate Rules and Standard Contractual Clauses
| Sub-processor | What it does for us | Where | Safeguard |
|---|---|---|---|
| Cloudflare | Content delivery, protection of the website, file storage, aggregate visitor statistics for our own site (we receive totals only, never IP addresses), and measurement of page performance (Cloudflare Web Analytics), which runs without prior consent, on legitimate interest, for visitors reaching a Cloudflare data center outside the European Economic Area, Switzerland and the United Kingdom | Global network, not limited to the EU | EU-US Data Privacy Framework and Standard Contractual Clauses |
| Business email and documents; website analytics and ad measurement, only with your consent | Google's global data centers | EU-US Data Privacy Framework and Standard Contractual Clauses | |
| Hetzner | Hosting of the platform and its database | Germany, EU | No transfer outside the EU |
| Lucky Orange | Session recordings and heatmaps of the website, only with your consent | United States | Standard Contractual Clauses |
| Resend | Transactional email | United States | EU-US Data Privacy Framework and Standard Contractual Clauses |
| SimpleMDM | Management of our Macs: enrollment, configuration and wiping | Google Cloud, region not published | EU-US Data Privacy Framework and Standard Contractual Clauses |
| Stripe | Payments, invoicing and fraud prevention | Stripe's global infrastructure | EU-US Data Privacy Framework and Standard Contractual Clauses |
| Twilio | SMS verification codes | United States | EU-US Data Privacy Framework, Binding Corporate Rules and Standard Contractual Clauses |
Anthropic
- What it does for us
- Answers are written by an AI model (Claude) and checked automatically before they are sent. If you want a person, say so in the ticket and a person at MacDuty will take over.
- Where
- United States
- Safeguard
- None by contract yet. Anthropic handles this data under its own terms and privacy policy. We are moving support to Anthropic's commercial service, with a data processing agreement and Standard Contractual Clauses.
| Sub-processor | What it does for us | Where | Safeguard |
|---|---|---|---|
| Anthropic | Answers are written by an AI model (Claude) and checked automatically before they are sent. If you want a person, say so in the ticket and a person at MacDuty will take over. | United States | None by contract yet. Anthropic handles this data under its own terms and privacy policy. We are moving support to Anthropic's commercial service, with a data processing agreement and Standard Contractual Clauses. |
We notify customers with a signed data processing agreement before adding or replacing a sub-processor.
Security measures
- Dedicated hardware. One Mac per customer, never shared, with no virtual machine between customers.
- Physical access control to our facility.
- Network segmentation between customers.
- Encrypted administrative access for our staff.
- Need-to-know access inside our team.
- Logging of administrative actions.
Security of macOS and of everything you install on the Mac is your responsibility.
If something goes wrong
If we become aware of a personal data breach affecting data we process for you, we notify you without undue delay, with the information you need to meet your own obligations as controller.
For breaches of data we control, we notify the Romanian supervisory authority within 72 hours where required, and inform the people affected when the risk to them is high.
When the service ends
When your subscription ends, and after the retention periods in our Terms of Service, we securely erase your Mac. Erased data cannot be recovered.
The service does not include backups. Back up anything you want to keep before the end of your term.
What stays your responsibility
- A legal basis for the personal data you process on your Mac
- Security of macOS, your accounts and your software
- Encryption of sensitive data at rest, where you need it
- Your own backups
- Agreements with any other providers your software sends data to
Running AI agents
An AI agent on your Mac often sends data to an AI model provider. That provider is your processor, not ours, and needs its own agreement with you.
Local models running on the Mac itself keep that data on your machine.
Contact
Privacy questions, data subject requests and processing agreements: [email protected].
- ANSPDCP, the Romanian supervisory authority, you may also contact the authority in your own country