Privacy Policy

When you order or hold an account: your name, email address, billing address, company name and VAT identification number where applicable, and your account credentials. Payment card details are collected and processed directly by our payment provider; we never receive or store your full card number.

When you use the service: the IP addresses and network identifiers assigned to you, connection and traffic metadata (volumes, port statistics, timestamps), power and provisioning events, and the actions you take on your Mac from your account (restarts, password resets, SSH key changes). We use this to operate the service, to bill correctly, and to investigate abuse.

Usage readings from your Mac. Each Mac runs a monitoring agent that sends, once a minute, how busy its processor and graphics are and how much memory and disk is in use. We keep these readings for 30 days to show you your Mac's usage, to warn you or us when it runs out of memory or disk, and to keep the service running. They contain no files, application or process names, screen content or keystrokes, and are not shared with anyone. The legal basis is the performance of our contract with you.

When you contact support: the content of your messages, tickets and any information you choose to share with us.

When you use the contact form: the name, email address and message you type, and a bot check by Cloudflare Turnstile, which sees your IP address and how the page behaved in your browser. It sets no advertising cookie and does not track you across sites; it is what keeps the form usable, so it runs without asking, on our legitimate interest in not being flooded (Art. 6(1)(f)).

When you visit our website: server logs including IP address, browser type, and pages requested, and, with your consent where it is required, measurement data collected through Google Analytics and Lucky Orange.

Visitor statistics. We count visits to macduty.com to see which pages are used and to keep the site working well. Cloudflare, which delivers our site, processes your IP address for every request it serves. From those requests we receive only totals, such as visits per page, country and day; we never receive your IP address for them. These statistics need no cookie and no script on your device: they come only from the requests your browser already sends to load a page. We do not store these totals ourselves: we read them from Cloudflare each time we look at them. Cloudflare keeps them for the period its analytics service retains data for our site, as set out in Cloudflare's documentation. Our legal basis is our legitimate interest in running and improving the site (GDPR Article 6(1)(f)). You have the right to object to this at any time (Article 21). Because we hold only totals and nothing that identifies you, we cannot pick out your visits in them; write to [email protected] and we will answer within one month and tell you what your objection changes.

Site performance measurement. Cloudflare, which delivers our site, adds on our behalf a small script (Cloudflare Web Analytics) to our pages that measures how quickly they load and respond. It sends Cloudflare the address of the page and of the page you came from (without any query string), load and response times, measurements of how the page displays, including a short description of the page elements and files involved, the name and version of your browser and operating system, and, in some browsers, memory-use figures; Cloudflare also processes your IP address. It sets no cookie and stores nothing on your device, but it reads this information from your browser. We see only totals. Cloudflare keeps the data for the period its analytics service retains it, as set out in Cloudflare's documentation. Visitors who reach our site through a Cloudflare data center in the European Economic Area, Switzerland or the United Kingdom do not get this script. Visitors who reach our site through a Cloudflare data center outside those countries get it automatically, without being asked first. For them our legal basis is our legitimate interest in a site that loads quickly and works (GDPR Article 6(1)(f)). You can object at any time by writing to [email protected], and we will answer within one month; you can also block the script in your browser.

We also record how pages of our public website are used (the pages visited, clicks, scrolling and mouse movement) through Lucky Orange, to find what is hard to use. Lucky Orange receives your IP address and masks it. In the European Economic Area, Switzerland and the United Kingdom this happens only with your consent. Elsewhere it happens by default until you turn it off in Cookie settings, and our legal basis is our legitimate interest in a site that is easy to use (GDPR Article 6(1)(f)). Nothing is recorded in your account, the partner area, checkout or sign-up. What you type, passwords, keys, addresses, VAT numbers and payment details are hidden before a recording leaves your browser.

Fraud prevention: our payment provider may carry out risk checks on orders and share the outcome with us.

Hosting partners. If you rent a Mac that one of our hosting partners owns, the partner sees the payments made for that Mac and their amounts, by month only if you used its coupon code, and, if you did, that one more customer used the code. The partner never sees your name, email address or other details.

Where your order came from: if you reached us through a link carrying campaign parameters (UTM values) or an advertising click identifier, we keep those values in a first-party cookie for 90 days and record them on your order, together with the first page you visited and the site that sent you. This is our own record of what led to the contract; it is not used to profile you and does not depend on your cookie choice.

Unfinished orders. If you start an order and the payment does not go through, we may email you up to three reminders about that order within three days, on our legitimate interest in helping you finish what you started (GDPR Article 6(1)(f)). Each reminder has a link to stop them.

We do not access the contents of your Mac, your files or your workloads. To provide the service, each Mac is enrolled in our device management system and carries a technical administrator account of ours. We use them only to prepare the Mac, restart it, reset your password at your request and erase it when the service ends. Your login is generated by us, stored encrypted and shown only to you, in your account. Our staff access your Mac only where you ask us to for support, where it is strictly necessary to maintain or restore the service, or where the law or a competent authority requires it. When we access it for support, we tell you so in the ticket.

• To provide the service you ordered, to provision your Mac, and to give you support, performance of a contract (Art. 6(1)(b) GDPR).
• To take payment, issue invoices, and keep accounting records, contract and legal obligation (Art. 6(1)(b) and (c)).
• To keep the network secure, prevent fraud and abuse, and protect our IP reputation and other customers, legitimate interests (Art. 6(1)(f)).
• To respond to lawful requests from authorities, legal obligation (Art. 6(1)(c)).
• To send you service notices such as maintenance, incidents, renewals and payment issues, contract. These are not marketing and you cannot opt out of them while you hold an account.
• To send you occasional product news, consent (Art. 6(1)(a)), which you may withdraw at any time.

The site needs a small amount of storage to work at all: your theme, your currency, your session when you are signed in, the security checks our payment provider runs, and, for 90 days, the campaign link that brought you (so we can record on your order what led to it). That storage is strictly necessary and is not subject to consent.

Beyond that we use Google Analytics, Lucky Orange, Reddit Pixel, Meta Pixel and SourceForge review badges. In the European Economic Area, the United Kingdom and Switzerland nothing of that kind is loaded until you choose: the first time you visit, a bar asks, and refusing is one click, the same size as accepting. Elsewhere it loads unless you turn it off.

You can change your choice at any time with Cookie settings, at the foot of every page. Your choice is stored in your own browser, for a year, and is never sent to us.

With your consent, we report to Google what was bought (an order number, the product and the net amount, never your name, email address, company, address or IP address) so that we can measure which pages and campaigns lead to orders and, if we advertise, so that Google Ads can count them. Google acts as our processor for this. Renewals and refunds of an order are reported the same way, and only when the order itself was; an order placed while consent was refused is never reported, then or later.

• Account and contact data: for the life of your account and for 3 years afterwards.
• Invoices and accounting records: 10 years, as required by Romanian law.
• Network and connection logs: 90 days, unless retained longer for an ongoing abuse or security investigation, or where required by law.
• Support correspondence: 3 years.
• Data on your Mac: erased on termination, in accordance with the retention periods set out in our Terms of Service. Erasure is secure and irreversible.

We share personal data only with processors and partners who need it to deliver the service:

• our payment provider, for payments, invoicing and fraud prevention;
• our email delivery provider, for transactional messages;
• our device management provider, to prepare, manage and erase the Macs;
• our hosting, monitoring, bot-protection and analytics providers;
• with your consent where it is required, the advertising platforms whose ads we run (Reddit Pixel and Meta Pixel): they learn that a browser which saw one of our ads visited our website and, if it did, asked to be told when a Mac is in stock, so we can tell which ads work. We never pass them your name or email address;
• with your consent where it is required, SourceForge (Slashdot Media), whose review badges the foot of our public website shows for SourceForge, Slashdot and Top Business Software: when a badge loads, their server receives your IP address, your browser type and the address of the page you are on. We send them nothing about you or your account, and the badges are never loaded on pages behind sign-in;
• our accountant and, where necessary, our legal advisers;
• competent authorities, where we are legally required to disclose.

Each processor is bound by a data processing agreement. For the advertising measurement above, we and the platform are joint controllers of the collection and transmission from our website, and the platform's own privacy policy governs what it does afterwards. We do not sell personal data, and we share nothing for advertising beyond that measurement.

Our facility and our Macs, with the data on them, are located in Romania, within the European Union. Where a processor operates outside the EU or EEA, the transfer is covered by an adequacy decision of the European Commission or by Standard Contractual Clauses. Details of the processors we use are available on request.

If you process personal data on your Mac, you are the controller of that data and we act as your processor in respect of the hosting infrastructure. A data processing agreement under Article 28 GDPR is available on request and, once signed, governs that processing, including our obligations on security, sub-processors, and assistance with data subject requests.

Under the GDPR you have the right to access your personal data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to receive your data in a portable format, and to withdraw consent where processing is based on it. Where you object to processing based on our legitimate interests, we will stop unless we have compelling grounds that override your interests.

To exercise any of these rights, write to [email protected]. We respond within one month. We may ask you to confirm your identity first.

If you believe we have handled your data unlawfully, you may complain to the Romanian supervisory authority, ANSPDCP (www.dataprotection.ro), or to the authority in your country of residence.

We apply appropriate technical and organisational measures, including physical access control to our facility, network segmentation between customers, encrypted administrative access, restricted internal access on a need-to-know basis, and logging of administrative actions. Your Mac is dedicated to you and is not shared with other customers. Security of the operating system and of anything you install on the Mac remains your responsibility.

If a personal data breach occurs that is likely to result in a risk to your rights, we notify the supervisory authority within 72 hours and inform you without undue delay where the risk is high.

We do not make decisions with legal or similarly significant effects about you by automated means alone. Automated fraud screening may flag an order for manual review; a person makes the final decision, and you may contact us to contest the outcome.

Our services are directed at businesses and professionals and are not intended for anyone under 16. We do not knowingly collect data from children.

We may update this policy. Material changes will be notified by email at least 15 days before they take effect, and the date at the top of this page always reflects the current version.