GDPR
Updated 15 September 2026
MacDuty is operated by AITEST S.R.L., a company registered in Romania, inside the European Union. This page explains how we handle data under the GDPR, in plain language.
Two roles, two documents
We handle two kinds of data, and our role is different for each.
| Data | Examples | Our role | Governed by |
|---|---|---|---|
| Data about you as our customer | Your account, billing details, support messages, network logs | Controller | Our Privacy Policy |
| Data you process on your Mac | Your files, databases, customer records, anything your software handles | Processor | Our data processing agreement |
If you put personal data on your Mac, you are its controller, and we host the infrastructure it runs on.
Where your data is
| Data | Location |
|---|---|
| Your Mac, its disk, and any snapshot you take of it | Our facility in Romania, EU |
| Network and connection logs | Romania, EU, kept for 90 days |
| Account and billing data | Processed by us and the providers below; transfers outside the EU are covered by an adequacy decision or Standard Contractual Clauses |
The data on your Mac never leaves the European Union because of us.
What we can and cannot access
You have full administrative control of your Mac. We do not access its contents, your files, your credentials or your workloads.
We access your Mac only:
- when you ask us to, for support,
- when it is strictly necessary to keep or restore the service, or
- when the law or a competent authority requires it.
When we access your Mac for support, the access is recorded and appears in your ticket history.
Data processing agreement
If you process personal data on a MacDuty Mac, we sign a data processing agreement under Article 28 of the GDPR. It covers:
- processing only on your documented instructions
- confidentiality of everyone with access
- security measures
- how we use sub-processors, and how we tell you about changes
- assistance with data subject requests and breach notifications
- deletion or return of data at the end of the service
- information and audits to demonstrate compliance
To sign it, write to [email protected] with your company name and VAT number.
Sub-processors
These companies may process personal data on our behalf. None of them has access to the contents of your Mac.
| Sub-processor | Purpose | Transfer basis |
|---|---|---|
| Stripe | Payments, invoicing and fraud prevention | EU processing, with Standard Contractual Clauses for onward transfers |
| Resend | Transactional email | Standard Contractual Clauses |
| Twilio | SMS verification codes | Standard Contractual Clauses |
| Cloudflare | Content delivery and protection of the website | Standard Contractual Clauses |
We notify customers with a signed data processing agreement before adding or replacing a sub-processor.
Security measures
- Dedicated hardware. One Mac per customer, never shared, with no virtual machine between customers.
- Physical access control to our facility.
- Network segmentation between customers.
- Encrypted administrative access for our staff.
- Need-to-know access inside our team.
- Logging of administrative actions.
Security of macOS and of everything you install on the Mac is your responsibility.
If something goes wrong
If we become aware of a personal data breach affecting data we process for you, we notify you without undue delay, with the information you need to meet your own obligations as controller.
For breaches of data we control, we notify the Romanian supervisory authority within 72 hours where required, and inform the people affected when the risk to them is high.
When the service ends
When your subscription ends, and after the retention periods in our Terms of Service, we securely erase your Mac. Erased data cannot be recovered.
The service does not include backups. Back up anything you want to keep before the end of your term.
What stays your responsibility
- A legal basis for the personal data you process on your Mac
- Security of macOS, your accounts and your software
- Encryption of sensitive data at rest, where you need it
- Your own backups
- Agreements with any other providers your software sends data to
Running AI agents
An AI agent on your Mac often sends data to an AI model provider. That provider is your processor, not ours, and needs its own agreement with you.
Local models running on the Mac itself keep that data on your machine.
Contact
Privacy questions, data subject requests and processing agreements: [email protected].
- ANSPDCP, the Romanian supervisory authority, you may also contact the authority in your own country