This Privacy Policy describes how Boris Mensah (hereinafter "MakerStock", "we" or the "Publisher"), operating the service accessible via makerstocks.com, collects, uses, stores and protects the personal data of users of the MakerStock service (hereinafter the "Service").
This policy applies to all natural persons whose data is processed in connection with the Service, whether they are direct clients, account administrators or operators designated by a client. It covers data processed through the MakerStock web application, mobile interface and public API.
The controller of personal data collected through the Service is:
| Name | Boris Mensah |
| Legal form | Sole trader (micro-enterprise) |
| SIRET | 852 444 181 00019 |
| City | Rennes, France |
| GDPR contact email | contact@makerstocks.com |
| DPO appointed | Not appointed at this stage |
| Category | Data concerned | Nature |
|---|---|---|
| Identity | First name, last name, professional email address | Required |
| Login data | BigCommerce credentials (via OAuth), authentication token | Required |
| Production data | Raw materials, recipes, batches, expiry dates, stock movements, production runs, COGS | Generated by use |
| Commercial data | Suppliers, resellers, B2B orders, internal pricing information | Optional depending on plan |
| Workshop data | Workshop name(s), production locations, warehouses | Required at configuration |
| Category | Data concerned | Purpose |
|---|---|---|
| Technical data | IP address, browser type, operating system, language | Security, debugging |
| Navigation data | Pages visited, action timestamps, session time | Service improvement, support |
| Application logs | Errors, API requests, BigCommerce sync statuses | Debugging, technical traceability |
| Device data | Screen resolution, device type (mobile/desktop) | Interface optimisation |
As part of the native integration with BigCommerce, MakerStock receives, via the BigCommerce API and with the user's consent at the time of installation, the following data:
MakerStock does not and will never collect:
| Purpose | Legal basis (GDPR Art. 6) | Detail |
|---|---|---|
| Provision of the Service (production, inventory, runs management) | Performance of a contract — Art. 6.1.b | Processing necessary for performance of the accepted ToS |
| Authentication and account security | Performance of a contract — Art. 6.1.b | User identification, access protection |
| Billing and subscription management | Performance of a contract — Art. 6.1.b Legal obligation — Art. 6.1.c | Coordination with BigCommerce, retention of purchase evidence (10 years) |
| Sending transactional emails | Performance of a contract — Art. 6.1.b | Confirmations, account alerts, service notifications |
| Service improvement and debugging | Legitimate interest — Art. 6.1.f | Technical log analysis, error correction. Interest: improving service quality. |
| Customer support | Performance of a contract — Art. 6.1.b | Processing of support requests |
| Compliance with legal obligations | Legal obligation — Art. 6.1.c | Responding to court orders, accounting retention |
We do not use your data for commercial prospecting, advertising profiling, or fully automated decision-making producing legal effects.
All personal data processed by MakerStock is hosted on servers located in Germany, within the European Union, with Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). No transfer of your personal data outside the European Economic Area (EEA) is carried out in the course of the Service's normal operation.
In the event of a future transfer outside the EEA (for example, use of a support provider based outside the EU), such transfer will be governed by appropriate safeguards in accordance with Chapter V GDPR, in particular by Standard Contractual Clauses (SCCs) approved by the European Commission, and this policy will be updated accordingly.
MakerStock uses the following sub-processors to ensure the technical operation of the Service. These providers act solely on our instructions and are not authorised to use your data for their own purposes:
| Sub-processor | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Server infrastructure, data storage | Germany (EU) |
BigCommerce Inc. is MakerStock's distribution and authentication partner. When installing the application from the BigCommerce App Store, you also accept BigCommerce's Terms of Service and Privacy Policy, which independently govern the management of your store and the billing of your MakerStock subscription. MakerStock is not responsible for BigCommerce's data processing practices.
MakerStock does not sell, rent or transfer your personal data to third parties for commercial, advertising or prospecting purposes. Your production data (recipes, batches, COGS, raw materials) is strictly confidential and is in no way shared with other clients or partners.
We may be required to disclose your data when a legal, regulatory or judicial obligation compels us to do so (court order, injunction by a competent authority). In that case, we will inform the User concerned as soon as possible, unless prohibited by law from doing so.
| Data type | Retention period | Basis |
|---|---|---|
| Active account data (profile, authentication) | Duration of active subscription + 90 days after termination | Performance of contract |
| Production data (recipes, batches, runs, stock) | Duration of active subscription + 90 days after termination | Performance of contract |
| Billing data and proof of payment | 10 years from the transaction | Legal obligation (French Commercial Code Art. L.123-22) |
| Technical and security logs | Rolling 12 months | Legitimate interest (security) |
| Customer support exchanges | 3 years from ticket closure | Legitimate interest (evidence, improvement) |
| Data retained due to legal obligation | Duration imposed by applicable law | Legal obligation |
At the end of the 90-day period following subscription termination, all production and account data is permanently and irreversibly deleted from our servers, unless a legal obligation requires otherwise. No backup is retained beyond this period, with the exception of billing data subject to a legal retention obligation.
In accordance with Regulation (EU) 2016/679 (GDPR) and French Law No. 78-17 of 6 January 1978 as amended (Data Protection Act), any natural person whose data is processed by MakerStock has the following rights:
| Right | What it means | How to exercise it |
|---|---|---|
| Access (Art. 15) | Obtain confirmation that your data is being processed and receive a copy | Email to contact@makerstocks.com Response within 30 calendar days. In the case of a manifestly unfounded or excessive request, we reserve the right to require proof of identity and, where applicable, to charge reasonable fees. |
| Rectification (Art. 16) | Have inaccurate data corrected or incomplete data completed | |
| Erasure (Art. 17) | Request deletion of your data in the cases provided for by the GDPR | |
| Restriction (Art. 18) | Request temporary suspension of processing | |
| Portability (Art. 20) | Receive your data in a structured, machine-readable format | |
| Objection (Art. 21) | Object to processing based on our legitimate interest |
If you believe that the processing of your personal data constitutes a violation of the GDPR, you have the right to lodge a complaint with the competent supervisory authority. In France, this is the:
Commission Nationale de l'Informatique et des Libertés (CNIL)
3 Place de Fontenoy, 75007 Paris, France
Website: www.cnil.fr
This right of complaint is without prejudice to any other administrative or judicial remedy.
If you are a California resident (United States), the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you additional rights over your personal data:
To exercise these rights, send your request to contact@makerstocks.com, stating your California residency. We will respond within the 45-day period provided by the CCPA, extendable by a further 45 days if necessary with prior notification.
MakerStock uses a strictly limited number of cookies, exclusively necessary for the technical operation of the Service. We do not use advertising cookies, behavioural tracking tools or third-party browsing analytics.
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| Authentication session | Strictly necessary | Maintaining user session | Session (deleted on close) |
| CSRF token | Strictly necessary | Protection against Cross-Site Request Forgery attacks | Session |
| Interface preferences | Functional | Storing theme (light/dark) and language preferences | 12 months |
Strictly necessary cookies do not require your prior consent. Functional cookies may be declined without impacting the essential features of the Service.
MakerStock implements appropriate technical and organisational measures to protect your data against loss, unauthorised access, disclosure, alteration or destruction, in accordance with Article 32 GDPR. These measures include in particular:
In the event of a data breach likely to result in a high risk to your rights and freedoms, we undertake to notify you as soon as possible in accordance with Article 34 GDPR, and to notify the relevant supervisory authority within the 72-hour period required by Article 33.
No security measure is infallible. MakerStock cannot guarantee the absolute security of data transmitted over the internet. We recommend that you never share your login credentials and immediately report any suspicious access to contact@makerstocks.com.
The MakerStock Service is intended for professionals and adults. We do not knowingly collect personal data from persons under 16 years of age. If you are a minor, please do not use the Service and do not provide us with any personal data.
If we learn that a minor under 16 has provided us with personal data without verifiable parental consent, we will take the necessary steps to delete that data as soon as possible. If you are a parent or legal guardian and believe your child has sent us data, please contact us at contact@makerstocks.com.
We reserve the right to amend this Privacy Policy at any time, in particular to comply with new legal or regulatory obligations, or to reflect changes in our processing practices.
In the event of a material amendment affecting your rights or the nature of the processing carried out, we will inform you by email to the address registered on your account, with at least 30 days notice before the amendment takes effect. Continued use of the Service after this period constitutes acceptance of the amended policy.
The date of last update is shown in the header of this document. Previous versions are available upon request at contact@makerstocks.com.
For any questions relating to this policy, to exercise your rights or to raise a concern about the protection of your data, please contact us:
We undertake to acknowledge receipt of your request within 5 business days and to provide a complete response within 30 calendar days. In the case of a complex request requiring additional time, we will inform you before the expiry of the initial period.