Privacy Policy
1. Who is responsible
ZORBY&CO d.o.o., Vilsonovo šetalište 10, 71000 Sarajevo, Bosnia and Herzegovina (JIB 4203428970007) runs Makeborne and is the controller of your account, billing, support and security data. Contact for every privacy question: admin@makeborne.com.
- EU representative (GDPR Art. 27): to be appointed.
- UK representative (UK GDPR Art. 27): to be appointed.
We have not appointed a data protection officer, because our core activities do not involve large-scale monitoring of people or large-scale sensitive data, so the law does not require one.
Data you add about other people. For your leads, clients, portal and review users and your websites' visitors, you are the controller and we are your processor under the Data Processing Agreement. If you are one of those people, contact the Makeborne customer who holds your data; we will pass on any request we receive.
2. What we use, why, and for how long
| Purpose | Data | Legal basis | Kept |
|---|---|---|---|
| Your account and sign-in | Email, password hash, account ID, sign-in records; name and avatar from Google or GitHub if you use them | Contract | Until your account is deleted |
| Providing Makeborne | Prompts, files, projects, versions, chats, published sites, workspace members | Contract | Until you or we delete them; account deletion runs 7 days after you ask |
| AI features | The brief and context you send with a request | Contract | Our copy as above; AI providers delete inputs and outputs within 30 days (longer only for flagged abuse) |
| Payments and credits | Plan, payment status and reference, refunds, credit ledger (card details stay with Whop) | Contract; legal obligation | Financial records 10 years, with your account ID replaced by a random reference after deletion |
| Support and legal requests | Messages, request records | Legitimate interest; legal obligation | Up to 3 years |
| Security, abuse and errors | IP address and device data in server logs; scrubbed error reports | Legitimate interest | Error reports about 400 days; provider logs per provider |
| Visit counts | One-way daily hash of IP and browser (no cookies) | Legitimate interest | Counts about 400 days (see below) |
| Account emails | Email address | Contract | As account |
| Showcasing your work | The work you choose | Consent (opt-in) | Until you withdraw consent |
| Launch waitlist | Email, when you joined, the notice version you saw, a campaign tag if your link carried one, one-way keyed hashes of your IP address and browser (the IP itself is not stored) | Consent (you ask to join) | Deleted 90 days after launch, or sooner on request; every waitlist email has an unsubscribe link |
Service quality. Our own servers count visits to the home, pricing, sign-in, studio, client portal and help pages, once per browser per page per day, as a one-way hash of your IP address and browser details combined with a random value for that day. Each day's random value is deleted when the first visit is counted two or more days later; after that, stored hashes can no longer be matched to you. Browsers sending Global Privacy Control or Do Not Track are not counted. Error reports are scrubbed of email addresses, IDs, long tokens, long numbers and link query strings before they are stored. This is pattern matching, so other text in an error message can remain. Visit counts and error reports are deleted after about 400 days. No third-party analytics is used.
We do not sell personal data, do not use it for advertising, and do not use your content to train AI models. Data exports you request are deleted after 72 hours. Backups are overwritten on their normal cycle.
3. Who receives data
| Recipient | Role | Location and safeguard |
|---|---|---|
| Supabase (database, sign-in, files) | Processor | EU (Frankfurt); provider entity outside the EU, SCCs |
| Vercel (app hosting; site builds) | Processor | EU (Frankfurt) for the app; builds in the US; SCCs |
| Cloudflare (published sites, forms, storage) | Processor | Global network; EU-US Data Privacy Framework and SCCs |
| DigitalOcean (publishing server) | Processor | United Kingdom (adequacy decision) |
| Anthropic (AI text) | Processor | US; SCCs; no training on API data |
| OpenAI (AI images, when switched on) | Processor | US; SCCs; no training on API data |
| Resend (account emails) | Processor | Sent from the EU; US company; Data Privacy Framework and SCCs |
| Whop (checkout and subscriptions) | Independent controller | US; its own privacy policy; SCCs for data it shares with us |
| Google, GitHub (sign-in; Gmail or repository access only if you connect them) | Independent controllers | Their own policies; we follow Google's API User Data Policy, including Limited Use |
| OpenStreetMap services (Nominatim, Overpass and community mirrors) | Receive lead-finder search terms only | Not your personal data |
We also disclose data when the law requires it or to protect people and the service. Our company is in Bosnia and Herzegovina, which has no EU adequacy decision; we protect data sent to us and onward under the GDPR's transfer rules, using the Standard Contractual Clauses where needed.
4. Lead finder and research
When a customer searches for leads, Makeborne reads public business listings from OpenStreetMap and the public websites and profiles they point to, and may keep a business's name, category, address, website, public business email, phone and social links, plus an AI estimate of fit. This is done for that customer, who is the controller and must tell you about it when they contact you. To object or ask for removal, reply to the customer, or email us and we will pass it on. We do not build a shared database of people.
5. Automated decisions
We make no decisions with legal or similarly significant effects by automated means. AI generates content you ask for, and the lead finder ranks businesses for a customer to review; people decide what happens next.
6. Cookies and browser storage
We use only what Makeborne needs to work, so no consent banner is required:
- Sign-in cookies set by Supabase after you sign in;
- a short-lived (20-minute) cookie on private preview addresses, when previews are on;
- browser storage (local storage and IndexedDB) for drafts, attachments, layout and checkout choices, kept on your device until you clear it.
Published Makeborne sites set no cookies of ours. We will ask for consent before adding any analytics or advertising cookies.
7. Your rights
You can ask for access to, a copy of (portability), correction or deletion of your data, restrict or object to its use, and withdraw consent at any time. Email admin@makeborne.com from your account address, or use Settings › Your data where shown. We reply within one month and may ask you to confirm your identity.
You can complain to a supervisory authority: in Bosnia and Herzegovina, the Personal Data Protection Agency (azlp.ba); in the EU or EEA, the authority where you live or work; in the UK, the ICO.
| Region | Additional rights |
|---|---|
| Bosnia and Herzegovina | Rights under the Law on Personal Data Protection (2025), as above |
| United Kingdom, Switzerland | The same rights under UK GDPR and the Swiss FADP; complain to the ICO or the FDPIC |
| United States (state laws such as California's) | Know, access, correct and delete; we do not sell or share personal information for cross-context advertising; no discrimination for using your rights; you may use an authorised agent and appeal a refusal by emailing us |
| Brazil (LGPD) | Confirmation, access, correction, anonymisation, portability, deletion, information about sharing, and complaint to the ANPD |
| Canada, Australia | Access and correction, and complaint to the Privacy Commissioner (OPC or OAIC) |
8. Children
Makeborne is for people aged 18 or over. We do not knowingly collect children's data; tell us and we will delete it.
9. Security
We use access controls on every database table, private file storage with short-lived links, encryption in transit and for stored connection tokens, and least-privilege keys. No system is perfectly secure; we will notify you and the authorities of a breach where the law requires.
10. Changes
We will post changes here and tell you by email or in the app before material changes take effect.