| 1 |
# Privacy Policy |
| 2 |
|
| 3 |
*Last updated: June 8, 2026* |
| 4 |
|
| 5 |
Makenot.work is operated by Make Creative, LLC. This policy explains what data we collect and how we use it. |
| 6 |
|
| 7 |
## The Short Version |
| 8 |
|
| 9 |
- We collect the minimum data needed to operate |
| 10 |
- We don't track you across the web |
| 11 |
- We don't sell your data |
| 12 |
- We don't show ads |
| 13 |
- You can export or delete your data anytime |
| 14 |
|
| 15 |
## What We Collect |
| 16 |
|
| 17 |
### Account Information |
| 18 |
- Email address |
| 19 |
- Username |
| 20 |
- Password (hashed, we can't read it) |
| 21 |
- Payment information (handled by our payment processor, we don't store card numbers) |
| 22 |
|
| 23 |
### Content |
| 24 |
- Files you upload |
| 25 |
- Metadata you provide (titles, descriptions, tags) |
| 26 |
- Projects and organization |
| 27 |
|
| 28 |
### Transactions |
| 29 |
- Purchases and memberships |
| 30 |
- Payment amounts and dates |
| 31 |
- Payout records |
| 32 |
|
| 33 |
### Technical Data |
| 34 |
- IP address (for security, rate limiting) |
| 35 |
- Browser type (for compatibility) |
| 36 |
- Error logs (for debugging) |
| 37 |
|
| 38 |
IP addresses are retained for 30 days, then deleted. |
| 39 |
|
| 40 |
### Login and Session Data |
| 41 |
- IP address and browser type per session (for security alerts and session management) |
| 42 |
- Failed login attempt counts and timestamps (for account lockout protection) |
| 43 |
|
| 44 |
Session records are retained for 90 days after the session ends. Failed login data is reset after a successful login. |
| 45 |
|
| 46 |
## What We Don't Collect |
| 47 |
|
| 48 |
- Browsing behavior or history |
| 49 |
- Location data (beyond IP-derived country for tax purposes) |
| 50 |
- Cross-site tracking or device fingerprinting for identification |
| 51 |
- Third-party tracking data |
| 52 |
- Social media profiles |
| 53 |
|
| 54 |
## How We Use Data |
| 55 |
|
| 56 |
- **Operating the service**: Hosting content, processing payments |
| 57 |
- **Communication**: Account notifications, support responses |
| 58 |
- **Security**: Detecting abuse, preventing fraud |
| 59 |
- **Legal compliance**: Tax reporting, responding to valid legal requests |
| 60 |
|
| 61 |
## Data Sharing |
| 62 |
|
| 63 |
We share data only with: |
| 64 |
|
| 65 |
- **Payment processor**: Payment processing (see [Infrastructure & Vendors](../tech/infrastructure.md) for current provider) |
| 66 |
- **Infrastructure providers**: Hosting, CDN (they process but don't access your data) |
| 67 |
- **Legal authorities**: Only when legally required, and we'll notify you unless prohibited |
| 68 |
|
| 69 |
We don't sell or share data for advertising. |
| 70 |
|
| 71 |
## Your Rights |
| 72 |
|
| 73 |
### Access |
| 74 |
Download all your data anytime from Settings > Export. |
| 75 |
|
| 76 |
### Correction |
| 77 |
Edit your account information directly. |
| 78 |
|
| 79 |
### Deletion |
| 80 |
Delete your account from Settings > Account > Delete. We remove your personal data within 30 days, except: |
| 81 |
- Transaction records (legal requirement) |
| 82 |
- If you have completed sales, purchased content remains accessible to buyers for 90 days after deletion, then is removed |
| 83 |
|
| 84 |
### Portability |
| 85 |
Export includes all content, metadata, and transaction history in standard formats. |
| 86 |
|
| 87 |
## Cookies |
| 88 |
|
| 89 |
We use cookies for: |
| 90 |
- **Session management**: Keeping you logged in |
| 91 |
- **Security**: Preventing unauthorized actions on your account |
| 92 |
|
| 93 |
We don't use tracking cookies or third-party cookies. |
| 94 |
|
| 95 |
## Children |
| 96 |
|
| 97 |
We don't knowingly collect data from children under 13. |
| 98 |
|
| 99 |
## International Transfers |
| 100 |
|
| 101 |
Your data is processed in the United States (application server and database) and the European Union (file storage in Germany and Finland). For the specific providers and regions that host it, see our [Infrastructure](../tech/infrastructure.md) page and the service list in [Credits](../about/credits.md), which links to each vendor (including Hetzner). |
| 102 |
|
| 103 |
For transfers of personal data from the EU/EEA to the United States, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission. Copies of our SCCs are available upon request at privacy@makenot.work. |
| 104 |
|
| 105 |
We also maintain data processing agreements with our infrastructure providers that include SCC commitments for any EU personal data they process on our behalf. |
| 106 |
|
| 107 |
## GDPR (EU Users) |
| 108 |
|
| 109 |
You have rights under GDPR including access, rectification, erasure, and portability. Contact privacy@makenot.work to exercise these rights. |
| 110 |
|
| 111 |
Legal basis for processing: contract performance (operating your account), legitimate interest (security), legal obligation (tax records). |
| 112 |
|
| 113 |
We respond to data subject requests within 30 days. |
| 114 |
|
| 115 |
## CCPA (California Users) |
| 116 |
|
| 117 |
You have the right to know what data we collect, request deletion, and opt out of data sales (we don't sell data, so there's nothing to opt out of). |
| 118 |
|
| 119 |
## Changes |
| 120 |
|
| 121 |
We'll notify you of material changes via email. |
| 122 |
|
| 123 |
## Contact |
| 124 |
|
| 125 |
Privacy questions: privacy@makenot.work |
| 126 |
|
| 127 |
Data protection inquiries: dpo@makenot.work |
| 128 |
|
| 129 |
--- |
| 130 |
|
| 131 |
## See Also |
| 132 |
|
| 133 |
- [Terms of Service](./terms-of-service.md): Full legal terms |
| 134 |
- [Acceptable Use Policy](./acceptable-use.md): Content rules |
| 135 |
- [What We Guarantee](../about/guarantees.md): Data export and portability commitments |
| 136 |
|