Privacy policy — MakeLocal

MakeLocal is an online marketplace for making things locally: people who need a part made (Seekers) describe it or pick a design, and people who own 3D printers and other machines (Makers) make it. This policy explains what personal data MakeLocal processes, why, and what rights you have. It applies to the website makelocal.eu, the MakeLocal app, our sign-in service, our event map, and our connector for AI assistants. Our cookie policy lists everything we store on your device.

1. Who is responsible for your data

The controller of your personal data is CODE THE CODE sp. z o.o., a company registered in Poland ("we", "us"). Its registration details and address are in the legal notice.

For anything about your data, write to privacy@makelocal.eu. We have not appointed a data protection officer; that address reaches the people responsible.

2. Summary

We use your data to run the marketplace: your account, your orders, your workspace, chat, payments and delivery.
We do not sell your data and we show no advertising.
Your home or workshop address is never public. A Seeker's delivery address is shown only to the Maker who ships the order, and only once the order is approved.
Analytics in your browser run only if you allow them. Without a yes, our servers only count page loads, receive error reports and record business events such as an order being paid, and none of these identifies you to our analytics provider.
Some providers we use process data outside the European Union: Stripe (payments), OpenRouter (the AI assistant and catalogue research), Google (the AI model behind them, our fonts, and Google Maps when a Maker opens directions to a delivery address), Apple (Apple Maps, likewise), Cloudflare (delivery of our pages' code) and Exa (web search for catalogue research, with no information about our users). Section 7 lists every provider and where it processes data.

3. What we process, why, and on what legal basis

The legal bases below are those of the EU General Data Protection Regulation (GDPR): contract (Article 6(1)(b), needed to provide the service you signed up for), legal obligation (Article 6(1)(c)), legitimate interest (Article 6(1)(f), weighed against your interests) and consent (Article 6(1)(a), which you can withdraw at any time).

3.1 Your account

When you sign up, we process your email address, your name and display name, your profile picture if you add one, the name of your organisation if you give one, whether your email address is verified, and when your account was created. We also record when you last used MakeLocal and, while the app is open, that you are online.

Every account is a Seeker. You can also take on the role of Maker, Coordinator or Logistics; these roles are stored with your account.

Your display name, first and last name, profile picture and organisation name are visible to other signed-in users, for example in chat and on orders. Your email address is not.

Why: to create and run your account and sign you in.
Legal basis: contract.

3.2 Signing in

Sign-in runs on our own sign-in service at auth.webtree.org, which uses the Zitadel software. It stores your email address, your name, your password (in a form that cannot be read back) or the account you sign in with, and a record of your sign-ins, including the IP address and browser they came from. The sign-in service also sends the emails your account needs, such as the email that confirms your address and the one that resets your password, through Amazon SES (section 7). We also use the same sign-in service for our other Webtree services, and we are the controller of the accounts in it.

Why: to keep your account secure and to sign you in.
Legal basis: contract; for the sign-in records, our legitimate interest in preventing account misuse.

3.3 Workspaces, production locations and machines (Makers)

A Maker's workspace holds their production locations, machines, materials, stock and prices. A production location is the address of a home or a workshop, given as precisely as the Maker chooses: from just a country down to the house number. While you type it, we suggest matching addresses. A map under the address outlines the house, district or city we know it to be. Instead of typing, you can click on the map where the location is, close enough to see single houses; we send the point you clicked to Geoapify to find the address there, and keep that exact point with the address so that a courier can reach the right door. You can also add an entrance and a flat or office number. When a new location has no address yet, your browser may ask whether to share your location, and if you allow it we fill the address in from it, as section 3.5 describes. Once the address is saved and names at least a city, we convert it to map coordinates so that we can tell how far away an order is. All of these lookups go through Geoapify (section 7). The map itself is loaded by your browser from OpenFreeMap and the OpenStreetMap tile servers (section 7).

A production location is never public and is never shown to anyone outside its workspace, at any level of detail. Inside the workspace, members see what their role allows.

Some information about machines is public through our connector for AI assistants (section 3.11).

Why: to let Makers offer their machines and to match them with orders.
Legal basis: contract.

3.4 Orders and files

When you order something, we process what you describe and upload: title, description, notes, quantity, colour and material preferences, 3D model files and photos, prices and fees, and the order's progress through its stages. Makers, designers and coordinators who work on the order are linked to it.

Makers who have the capabilities an order needs can see the order's description and download its model files while the order looks for a Maker, so that they can decide whether to offer to make it. Published models and products in our catalogue are public, without the name of the person who published them.

Files are stored in Amazon Web Services' data centre in Frankfurt, Germany. Your browser uploads them there directly.

Why: to take, match and carry out orders.
Legal basis: contract.

3.5 Delivery address (Delivery Point)

For an order that has to be delivered, you give a delivery address. While you type it, we send what you have typed so far (once it is at least three characters long), with the city and your language if known, to Geoapify (section 7) to suggest matching addresses. A map under the address outlines the house, district or city we know it to be. Instead of typing, you can click on the map where you are, close enough to see single houses: we send the point you clicked, the map's zoom and your language to Geoapify to find the address there. We keep that exact point with your address, so that the courier can reach the right door, and it is as private as the address. You can also add an entrance and a flat or office number in their own fields; they are never sent to Geoapify. Once the address is saved, we convert it to map coordinates through Geoapify too.

When the map opens and you have no saved address for it to open on, your browser asks whether to share your location with us. If you allow it, your browser gives us a point, which we send to Geoapify to find the house, district or city there and show it on the map. If the address is still empty and your browser locates you well enough (to within about 25 kilometres), we fill it in from that answer at once and save it with the address: the exact point and the house only when your browser places you to within about 30 metres, otherwise only the district or city, without the point. You can change or clear it at any time. In every other case the point is not kept and is gone when you leave the page. If you refuse, the map shows your country, and the location button on the map asks again.

Either way we send Geoapify only an address or a point, never your name, contact details or account. A flat number you add after an address you picked is never sent; one inside an address you typed by hand is removed before the lookup where we recognise it, and otherwise goes to Geoapify with the rest of what you typed. The map itself is loaded by your browser from OpenFreeMap and the OpenStreetMap tile servers (section 7), which see your IP address and the part of the map you look at, but not your address.

While Makers decide whether to take an order, they see only a rough distance band to a grid cell about 2 km wide around your address, never the address. The full address, with the point you placed, the entrance and the flat, is shown only to the Maker who carries out the last production stage before delivery, only after you have approved their work, and only until the order closes. That Maker sees the point on a map and can open it in Google Maps or Apple Maps for directions, which sends the point to Google or Apple (section 7). We record when the address was shown and to whom.

Why: so that your order can be delivered.
Legal basis: contract.
How long: for a draft order, deleted once neither the order nor the address has changed for 90 days; for an open order, once neither has changed for 180 days; for a completed or cancelled order, 30 days after it closed.

3.6 Chat

Each order has a chat. We process the messages, edits, reactions, attachments and read receipts. The people taking part in the order's chat can read them, and our support team may read an order's chat to help resolve a problem with that order.

Why: to let the people on an order talk to each other, and to resolve problems.
Legal basis: contract; for support, our legitimate interest in resolving disputes fairly.

3.7 Payments and payouts

Payments are processed by Stripe (section 7). When you pay, your card or other payment details go straight from your browser to Stripe; we never see or store them. We store the payment's amount, fees, status, the type of payment method (for example "card"), and Stripe's reference numbers. Stripe uses information about your browser and device to detect fraud (see the cookie policy).

To receive payouts (as a Maker, as a designer selling models, or as a coordinator receiving product revenue), you set up a Stripe account. We send Stripe your email address. Stripe then collects the identity and bank details it needs directly, on its own pages. We store the Stripe account number and whether payouts are enabled, and if not, what Stripe still needs.

Disputes about an order are recorded with the order, together with the notes of the person handling them.

Why: to take payments, pay Makers, designers and coordinators, prevent fraud, and handle disputes and refunds.
Legal basis: contract; for keeping accounting records, legal obligation (the Polish Accounting Act and tax law); for fraud prevention, our and Stripe's legitimate interest.
How long: accounting records are kept for at least 5 years from the end of the year in which the payment was made, as Polish accounting and tax law requires.

3.8 Matching, reputation and automated processing

Our matching system decides which Makers are offered an order. To do so it uses data about Makers' machines, processes, materials, skills, availability, location, the work they already hold and how past orders went. How it chooses and orders Makers is set out only in section 8 of our terms of service. If no one takes the work, it goes to an open board that any Maker can see.

After an order, a Seeker can say whether they were happy with it (a like or a dislike). That answer is never shown to the Maker or to anyone who could tell who gave it. We also calculate further figures from what Makers do on the Platform, such as how reliably they meet agreed dates and how much work their machines already have, and store them with each matching round. Section 8 of our terms of service says which of them affect who is offered work, and we will tell Makers before that changes, as the EU Platform-to-Business Regulation (2019/1150) requires.

We make no decision about you based solely on automated processing that has legal or similarly significant effects on you (Article 22 GDPR).

Why: to offer each order to Makers who can make it, and to keep the marketplace trustworthy.
Legal basis: contract; for the reputation figures, our legitimate interest in a marketplace that rewards reliable work.

3.9 The AI assistant

When you describe an order, our AI assistant helps you fill it in: it suggests a title, materials and other details, and answers questions in the order form. To do that, we send OpenRouter (section 7) what you typed, your messages to the assistant, the current contents of the order form, and matching entries from our catalogue. We do not send your uploaded files, only their reference numbers. OpenRouter passes the request to the AI model that answers it, currently Google's Gemini (section 7). Your conversation with the assistant is saved with the order form, so it is still there when you come back; only you can see it, and it is kept as long as the order.

OpenRouter does not use what we send to train AI models, and we instruct it to route our requests only to model providers that do not collect it either. AI answers can be wrong; check them before you rely on them.

We keep a technical trace of each AI request in Langfuse (section 7), so that we can find and fix wrong answers. A trace contains the prompt and the reply, your internal account number and the order's number. Email addresses and phone numbers in the text are hidden before the trace is sent.

Why: to help you describe what you need, and to improve the assistant's answers.
Legal basis: contract for the assistant; our legitimate interest in the quality of the assistant for the traces.
How long: we delete traces 30 days after the request.

Separately, our servers use AI services to research the equipment and supplies in our catalogue. That research sends OpenRouter, and through it Google's Gemini and the web-search service Exa (section 7), catalogue material: the names and technical details of machines and supplies, and quotations from public web pages we use as sources, with their titles and addresses. It sends no information about our users.

3.10 Event map

At events, we run a map at makelocal.eu/ws where anyone can add a pin without an account. A pin holds a city, country and map position, a short label, an optional nickname, and, for a pin asking for a part to be made, a contact (an email address or phone number) and the time you agreed to our use of it. We also store a one-way hash of your IP address to limit abuse, and which of our printed QR codes brought you there (see the cookie policy).

The public map shows only the label, the city and country, a slightly shifted position and the first word of the nickname. The contact is never shown.

Why: to show who near you could make things, and to arrange part requests.
Legal basis: consent for the contact, which we use only to arrange the hand-over of that part; our legitimate interest in running the map and preventing abuse for the rest.

3.11 Connector for AI assistants

Our public connector for AI assistants (the MCP endpoint at /mcp) lets anyone's AI assistant list the machines available on MakeLocal. For each active machine it shows the machine's model, once our catalogue has confirmed that model, and the processes and materials the model works with, less any its Maker has said their machine does not. It shows no name a Maker gave their machine and nothing about the person who owns it: not who they are, not whether they are online, not where they are and not how to contact them.

Why: to let people find Makers through the AI tools they use.
Legal basis: our legitimate interest in making the marketplace's supply visible.

3.12 Analytics, error reports and business events (PostHog)

We use PostHog to understand how MakeLocal is used and to find faults. All PostHog data is stored in PostHog's EU cloud in Frankfurt, Germany (section 7).

Nothing reads your device for analytics until you allow it. Before you answer the consent banner, and if you choose "Don't allow", our analytics script is not loaded at all. Then only server page counts, error reports and business events are recorded, as described below.

Server page counts. For every visitor, our server counts each full page load: which kind of page was loaded (the page's pattern, such as "a product page", never its full address) and, if the link carried them, our own campaign tags (utm_source, utm_medium and utm_campaign, kept only when their value is one of our own campaign names). Only page loads that succeed are counted. We keep no IP address, no browser details, no referring page and no identifier, so a count cannot be linked to you or to your other visits. The counts measure page loads, not visitors. We read nothing from your device for them.

Legal basis: our legitimate interest in knowing how much each page is used.
How long: 1 year.

Error reports. When part of MakeLocal fails in your browser, the page sends a short technical report through our server, so that we can find and fix the fault in the service you are using. The report contains:

the type of error, as one of our own error codes;
the kind of page it happened on (the page's pattern, never its full address);
where in our code it happened (the stack frames, without the error message);
the version of MakeLocal;
the name and version of your browser and operating system;
whether it came from our live site or from one of our developers testing it.

It contains no error message, no account number, name or contact detail, and no identifier that lasts beyond that single report. Nothing is stored in your browser to make it. Your IP address reaches our server as part of any request, but it is not passed on to PostHog or kept with the report. Reading these details from your browser is necessary to provide the service you asked for (art. 399(3)(2) of the Polish Electronic Communications Act).

Legal basis: our legitimate interest in keeping MakeLocal working.
How long: 1 year.
You can object at any time by writing to privacy@makelocal.eu.

Analytics, only if you allow it. If you choose "Allow analytics", PostHog shows us how MakeLocal is used: which pages you open (without anything after "?" or "#" in their address), what you click, and how long pages take to load. Text on the page and in what you click is hidden from what we collect. On some screens it also records the page, with all text and everything you type hidden. Screens showing order details, chat, account settings or checkout are never recorded, and no recording captures your browser's console or network traffic. It also lets us try out new features on some visitors and not on others.

PostHog stores an identifier in your browser (see the cookie policy) for up to 1 year, so that it can recognise your later visits. If you are signed in, we link it to your internal account number and to the list of roles you hold on MakeLocal (Seeker, Maker, Coordinator, Logistics, Admin), never to your name, email address, phone number or address. PostHog does not store your IP address.

Legal basis: your consent (art. 399 of the Polish Electronic Communications Act and Article 6(1)(a) GDPR).
How long: recordings 30 days; other analytics data 1 year.
Withdrawing: use Cookie settings at the bottom of our public pages, such as the home page. We then stop collecting at once and delete PostHog's identifier from your browser. Withdrawing does not affect what was collected before. If you are signed in, your choice is also stored on your account, with every change and the version of the text you answered.

Business events. Our servers record key steps in PostHog: an order placed, paid or delivered, and a Maker approved. If you allowed analytics, the record carries your internal account number; otherwise PostHog receives no account number or other identifier of yours with it, and keeps no profile of you.

Legal basis: our legitimate interest in measuring how the marketplace works.
How long: 1 year.

When your account is deleted, we also delete your record in PostHog, with its events and recordings.

3.13 Security and server logs

Our servers log each request they handle: the method, the address requested, the result and how long it took. These routine entries do not contain your IP address or your account. To limit abuse, our servers count requests per IP address in memory for a short time. When a limit is hit or a security check fails, for example too many attempts to use a workspace invitation, the warning we log can include the IP address and your internal account number, so that we can tell an attack from a mistake. Other entries can include internal account numbers when we investigate a fault in your account or sign-in.

Why: to keep MakeLocal running and secure, and to investigate faults and attacks.
Legal basis: our legitimate interest in a secure, working service.
How long: 7 days.

3.14 Fonts

Our pages load their fonts from Google Fonts. To deliver them, your browser connects to Google's servers, which receive your IP address and the details every browser sends with a request. Google says it does not use this to build profiles. Google may process it in the USA.

Why: to display our pages as designed.
Legal basis: our legitimate interest in a consistent appearance.

3.15 When you write to us

If you write to privacy@makelocal.eu or to our support, we process your message and contact details to answer it.

Legal basis: our legitimate interest in answering you; for requests about your data, our legal obligation to handle them.
How long: as long as needed to handle your request, and up to 3 years afterwards to show how we handled it.

4. Do you have to give us your data?

You do not have to, but without some of it we cannot provide the service: we need an email address to create an account, an order's details to carry it out, a delivery address to deliver it, and a Stripe account to pay a Maker, designer or coordinator. Everything else is optional.

5. Children

You must be at least 18 to create an account (see our terms of service), and MakeLocal is not meant for children under 16. If you believe a child under 16 has given us their data, write to privacy@makelocal.eu and we will delete it.

6. How long we keep data

The periods stated in section 3 apply where they are given. Apart from those:

Your account, workspace, orders, files and chat are kept while your account exists.
When your account is deleted, your profile is marked as deleted at once and the delivery addresses of your draft and closed orders are deleted. Today, your orders, chat messages, uploaded files, and your workspace with its production locations and their addresses are not yet deleted automatically after that. If you want them erased, write to privacy@makelocal.eu and we will erase them, except what the law requires us to keep (such as accounting records, section 3.7) or what we need to establish or defend legal claims.
Pins on the event map are kept until we remove the map after the event.
Copies of deleted data remain in our database backups for up to 7 days.

7. Who receives your data, and where it is processed

We use the following providers. Each processes data only on our instructions, under the data-processing terms that are part of its standard service terms, except where stated.

Stripe (payments and payouts). Stripe Payments Europe, Ltd., Ireland, together with Stripe, Inc. in the USA. Stripe processes data in the EU and in the USA. Transfers to the USA are covered by the EU–US Data Privacy Framework and by the European Commission's standard contractual clauses. For identity checks and fraud prevention, Stripe also acts as an independent controller under its own privacy policy (stripe.com/privacy).
OpenRouter (the AI assistant and catalogue research). OpenRouter, Inc., USA. Receives what section 3.9 describes and passes each request to the AI model that answers it. OpenRouter processes data in the USA; transfers are covered by standard contractual clauses in OpenRouter's data-processing terms.
Google (Gemini, which answers the AI assistant and catalogue research through OpenRouter; and Google Fonts). Google processes this data in the USA and in other countries where it runs data centres. Transfers are covered by the EU–US Data Privacy Framework and by standard contractual clauses in Google's data-processing terms. For Google Fonts, Google acts as an independent controller.
Exa (web search for catalogue research, reached through OpenRouter). Exa Labs, Inc., USA. Receives search questions about machines and supplies only (section 3.9). Because we send it no information about our users, this is not a transfer of their personal data, and no transfer safeguard applies.
Langfuse (traces of AI requests). Langfuse GmbH, Germany; data stored in its EU region.
Geoapify (suggesting addresses as you type them, finding the address and the outline of the house, district or city at a point on the map, whether you clicked it or your browser gave it, and turning saved addresses into map positions). KEPTAGO LTD, Cyprus, which runs Geoapify; we use its EU servers. Geoapify receives address text (complete or partly typed) or a point on the map, and nothing that ties it to a person: no name, contact detail or account. Requests go from our server, so Geoapify does not see your IP address either. Because it cannot tell whose address it is, Geoapify is a recipient rather than our processor. It keeps each request for up to 24 hours, and in exceptional cases for up to 2 months.
OpenFreeMap (the map shown under every address, and the map of a delivery address shown to the Maker who ships to it), a free public map service at openfreemap.org. Your browser downloads the map's style and tiles from tiles.openfreemap.org, so OpenFreeMap receives your IP address, the details every browser sends with a request, and which part of the map you look at. It receives no address, account or other information about you.
OpenStreetMap Foundation (the map's fallback tiles, used when OpenFreeMap cannot be reached). OpenStreetMap Foundation, United Kingdom. Your browser downloads the tiles from tile.openstreetmap.org, so the OpenStreetMap Foundation and its content delivery network receive what OpenFreeMap would. The United Kingdom has an adequacy decision from the European Commission.
Google Maps and Apple Maps (directions to a delivery address). Only when the Maker shown a delivery address follows its "Open in Google Maps" or "Open in Apple Maps" link, their browser opens Google's or Apple's maps with the delivery point's coordinates in the link. Google or Apple then receive that point and the Maker's IP address, and process them as independent controllers under their own privacy policies, possibly in the USA. We send them nothing ourselves.
PostHog (analytics, error reports and business events). PostHog, Inc., USA; data stored in its EU cloud in Frankfurt, Germany. PostHog staff outside the EU can access it to provide support; that access is covered by standard contractual clauses in PostHog's data-processing agreement.
Amazon Web Services (file storage, database backups, configuration, and sending the sign-in service's emails through Amazon SES). Amazon Web Services EMEA SARL, Luxembourg; data stored in Frankfurt, Germany. Amazon is a US company; any access from outside the EU is covered by the EU–US Data Privacy Framework and standard contractual clauses.
Hosting. We run our servers, database, sign-in service, background jobs and logs ourselves, on servers rented from Hetzner Online GmbH, Germany (data centre in Nuremberg), and Scaleway SAS, France. Database backups are stored with Amazon Web Services in Frankfurt.
Cloudflare (delivery of our pages' code and styles). Cloudflare, Inc., USA. Your browser downloads these files from cdn.webtree.org, so Cloudflare receives your IP address and the details every browser sends with a request. Cloudflare serves them from its network worldwide. Transfers are covered by the EU–US Data Privacy Framework and standard contractual clauses in Cloudflare's data-processing terms.

Besides these providers, your data reaches:

Other MakeLocal users, as described in section 3 (for example, the Maker who ships your order sees your delivery address).
Authorities, courts and advisers, when the law requires it or when we need to establish, exercise or defend legal claims.

8. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you and get a copy of it;
have inaccurate data corrected;
have your data erased;
restrict how we use your data;
receive the data you gave us in a machine-readable format and have it sent to another provider (portability);
object at any time to processing based on our legitimate interest, for reasons relating to your situation;
withdraw your consent at any time, without affecting what was done before.

To use any of these rights, write to privacy@makelocal.eu from the email address of your account, or tell us how to confirm that the request is yours. We answer within one month. You can change your name, email address and password yourself: your account settings link to our sign-in service, where you manage them. To delete your account, write to the same address.

You also have the right to complain to a data protection authority. In Poland that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, www.uodo.gov.pl. You can also complain to the authority in the EU country where you live or work.

9. Security

Data travels between your browser and our servers encrypted. Access to our systems is limited to the people who need it. Sign-in cookies cannot be read by scripts on the page, and passwords are stored only in a form that cannot be read back. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authority as the law requires.

10. Changes to this policy

When MakeLocal changes in a way that affects your data, we update this policy and the date at the top. If a change affects what you agreed to, we ask you again.

This policy is written in English, and the English version is the reference. Translations are provided for convenience.