Privacy Policy — Participants

The Makers’ Cafe — Last updated: June 2026

How we handle your personal data. Controller: SUPPL FlexCo, Wildgartenallee 19/2, 1120 Vienna. Contact: office@themakerscafe.com.

What we collect

You give us: name, email, password (hashed), profile preferences, messages, survey responses.

From payments: Stripe sends us transaction records (amount, date, product). We never see full card numbers.

Automatically: pages visited, device/browser info, IP address, approximate city, referral source.

From Partners: attendance confirmation.

Why we process it

To run the Platform (account, bookings, Credits) — Art. 6(1)(b) GDPR.

Legal obligations (tax, accounting) — Art. 6(1)(c) GDPR.

To improve & protect (analytics, fraud prevention, service messages) — Art. 6(1)(f) GDPR.

Marketing (newsletters, offers) — only with your consent, Art. 6(1)(a) GDPR. Withdraw anytime.

Who sees your data

Partners receive your name and booking details only when needed to deliver your Experience. Our processors:

Supabase (database, auth) — EU data centres.

Stripe (payments) — PCI-DSS Level 1, EU processing.

Mailjet (transactional emails) — EU data centres.

Mapbox (geocoding/location search) — receives address/location data; US-based, EU SCCs apply.

OpenStreetMap (map display) — map tiles loaded from OpenStreetMap servers; the OpenStreetMap Foundation receives user IP addresses and tile coordinates (which indicate approximate location viewed). OSMF is UK-based; the UK has an EU adequacy decision, so no SCCs are required.

Google OAuth (authentication) — used as a login option; Google receives authentication data; EU SCCs apply.

We use a self-hosted instance of Plausible Community Edition for privacy-friendly website analytics. Plausible does not use cookies or persistent identifiers. Analytics data is used only in aggregate to understand platform usage and improve the service.

We never sell your data. We disclose to authorities only when legally required.

International transfers

Where data leaves the EU (e.g., Supabase’s US parent), we rely on EU Standard Contractual Clauses or adequacy decisions. Request a copy from us anytime.

How long we keep it

Account data: while active + 7 years (Austrian tax law, §132 BAO).

Transaction data: 7 years from year-end of transaction.

Usage logs: up to 26 months, then anonymised/deleted.

Marketing consent: until you withdraw or delete your account.

Your rights (GDPR)

Access · Rectification · Erasure · Restriction · Portability · Objection · Withdraw consent

Email us at office@themakerscafe.com. We respond within one month.

Complaints: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Wien, dsb@dsb.gv.at.

Cookies

Strictly necessary cookies (session, auth) are set without consent. Analytics and marketing cookies require your opt-in via our cookie banner. Manage preferences anytime via the footer link.

Security

TLS encryption in transit; Supabase row-level security and AES-256 encryption at rest; Stripe PCI-DSS Level 1; Mailjet email delivery over TLS; Mapbox, Google OAuth, and OpenStreetMap accessed via HTTPS with EU Standard Contractual Clauses governing any data transfers outside the EEA (note: OpenStreetMap Foundation is UK-based and covered by the UK adequacy decision, so no SCCs are required for that transfer); all fonts are self-hosted and involve no third-party requests; job queues handled by self-hosted Redis with no third-party access.

Changes

Material changes communicated by email at least 14 days before taking effect.