Privacy Policy
Version 2.6 · Effective September 14, 2026
Macyou LLC (“we”, “our”, or “us”) is a limited liability company registered in Georgia (entity ID 445839503) that operates the Macyou platform at macyou.co. This Privacy Policy explains what personal data we collect, how we use it, and your rights in relation to it. By using our services you agree to the practices described here.
1. Introduction
Macyou provides dedicated Apple Mac Mini servers — both Bare Metal and VM instances — on a rental basis. This policy covers all data processing activities that occur when you visit our website, create an account, provision servers, or otherwise interact with the Macyou platform and services.
Macyou collects only what is necessary to deliver and operate its services. Macyou does not sell personal data. Personal data may be transferred as part of a merger, acquisition, financing or sale of assets, subject to this policy.
2. Information We Collect
Account Data
When you register, we collect your name and email address, and, if you set a password, a cryptographic hash of it. Passwords are not stored in readable form. If you sign in via an OAuth provider, we receive the profile information that provider releases under the scope you approve.
Server & Usage Data
We log actions taken within your account: server provisioning and termination events, SSH key additions, API calls, dashboard page views, and billing operations. This data is held in a managed relational database and used for activity auditing, billing accuracy, and support.
Payment Data
We accept payment in cryptocurrency (USDT on the TRON / TRC-20 network) through our third-party payment provider NOWPayments, on an invoice-per-period basis. Macyou does not collect or store card numbers or bank details. In connection with a payment we process the on-chain wallet address, transaction hash, payment and invoice identifiers, amount, and status; NOWPayments processes the underlying crypto transaction under its own privacy policy. Transaction records are retained for 7 years to meet accounting and anti-money-laundering obligations.
Technical & Log Data
Our infrastructure providers (Vercel for hosting, Upstash Redis for rate limiting) automatically collect certain technical data: IP addresses, browser user-agent strings, HTTP request paths, response codes, and timestamps. IP addresses are held transiently for rate-limiting purposes and may appear in server access logs for up to 90 days.
Cookies
We set a session cookie when you log in (see Section 9 for details). No third-party advertising or analytics cookies are placed on your device.
3. How We Use Information
- Service delivery: Provisioning, managing, and monitoring your Mac Mini servers; authenticating your identity; routing API requests.
- Billing: Generating invoices, processing payments, and maintaining financial records required by Georgian tax law.
- Support: Diagnosing technical issues, responding to support tickets, and auditing account activity logs.
- Security: Detecting abuse, enforcing rate limits, investigating suspicious activity, and protecting platform integrity.
- Communications: Sending transactional emails (server status alerts, invoices, password resets) via Resend. We do not send marketing emails without your explicit opt-in.
- Platform improvement: Aggregated, anonymized usage patterns help us improve performance and plan new features. We do not profile individual users for advertising.
4. Legal Basis for Processing
Under the GDPR and equivalent frameworks, we process personal data on the following legal bases:
| Processing activity | Legal basis (GDPR Art. 6) |
|---|---|
| Account creation & authentication | Performance of contract (Art. 6(1)(b)) |
| Server provisioning & management | Performance of contract (Art. 6(1)(b)) |
| Billing & invoicing | Performance of contract + Legal obligation (Art. 6(1)(b), (c)) |
| Transactional emails (alerts, invoices) | Performance of contract (Art. 6(1)(b)) |
| Security monitoring & rate limiting | Legitimate interest (Art. 6(1)(f)) — platform integrity |
| Fraud prevention (Turnstile, IP logging) | Legitimate interest (Art. 6(1)(f)) — fraud prevention |
| Abuse prevention & AUP enforcement | Legitimate interest (Art. 6(1)(f)) — network safety |
| Marketing emails & product updates | Consent (Art. 6(1)(a)) — opt-in only |
| Tax record retention (7 years) | Legal obligation (Art. 6(1)(c)) — Georgian tax law |
| Terms acceptance logging | Legal obligation (Art. 6(1)(c)) — contract evidence |
5. Data Sharing & Sub-processors
We do not sell, rent, or trade your personal data. We share data only with the sub-processors listed below, each bound by data processing agreements, and only to the extent necessary:
Server-side request logs, access logs, deployment artifacts.
All structured application data (accounts, servers, invoices, activity logs).
IP addresses and request counters (short TTL).
Your email address and the content of transactional messages.
Wallet address, transaction hash, and payment/invoice identifiers and amounts.
Connection metadata and encrypted desktop/SSH traffic routed to your rented Mac.
Error events, stack traces, and diagnostic breadcrumbs (text masked).
Where identity verification is required: identity document, selfie and liveness capture, processed and stored by the provider. Macyou does not store identity documents.
Content of support-chat conversations processed to generate AI assistant replies. Replies may be reviewed by Macyou personnel.
We may also disclose data where required by applicable law, court order, or governmental authority, and only to the extent legally compelled. Our Law Enforcement Request Policy explains what data we hold, the legal basis we require, and when we notify you before disclosing anything.
6. Data Storage & Security
Application data is held in a managed relational database. Credentials and secrets stored by Macyou are encrypted at rest. Passwords are stored only as cryptographic hashes and are not held in readable form.
Traffic between your browser and the platform is encrypted in transit using current TLS versions.
Access to production systems is restricted to authorised Macyou personnel. Macyou maintains an incident response process. Where a personal data breach affects your personal data, Macyou will notify you in accordance with applicable law.
7. Data Retention
| Data category | Retention period | Basis |
|---|---|---|
| Account data | Duration of account + 7 days after deletion request | Contract performance |
| Server credentials (SSH/VNC) | Duration of server lifecycle, encrypted at rest (AES-256-GCM) | Contract performance |
| Activity logs | retained for 90 days, then purged | Legitimate interest (security) |
| Terms acceptance records | 7 years | Legal obligation |
| Invoices & financial records | 7 years (Georgian tax law) | Legal obligation |
| Rate-limiting data (Redis) | 60 seconds to 1 hour (TTL) | Legitimate interest (security) |
| Server access logs (Vercel) | Up to 90 days (Vercel policy) | Legitimate interest (security) |
| IP addresses (registration) | Duration of account | Legitimate interest (fraud prevention) |
| Machine assignment records (which account held which machine, with assignment and release timestamps) | retained for 12 months after the machine is released; retained independently of the account | Legitimate interest (security, abuse attribution) / legal obligation |
| Data export requests | 7 days after delivery | Contract performance |
When you request account deletion, your personal data is anonymized within 7 days of the request. Financial records required by Georgian tax law are retained for 7 years with customer-identifying fields redacted. Machine assignment records (which account held which physical machine, and when) are retained for 12 months after the machine is released, independently of the account: as an infrastructure provider we must be able to respond to an abuse complaint or a lawful request about a past tenant.
8. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
Access
Request a copy of the personal data we hold about you.
Correction
Ask us to correct inaccurate or incomplete data.
Deletion
Request erasure of your personal data, subject to legal retention requirements.
Export / Portability
Receive your data in a machine-readable format.
Objection
Object to certain processing activities, including direct marketing.
Complaint
Lodge a complaint with a data protection authority in your jurisdiction.
Self-service options
You can exercise your right to data export, account deletion, and email preference management directly from your Dashboard → Settings page — no email required.
For all other requests, email privacy@macyou.co. Macyou will respond within the period required by applicable law. Macyou may need to verify your identity before processing the request.
10. International Transfers
Macyou LLC is registered in Georgia. Our production infrastructure (dedicated Apple Silicon nodes) is located in our Tbilisi, Georgia data center. Our sub-processors (listed in Section 5) may store or process data in the United States and/or the European Union, depending on the data center regions they use.
Where personal data originating in the EEA is transferred to sub-processors in the United States or other countries without an EU adequacy decision, we rely on the EU Standard Contractual Clauses (SCCs) 2021, Module 2 (Controller-to-Processor) executed with each sub-processor. For personal data originating in the United Kingdom, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, as applicable.
Our Data Processing Agreement is available to all customers and incorporates the SCCs by reference, with Annexes I–III populated.
11. Children's Privacy
Macyou is a professional cloud infrastructure platform intended solely for users who are 18 years of age or older. Macyou does not knowingly collect personal data from anyone under the age of 18. If you believe such data has been collected, contact privacy@macyou.co and Macyou will delete it.
12. Changes to This Policy
Macyou may update this Privacy Policy from time to time. Where a change is material, Macyou will give notice by email to the address on the account or by a notice on the platform at least 30 days before it takes effect. Continued use of the platform after that date constitutes acceptance of the updated policy.
13. Contact Us
For privacy-related questions, data subject requests, or to report a concern, please contact:
Company: Macyou LLC (entity ID 445839503)
Jurisdiction: Georgia
Privacy contact: privacy@macyou.co
Website: macyou.co
EEA data subjects: eu-rep@macyou.co — see /legal/imprint.
UK data subjects: uk-rep@macyou.co
Version 2.6, effective September 14, 2026. Previous versions are available on request at privacy@macyou.co.