Version 1.1. In effect from 10 September 2026. Changes from 1.0: Resend added as the email provider; sign-in described as codes and passkeys rather than passwords.
This policy covers two groups of people, and our responsibilities are genuinely different for each. It is worth two minutes to understand which one you are.
If you run a business on MakerBay, we decide how your account information is handled, so we are what data protection law calls the controller. This policy is our agreement with you about it.
If you are a customer of a business that uses MakerBay — you booked a plumber, you were sent a quote — then that business decided to store your details, not us. They are the controller. We are the processor: we hold and handle the information on their instructions and do nothing else with it.
That matters practically. If you want a business to delete what it holds about you, ask that business, because it is theirs to delete. If you cannot reach them, contact us and we will help you get to them.
Only what the business put in, or what the customer gave the business: typically a name, an email address or phone number, an address if there is a job at one, what they asked for, and the history of the messages and documents between them.
We also record whether an email reached them. If a message bounces or somebody marks it as spam, we record that against the address so we stop sending to it. This exists to protect people from being emailed repeatedly by a business that cannot reach them.
That record is kept per business, not across all of them. Two tradespeople may share a customer, and one business’s bounce must not silence that address for another business with its own relationship.
We do not use anyone’s data for advertising, and we do not build profiles of your customers.
MakerBay runs on Amazon Web Services in the US East (Northern Virginia) region. So if your business is in Australia, the United Kingdom, the European Union, Canada or New Zealand, your data and your customers’ data are stored in and accessed from the United States.
We are stating that prominently rather than burying it, because it is the single fact in this policy most likely to matter to you. Australian Privacy Principle 8 requires us to disclose it.
UK and EU law needs more than a disclosure: it needs an approved transfer mechanism. There are two separate steps to cover. The step from us to our infrastructure providers is covered by the standard contractual clauses in our agreements with Amazon Web Services, Stripe and Resend. The step from you to us needs clauses between you and us, which is what our Data Processing Agreement is for. If you are a UK or EU business, ask us for it before you sign up and we will put it in place.
If your business needs its data kept inside a particular country, tell us before you sign up, because right now we cannot offer that.
The complete list. There is no one else.
The full detail, including what each one handles and where, is on the sub-processors page, which is generated from a single list so it cannot drift from what this page says. We will update it before adding anyone, not after, and give 30 days' notice. We may also disclose information if the law genuinely requires it, and unless we are forbidden from doing so, we will tell you first.
This includes the small things. The fonts on your booking page and help centre are served from our own servers rather than Google’s, so loading one of your pages does not tell Google that your customer visited it. Most websites get this wrong without realising, and we did too until August 2026, when we found it and fixed it.
If our business is ever sold, data may transfer with it. You would be told, and this policy would continue to apply until you were given notice of a new one.
The assistant that answers enquiries on your booking page uses a Claude model from Anthropic, run through Amazon Bedrock inside our own AWS account.
No decision with a legal or similarly significant effect on anybody is made automatically. The assistant answers questions and takes booking details; a person decides about the work.
Email is sent through Resend and text messages through Amazon Pinpoint. We record whether each one was delivered, bounced, or was reported as spam, so a business can see that a customer never got their invoice, and so we stop sending to addresses that do not work.
Optional messages, meaning review requests and the daily digest, carry an unsubscribe link and the one-click unsubscribe that Gmail and Apple Mail show. Acting on it is immediate and needs no confirmation step.
Messages you are waiting for, such as a quote, an invoice, a booking confirmation or a sign-in code, do not carry an unsubscribe link, because opting out of the document you are waiting for is not a useful choice. To stop those, ask the business directly.
This website sets no cookies. There is no Google Analytics, no advertising pixel, and no third-party tracker of any kind on it. That is why you have not been shown a cookie banner: there is nothing to consent to.
We do count page views, and it would be dishonest to leave that out. A small script of our own records which page was opened and the website you came from — just the site, never the full address. It sets no cookie, stores nothing on your device, and creates no identifier, so it cannot tell one visitor from another or follow anyone between two pages. What it produces is a daily total per page. If your browser sends a Do Not Track signal we skip it entirely. You can read the whole script at makerbay.app/assets/stat.js?v=2.29.0 — it is about forty lines.
When you sign in to the app, your browser keeps a session cookie so you are not asked for a code on every page. It is marked so that scripts on the page cannot read it, it is not a tracking cookie, it expires after seven days, and signing out removes it. If you choose to sign in with a fingerprint or face, the passkey stays on your device; we hold only its public half, which cannot be used to sign in.
Wherever you live, you can ask us to:
Email support@makerbay.app. We answer within 30 days and we do not charge for it. We may need to check who you are first, which protects you.
If you are a customer of a business that uses MakerBay, send your request to that business. If they do not respond, contact us and we will help.
No system is perfect. If a breach affects you, we will tell you and the relevant regulator within the time the law requires, and we will tell you what actually happened rather than a form of words.
MakerBay is for businesses and is not intended for anyone under 18. We do not knowingly collect data about children. If a business has recorded a child’s details as part of a job, that is the business’s responsibility under its own obligations.
We will post a new version here with a new date. If a change materially affects how we handle your information, we will email you at least 30 days beforehand.
Email support@makerbay.app, or write to Appa Technologies Pty Ltd, 4 Greenwood Place, Freshwater NSW 2096, Australia.
If you are not happy with our answer, you can complain to a regulator. In Australia that is the Office of the Australian Information Commissioner (oaic.gov.au). In the United Kingdom it is the Information Commissioner’s Office (ico.org.uk). In the European Union it is your national data protection authority. We would rather you told us first and gave us the chance to fix it.