MacNeatMacNeat is designed to work on your Mac, not on our servers. This page explains, without jargon, what data we process to run your account and your licence.
Data controller
Novadesko SRL, Rue de Boussoit 4, 7110 Maurage, Belgium — CBE BE 1018.192.568.
Contact for any question about your data: privacy@novadesko.com.
What stays on your Mac
Scans (caches, files, apps, privacy, disk space, cloud services) run locally. The contents and names of your files are not sent to our servers. Connections to cloud services (iCloud Drive, Google Drive, OneDrive, Dropbox) are made directly between your Mac and those services.
Data we collect
- Account: name, email address, password (stored hashed), language, security settings (two-factor authentication).
- Devices: device identifier (hashed), Mac name and model, macOS and app versions, IP address and derived country, activation and last-seen dates.
- Licence and payments: plan, status, renewal dates, payment history. Payments are processed by Stripe: we never store card details.
- Usage telemetry: anonymous usage statistics (modules used, errors), not linked to your identity.
- Technical logs: requests sent to our servers (date, IP address, page or API endpoint, response code), for security purposes.
Purposes and legal bases
- Creating and managing your account, activating and checking your licence on your Macs: performance of the contract.
- Invoicing and bookkeeping: legal obligation.
- Securing the service, preventing fraud and abuse (logs, rate limiting): legitimate interest.
- Improving the app through anonymous telemetry: legitimate interest.
- Sending service emails (confirmation, security, billing): performance of the contract.
Retention periods
- Account, licence and devices: for as long as your account exists. A revoked device stays visible in your history until the account is deleted.
- Request logs: 90 days.
- Accounting records (invoices, payments): 10 years, anonymised after account deletion, as required by Belgian accounting law.
- Telemetry: anonymous data, kept as statistics.
Processors and recipients
- OVH SAS (France): server hosting.
- Stripe (Ireland, part of Stripe Inc., USA): payments and billing portal.
- Google and Apple: only if you choose to sign in with these accounts; we then receive your name and email address.
Where data is transferred outside the European Union (Stripe, Google, Apple), the transfer is covered by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses. We never sell or rent your data.
Your rights
You have the right to access, rectify, erase, restrict, object to and port your data.
- Export: download all your data as JSON from your account (“Export my data”).
- Deletion: delete your account yourself from your account page; erasure is immediate.
- Other requests: write to privacy@novadesko.com. We reply within one month.
Complaints
If you believe your rights are not being respected, you can lodge a complaint with the Belgian Data Protection Authority (APD/GBA), Rue de la Presse 35, 1000 Brussels — dataprotectionauthority.be.
Security
Encrypted connections (HTTPS), hashed passwords and device identifiers, optional two-factor authentication, automatic sign-in rate limiting and cryptographically signed licences.
Changes
We may update this policy. If there is a significant change, we will let you know by email or in the app.