This Privacy Policy explains how MC Studio processes personal data when MC Studio acts as a controller.

MC Studio is a trade name of REVE Media, registered with the Dutch Chamber of Commerce (KVK) under number 88874990, VAT identification number NL004665647B65, with its business address at Diamantdreef 16, 7828 AW Emmen, the Netherlands.

Privacy contact: privacy@mcstudio.io Phone: +31 6 27582254

1. Scope

This policy applies to personal data processed through:

mcstudio.io and related MC Studio websites;
account registration and authentication;
CRM, workspace and, where released, CAD/CAM use;
waitlists, demo requests and contact forms;
billing and subscriptions;
customer support and complaints;
security, authentication and technical operation of the Service; and
marketing where permitted.

MC Studio currently has no separate third-party analytics provider, no separate error-monitoring provider and no customer-facing AI provider in its core application stack. If relevant processing changes, we will update this policy and the Cookie Policy and provide any additional notice or obtain any consent required before the new processing begins.

When a Business Customer stores personal data about its own customers, prospects, employees, suppliers or other contacts in MC Studio, that Business Customer will normally be the controller and MC Studio will normally act as processor. The MC Studio Data Processing Agreement governs that processing where required.

2. Personal data we may process

Depending on how you use MC Studio, we may process the following categories.

2.1 Account and identity data

Name, email address, account identifiers, company/workspace, role, language and account settings.

2.2 Business and billing data

Company name, billing address, country, VAT number, KVK/company registration number, subscription, invoice and transaction information.

Payment-card data is generally processed directly by the payment provider. MC Studio normally receives transaction identifiers, payment status and limited billing information rather than full card details.

2.3 CRM and project data

Where entered into the Service: customer/prospect names, contact details, addresses, notes, site-visit information, project status, measurements, files, photographs, offers/quotes, tasks, reminders and other project information.

For Business Customer CRM data, MC Studio will often be acting as processor rather than controller.

2.4 CAD/CAM and workspace data

Project names, designs, dimensions, materials, hardware selections, construction settings, library usage, project metadata, export events and other workspace data.

2.5 Support and communications

Emails, support requests, complaint records, bug reports, demo/call information and correspondence.

2.6 Technical and security data

IP address, browser/device information, timestamps, session identifiers, authentication logs, security events, crash/error information and diagnostic data.

MC Studio does not currently use a separate third-party analytics provider in its core application stack. Necessary web/application logs and limited technical events may still be processed for security, service delivery and troubleshooting.

If optional website or product analytics are introduced later, the relevant data categories, provider and cookie/consent position will be disclosed before or when legally required.

2.8 Marketing data

Waitlist status, communication preferences, campaign engagement and information submitted through marketing or sales forms.

2.9 AI-feature data

MC Studio does not currently offer a customer-facing AI feature using an external AI provider. Customer Content is not sent to Anthropic, OpenAI or another AI provider as part of a current customer-facing AI feature.

If an AI feature is introduced later, MC Studio will describe the data used, provider/data flow, purpose, retention/training position and applicable legal basis before or when required.

3. Where personal data comes from

We obtain personal data:

directly from you when you create an account, contact us, purchase or use the Service;
from a Business Customer or workspace administrator who invites you or enters project/contact data;
automatically from your browser/device and use of the Service where lawful;
from payment, authentication and integration providers where needed to complete the requested function; and
from public business sources or a referral where relevant to a legitimate B2B sales relationship and permitted by law.

4. Why we process personal data and our legal bases

The legal basis depends on the purpose and context.

4.1 Contract performance and steps before a contract

To create and operate accounts, provide purchased Services, process orders, manage subscriptions, provide requested exports, respond to requested demos and deliver customer support where necessary for a contract with you or steps you request before entering one. Where you represent a business that is the contracting customer, necessary business-contact administration may instead be based on our legitimate interest in managing that relationship.

Information needed to create an account, supply a requested Service or meet a legal obligation must be provided for that purpose. Without it, MC Studio may be unable to provide the requested account, transaction or Service. Optional information is identified as such where it is collected.

4.2 Legitimate interests

Where appropriate and balanced against your rights, MC Studio may process data to:

secure the Services;
prevent fraud and abuse;
diagnose errors;
improve performance and reliability;
understand how supported product functions are used;
maintain business relationships;
establish, exercise or defend legal claims; and
operate and improve MC Studio responsibly.

4.3 Legal obligations

To comply with tax, accounting, sanctions, consumer-protection, data-protection and other legal obligations.

Where consent is required, for example for certain marketing communications, tracking cookies or a separate optional data use.

Consent may be withdrawn at any time without affecting processing that was lawful before withdrawal.

5. Customer Content and product improvement

MC Studio may use genuinely anonymous, aggregated statistics and limited operational/technical information to understand and improve the product, subject to applicable law. Replacing a name with an identifier does not by itself make personal data anonymous.

This does not authorise MC Studio to reuse private customer workspace content for unrelated analytics or extend its retention for that purpose. Where MC Studio holds personal data as a processor, any use, including creation of statistics, remains subject to the Controller's lawful instructions and the DPA.

MC Studio does not use private Customer Content, private CRM records, private customer designs or uploaded files to train general-purpose AI models by default.

Private Customer Content may be accessed or used only where reasonably necessary to:

provide the Service;
perform a customer-requested function;
respond to a support request;
secure or troubleshoot the Service;
comply with law; or
perform a separately agreed research/design-partner activity where the required legal basis or permission exists.

The absence of a separate third-party analytics/error-monitoring provider does not mean MC Studio processes no operational logs at all; necessary authentication, payment, hosting and security records may be generated by the current infrastructure providers.

6. AI providers

MC Studio does not currently use a customer-facing AI provider.

If MC Studio later introduces an AI-enabled customer feature, MC Studio will update the relevant product/privacy information and, where applicable, the DPA/subprocessor information before customer data is sent to that provider. Private Customer Content will not become general-purpose AI training data merely because an AI feature is introduced.

7. Recipients and service providers

MC Studio currently relies on the following core application providers:

Supabase - PostgreSQL database, Supabase Auth and file storage;
Vercel - hosting/application delivery;
Stripe - payment processing; and
Resend - transactional email, including system messages sent from notifications@mcstudio.io.

The Supabase production project is configured in an EU region. This is a hosting configuration, not a promise that all processing by every provider, including support and administrative access, occurs only within the EU.

MC Studio may also use business email and support-service providers for correspondence and request handling. Personal data may be disclosed to professional advisers such as lawyers, accountants and insurers where necessary and lawful, and to competent authorities where required by law.

MC Studio does not currently use a separate third-party analytics provider or separate error-monitoring provider in its core application stack.

Our Subprocessors page provides current provider information, including legal identities, purposes, relevant processing locations and international-transfer safeguards. Providers acting as independent controllers for particular activities are distinguished from subprocessors. In particular, Stripe may act as a processor or independent controller depending on the payment-related activity.

8. Subprocessors and Business Customer data

When MC Studio acts as processor, relevant service providers may be subprocessors.

The Data Processing Agreement governs their use. MC Studio will maintain a current subprocessor list and provide the contractual protections required by applicable data-protection law.

9. International data transfers

Some service providers may process data outside the European Economic Area.

Where required, MC Studio will use a lawful transfer mechanism such as:

an adequacy decision;
the European Commission Standard Contractual Clauses; or
another valid transfer mechanism,

and will apply supplementary measures where appropriate.

Our Subprocessors page identifies relevant processing locations and transfer mechanisms. You may contact privacy@mcstudio.io for information about the safeguards relevant to your data and, where applicable, a copy of them, subject to lawful redactions protecting confidential information or other people.

10. Retention

MC Studio retains personal data only as long as reasonably necessary for the relevant purpose, legal role and legal obligation.

10.1 Active accounts

Account and workspace data is generally retained while the account is active and as needed to provide the Service.

10.2 Cancelled or downgraded accounts

Archived or locked workspace data may be retained for up to 12 months as a recovery window, subject to:

a valid earlier deletion/erasure request;
MC Studio's processor obligations;
legal requirements; and
the separate account-deletion lifecycle.

10.3 Account deletion

A normal account-deletion request enters a 30-day recovery period intended to protect against accidental deletion. Unless a lawful retention ground applies, primary customer/workspace data is permanently deleted after that period and ordinary backup copies are deleted or expire within the same 30-day deletion lifecycle.

A valid GDPR erasure request may require MC Studio to permanently delete relevant data before that 30-day recovery period ends. MC Studio will not use the accidental-deletion recovery period as a blanket reason to delay a statutory erasure request.

10.4 Financial and tax records

Dutch accounting and invoice records are generally retained for at least 7 years. Records associated with certain EU VAT One Stop Shop arrangements may need to be retained for 10 years.

10.5 Support, security and legal records

These are retained only as long as reasonably necessary for the relevant support purpose, security investigation, legal claim or limitation period.

10.6 Marketing

Marketing contact data is retained until you unsubscribe, object, withdraw consent or the data is no longer needed, subject to retaining a limited suppression record where necessary to respect an opt-out.

11. Cookies and similar technologies

The Cookie Policy explains the cookies and similar technologies used by MC Studio.

Strictly necessary cookies may be used without consent where legally permitted.

Tracking and other non-essential technologies are not activated before valid consent where consent is required.

12. Children

People under 18 may use paid Services only with the permission of a parent/legal guardian or where they otherwise have legal capacity under applicable law.

Where MC Studio relies on consent for a service offered directly to a child under 16 in the Netherlands, parental or guardian authorisation is required.

Information directed specifically to children will be presented in clear, age-appropriate language where required.

MC Studio does not intentionally use a child's private Customer Content for targeted advertising.

13. Your privacy rights

Depending on applicable law and the context, you may have rights including:

access to your personal data;
correction of inaccurate data;
deletion;
restriction of processing;
objection to certain processing based on legitimate interests;
withdrawal of consent;
data portability;
information about recipients and international transfers; and
safeguards concerning certain solely automated decisions with legal or similarly significant effects.

To exercise a right, contact privacy@mcstudio.io. MC Studio responds without undue delay and normally within one month. Where necessary because of the complexity or number of requests, the period may be extended by up to two further months, as permitted by law. We will explain any extension and its reasons within the first month. Requests are normally handled free of charge; any refusal or reasonable fee for a manifestly unfounded or excessive request must meet the conditions of applicable law.

You may object at any time to processing of your personal data for direct marketing. If you object, MC Studio will stop using that personal data for direct marketing. Marketing emails also contain an unsubscribe route where required.

MC Studio may request reasonable information to verify your identity.

Where MC Studio acts only as processor, MC Studio may refer the request to the relevant Business Customer or assist that customer under the DPA.

14. Automated decision-making

MC Studio does not currently intend to make solely automated decisions about individuals that produce legal or similarly significant effects without the safeguards required by applicable law.

If this changes, MC Studio will update the relevant privacy information before such processing begins.

15. Security

MC Studio uses technical and organisational measures appropriate to the nature and risk of the data processed.

Measures may include access controls, secure authentication, encryption in transit, logging, backups, vulnerability management, workspace isolation and incident response, subject to the architecture actually deployed.

No online service can guarantee absolute security.

16. Personal-data breaches

MC Studio maintains an incident-response process.

Where MC Studio acts as controller, it will assess whether a personal-data breach must be notified to the Dutch Data Protection Authority and/or affected individuals within the periods required by law.

Where MC Studio acts as processor, it will notify the relevant Business Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data, as described in the DPA.

17. Marketing communications

Where required, MC Studio will send electronic marketing only with valid consent or another lawful basis.

You may unsubscribe using the link in a marketing email or by contacting privacy@mcstudio.io.

Transactional and legally required service communications may still be sent where necessary even if you unsubscribe from marketing.

18. Complaints

If you have a concern about how we handle your personal data, please contact privacy@mcstudio.io or legal@mcstudio.io so that we have an opportunity to investigate and try to resolve it.

You are not required to contact us or wait for our response before lodging a complaint with a competent supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens. Where applicable, you may also complain to a supervisory authority in the EU Member State of your habitual residence, place of work or the alleged infringement.

19. Changes to this policy

MC Studio may update this Privacy Policy to reflect legal, technical or product changes.

Material changes will be communicated where required. The current version and revision date remain available on the website. Where consent or another additional legal step is required for a change in processing, updating this policy alone does not replace that step.

20. Contact

MC Studio - a trade name of REVE Media Diamantdreef 16 7828 AW Emmen The Netherlands

KVK: 88874990 VAT ID: NL004665647B65 Email: privacy@mcstudio.io Phone: +31 6 27582254

MC Studio Privacy Policy