In short
We don't sell your data. We never sell personal data and we never share it with data brokers. MakerStudio is paid for by institutional subscriptions, not by advertising.
Learners never see advertising. That will not change. No ads to learner or avatar accounts, or to anyone under 18 — ever, whatever else changes about how MakerStudio is funded. Learner data is never used to choose an ad, not even one shown to an adult.
There is no advertising anywhere in MakerStudio today. We may in future promote our own products, or placements sold directly to relevant suppliers, to adults on free or trial accounts — never inside a school's paid subscription. If that happens we will tell you 30 days beforehand (section 14).
No ad networks, ever, for anyone. No tracking pixels, no behavioural targeting, no profiling, and no sharing or sale of personal data with advertisers. There is no advertising or analytics tag anywhere on our site: our website statistics come from Plausible, which sets no cookies and builds no profiles.
We don't train AI on your work. Your designs and learner work are not used to train, fine-tune or evaluate machine-learning or generative-AI models, and our service providers are not permitted to do so.
Your work is private by default. Designs are visible only to you until you choose to share them. Within a school, learner work is visible to that school's administrators and the coaches responsible for that learner — not to other learners, unless it is shared through an activity or team.
Schools can use MakerStudio without giving us learner names at all. Anonymous avatar accounts are designed to hold no learner name and no contact details — which matters most for the youngest learners, from K1 upwards.
Your account and your designs are stored in Europe. The platform runs on OVHcloud infrastructure in Frankfurt, Germany, and our Odoo CRM is self-hosted on our own OVHcloud infrastructure in Europe. A small number of providers help us deliver the service — for example sending your verification email — and not all of them are European companies. We name every one of them, and what they do, in section 8.
We keep as little as possible, for as short as possible. Every category of data has a retention period, listed in section 9.
We say what we can evidence. We do not hold a privacy certification or seal, and we do not claim one. What we describe below is what we actually do.
1. Who we are
MakerStudio is operated by Fablab Factory BV, Capucienenlaan 88, 9300 Aalst, Belgium, company and VAT number BE 0700.541.423. We are the data controller for the processing described in section 3.
Data-protection contact. For questions about this statement, to exercise your rights, or for any other data-protection matter, contact privacy@makerstud.io, or write to us at the address above marked "data protection". For everything else: hello@makerstud.io.
2. What this statement covers
This statement covers:
-
the MakerStudio websites, including
launch.makerstud.io; - the free Design Trial (adults 18+, Design pillar only);
- institutional subscriptions, including administrator, coach, learner and anonymous-avatar accounts;
- our email and support communications.
It does not cover third-party websites we link to, which have their own policies.
3. Our role: controller or processor
| Situation | Who is the controller | Our role |
|---|---|---|
| You register for a Design Trial yourself | We are | Controller |
| You visit our website or contact support | We are | Controller |
| A school creates coach, learner or avatar accounts and uses MakerStudio to run classes | The school is | Processor, acting on the school's documented instructions |
| We keep our own service logs, security records and billing records | We are | Controller |
Where we act as processor, our obligations will be set out in a Data Processing Agreement (DPA) with the institution, reflecting Article 28 GDPR. That agreement is currently in preparation. Institutions can ask about its status, and request a copy once it is available, at privacy@makerstud.io.
Each institution remains responsible for its own compliance: having a lawful basis to process learner data, informing learners and parents or guardians, setting its own retention and access rules, and handling requests from its own learners. We assist as required under Article 28.
4. What we collect
a. Design Trial registration (adults)
First name, last name, email address, organisation name, country, organisation type, role, adult confirmation, and acceptance of the terms and this statement. Optionally: organisation website or directory page, and marketing consent.
Your password is not collected on the public form. You set it after you click the verification link, when your account is created.
b. Post-registration survey (optional)
Fabrication process, machine brand and machine model — including "I do not know the model". Used to understand which machines educators use.
c. Account and usage data
Account identifiers, verification and trial-expiry status, referral relationships (who invited whom, and whether the invitee has exported an SVG), sign-in timestamps, language and interface preferences.
d. Your designs and files
The designs you create, the images and SVG files you import, file names, folder structure, and export history.
e. Learner and avatar accounts (institutional subscriptions)
Learners span the full school range, from K1 (around five years old) through grade 12. These accounts are created by the institution, not by us, and never by the learner. What is stored depends on the institution's choice:
- Learner account: the identifiers the institution enters — typically a name or class identifier and, if the institution chooses, an email address; plus the learner's designs, activity participation and team membership.
- Anonymous avatar account: an identifier chosen by the institution (for example "Avatar 12"), plus designs and activity data. No learner name, no email address, no date of birth.
We ask institutions to enter the minimum needed. We do not require or provide a field for a learner's date of birth, home address, telephone number or photograph, and the Service is not designed to store them. For primary-age classes in particular, avatar accounts let a school run MakerStudio while giving us no learner identity at all — see section 6.
f. Support and correspondence
Emails you send us and our replies, and any information you include in them.
g. Technical and security data
IP address, browser and device type, and server logs (timestamps, requests handled by our infrastructure, and error traces) used for security, abuse prevention and debugging. These logs are kept for the period in section 9.
h. Website analytics
We use Plausible Analytics — privacy-friendly, cookieless, with no cross-site tracking and no personal profiles. It gives us aggregate figures such as page views, referrer and country, and it runs on EU infrastructure. We do not use Google Analytics or any other advertising-network analytics on our websites.
i. Billing (institutional subscriptions)
Organisation name, billing address, VAT number, contact person, purchase-order and invoice records. We do not store full payment-card numbers.
What we do not collect
No advertising, retargeting or cross-site tracking identifiers — and we would not add them, because any future promotion will be non-behavioural (see Advertising at the end of section 5). No biometric data. No location tracking beyond country-level inference from IP. No special-category data (health, religion, ethnicity, political opinion, trade-union membership, sexual orientation) — please do not put such data into designs, file names or account fields.
5. Why we use it, and our legal basis
| What we do | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Create and run your trial or subscription account | 4a, 4c, 4d | Contract — Art. 6(1)(b) |
| Send service emails: verification, welcome, expiry warnings, deletion notice | 4a, 4c | Contract — Art. 6(1)(b) |
| Store, render, back up and export your designs | 4d | Contract — Art. 6(1)(b) |
| Provide support | 4a, 4f | Contract / legitimate interests — Art. 6(1)(b), (f) |
| Keep the Service secure, prevent abuse, debug faults | 4c, 4g | Legitimate interests — Art. 6(1)(f) |
| Understand which machines educators use, to prioritise development | 4b | Consent (the survey is optional) — Art. 6(1)(a) |
| Aggregate website analytics | 4h | Legitimate interests — Art. 6(1)(f); no cookies, no profiling |
| Marketing emails about MakerStudio | 4a | Consent — Art. 6(1)(a); withdraw at any time |
| Run the referral extension programme | 4c | Contract — Art. 6(1)(b) |
| Invoicing and statutory bookkeeping | 4i | Legal obligation — Art. 6(1)(c) |
| Process learner and avatar data for a school | 4e | The school's basis; we act on its instructions — Art. 28 |
Balancing. Where we rely on legitimate interests, we have considered your interests and rights and limited the processing accordingly. You can object at any time (section 10).
No automated decision-making. We do not use automated decision-making or profiling that produces legal or similarly significant effects.
Advertising
There is no advertising in MakerStudio today. We are setting out our position in full so that you know what can and cannot change later.
What will never change:
- No advertising is ever shown to a learner or avatar account, or to any account belonging to a person under 18. This is unconditional and permanent. It does not depend on how MakerStudio is funded, on which subscription a school holds, or on what a role happens to be called.
- Learner data is never used to target, select or measure advertising — including advertising shown to an adult. A coach will never see a promotion chosen because of what their class designed.
- We will never use an advertising network, a tracking pixel, behavioural targeting or profiling, and we will never sell or share personal data with an advertiser. None of the providers listed in section 8 process your data to select, target or measure advertising.
What we may do in future: promote our own products, features and events, and show placements sold directly by us to relevant suppliers such as machine and material vendors. If we do, it will be:
- shown only to adults on free or trial accounts — never inside a school's paid institutional subscription, where our Data Processing Agreement commits us not to advertise;
- never behaviourally targeted. At most it would be selected using information you gave us knowingly — your role, your country, or the optional machine survey — and never by tracking what you do;
- never placed on the design canvas, or in any full-screen or presentation view, because a teacher's screen is often projected to a classroom of children; and
- announced 30 days in advance as a material change to this statement (section 14).
Until then, the answer to "does MakerStudio show ads?" is simply no.
6. Children and learners (K1–12)
MakerStudio is used in classrooms by learners from K1, around five years old, through grade 12. Some of our users are therefore very young children, and the design principle throughout is to hold as little about them as a lesson actually requires.
- Children never register themselves. There is no route for a learner of any age to create an account. The public Design Trial is for adults 18+ and its signup form requires confirmation of adult status; every learner account is created by the school.
- A school can use MakerStudio without giving us a single learner's name. Anonymous avatar accounts hold an identifier the school chooses and nothing else. This is what we recommend for primary classes, and it is the reason the feature exists.
- The school is the data controller for learner data (section 3). It decides the lawful basis, decides how much to enter about each learner, and is responsible for informing learners and their parents or guardians. We support the school in doing so and will provide the information it needs.
- No marketing, no advertising, no profiling, no AI training — ever, for any learner. We do not send marketing email to learner or avatar accounts, we do not build behavioural profiles, and learner work is never used to train or evaluate machine-learning models. This is permanent. Should we ever show promotional content to adult users, it will never appear to a learner or avatar account, it will never be chosen using learner data, and it will never appear on the design canvas or in a presentation view — because a teacher's screen is often projected to a class. See Advertising at the end of section 5.
- Visibility is narrow by default. A learner's work is visible to the school's administrators and to the coaches responsible for that learner. It is not visible to other learners unless the learner's work is shared through an activity or team, and it is never public by default. There is no public gallery.
- Deletion. A school can delete a learner account, a class, or an individual design from within the platform. On request we will confirm a deletion in writing.
- Minimum age for a self-created account. No one below the age of digital consent in their country (13 in Belgium; 13–16 across the EEA) may hold a self-created account. In practice all self-created accounts are 18+, and all learner access runs through a school.
7. Where your data is stored
The MakerStudio platform, its database and its file storage run on OVHcloud infrastructure in Frankfurt, Germany. OVHcloud is a European company. Our Odoo CRM, which holds trial registrations and customer records, is software we host ourselves on OVHcloud infrastructure in Europe — it is not a hosted service operated by someone else.
Your account data, your designs and your files are stored in Germany, inside the European Economic Area.
Delivering the service involves a small number of other providers, and not all of them are European companies. Two are worth naming here directly, and both are in the table in section 8:
- Email delivery. Verification, welcome, expiry and password-reset messages are delivered through Amazon Simple Email Service, which processes the recipient's name and email address in order to send them.
- Web font. The MakerStudio application loads a typeface from Google's font servers. That request transmits the visitor's IP address to Google. It sets no cookie and is not used for advertising or analytics, but it is a transfer and we would rather tell you than leave it out.
Where a provider processes personal data outside the EEA, we rely on an adequacy decision or on Standard Contractual Clauses with supplementary measures. If we add such a provider, we will update section 8 before doing so.
8. Who else processes your data
We do not sell personal data, and we do not share it for advertising — and that stays true if we ever show promotional content, because a directly-sold placement means an advertiser buys space, not data (see Advertising at the end of section 5). Because we host the platform and the CRM ourselves, the list of outside companies that process personal data on our behalf is short. Each is bound by a written contract and may process data only on our instructions. None of them processes your data to select, target or measure advertising.
| Service provider | What it does | Where |
|---|---|---|
| OVHcloud | Infrastructure: hosting, database, file storage, backups | Frankfurt, Germany (EU) |
| Amazon Web Services — Amazon SES | Delivery of service email (verification, welcome, expiry and password-reset messages). Processes the recipient's name and email address | US company; transfers covered by an adequacy decision or Standard Contractual Clauses |
| Plausible Analytics | Cookieless website statistics — no cookies, no profiles, no cross-site tracking | EU |
| Serves the typeface used by the MakerStudio application. Receives the visitor's IP address as part of that request. No cookie is set, and the request is not used for advertising or analytics | US company; transfers covered by an adequacy decision or Standard Contractual Clauses |
Self-hosted, so not third parties: the MakerStudio application and the Odoo CRM and email automation run on our own OVHcloud infrastructure. Odoo is software we operate, not a processor we send your data to.
We also disclose personal data where we are legally required to — for example to a competent authority acting under a valid legal request — and, if we are ever involved in a merger or acquisition, to the acquiring party under confidentiality, with notice to you.
9. How long we keep it
We keep each kind of record only as long as we need it, and no longer. This is what that means in practice.
| Data | How long we keep it |
|---|---|
| Design Trial account and designs | Account locks 42 days after email verification; account and files deleted 90 days after expiry |
| Warning before deletion | We email you 30 days after expiry, and again before deletion |
| Individual designs you delete yourself | Removed from the live service immediately; purged from backups within 30 days |
| Account deletion on request | Actioned within 30 days; backups purged within a further 30 days |
| Institutional accounts, including learner and avatar accounts | For the subscription term, then deleted — subject to the DPA and the institution's instructions. Where circumstances reasonably allow we give the institution an opportunity to export first, and tell it how long it has |
| Registration record for someone who signed up but never verified their email | 6 months |
| Customer-relationship record for a former trial user | 24 months from last contact, unless a subscription follows |
| Marketing consent, and our record that you gave it | Until you withdraw consent; the proof-of-consent record for 3 years afterwards |
| Support correspondence | 24 months |
| Server and security logs | 90 days |
| Invoices and accounting records | 7 years (Belgian statutory bookkeeping period) |
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you, and receive a copy;
- rectify data that is inaccurate or incomplete;
- erase your data ("right to be forgotten");
- restrict processing in certain circumstances;
- object to processing based on legitimate interests, and to object to direct marketing at any time;
- data portability — receive your data in a structured, commonly used, machine-readable format. For designs, you can also export SVG directly from the platform at any time;
- withdraw consent at any time, without affecting processing already carried out.
How to exercise them: email privacy@makerstud.io. We respond within one month, and will tell you if we need to extend that by up to two further months for a complex request. We may ask you to confirm your identity. Exercising your rights is free unless a request is manifestly unfounded or excessive.
If your account was created by a school, please contact the school first — it is the controller for that data. If you contact us instead, we will pass the request on and support the school in answering it.
Complaints. You can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, +32 2 274 48 00, contact@apd-gba.be, www.dataprotectionauthority.be — or with the supervisory authority in your own EEA country. We would appreciate the chance to resolve it with you first.
11. Cookies and similar technologies
We use as few as possible.
| Type | Purpose | Consent needed |
|---|---|---|
| Session / authentication cookie | Keeps you signed in | Strictly necessary — no consent required |
| Security cookie (e.g. CSRF token) | Protects against request forgery | Strictly necessary — no consent required |
| Preference cookie | Remembers interface language and settings you choose | Strictly necessary / functional |
| Analytics | Plausible — no cookies, no cross-site tracking, no personal profiles | Not required, because no cookies are set and no personal data is used to profile you |
We do not use advertising, retargeting or social-media tracking cookies, and there are no third-party ad pixels on our site. Because we use no non-essential cookies, we do not need to interrupt you with a cookie consent banner — which is one of the reasons we chose cookieless analytics. This holds even if we later show promotional content: because it would not be behaviourally targeted, it introduces no tracking cookie and no banner.
One external request is worth naming even though it sets no cookie: the MakerStudio application loads its typeface from Google's font servers, which receives the visitor's IP address. It is listed in section 8 and explained in section 7.
12. Security
We apply measures appropriate to the risk, in line with Article 32 GDPR:
- Encryption in transit — all traffic over HTTPS/TLS.
- Encryption at rest for stored data and backups.
- Passwords are hashed and never stored in readable form.
- Session tokens are held in cookies that cannot be read by scripts in the browser, are sent only over HTTPS, and are scoped to our own site.
- Access control — staff access to production data is limited to those who need it for their role, and is logged.
- Multi-factor authentication on administrative and infrastructure accounts.
- Tenant isolation — trial accounts are provisioned into an isolated trial institute, separate from institutional customers' data.
- Backups taken regularly, with retention as described in section 9.
- Monitoring and logging of security-relevant events.
- Patching of platform components and dependencies.
- Written contracts with our service providers requiring equivalent measures.
- Self-hosting — running the platform and the CRM on our own European infrastructure means fewer outside parties hold your data at all (section 8).
What we do not claim. We do not hold an ISO 27001 certification, a SOC 2 report or a privacy seal, and we do not claim one. We have not published the results of an external penetration test. We would rather tell you exactly what we do than point at a badge.
No online service can be completely secure. Please use a strong, unique password, and tell us at privacy@makerstud.io if you suspect unauthorised access to your account or you find a security issue. We welcome good-faith security reports and will not pursue researchers who report responsibly and do not access, alter or exfiltrate other users' data.
13. Personal data breaches
If a personal data breach occurs, we will:
- investigate and contain it without undue delay;
- notify the competent supervisory authority within 72 hours of becoming aware, where the breach is likely to result in a risk to individuals (Art. 33);
- inform affected individuals without undue delay where the breach is likely to result in a high risk (Art. 34);
- notify the institution without undue delay where we are acting as its processor, so it can meet its own obligations (Art. 33(2));
- record the facts, effects and remedial action taken.
14. Changes to this statement
We will publish any updated version here with a new "Last updated" date. For changes that materially affect how we handle your personal data, we will notify registered users by email at least 30 days before they take effect. Introducing advertising of any kind counts as a material change and carries that notice. Previous versions are available on request.
15. Contact
Fablab Factory BV, Capucienenlaan 88, 9300 Aalst, Belgium · company/VAT number BE 0700.541.423
Privacy questions and data-subject requests: privacy@makerstud.io
General support: hello@makerstud.io
Related documents: Terms of Service · Privacy FAQ for schools (in preparation) · Data Processing Agreement (institutions — in preparation)