Privacy policy
Version 1.0 · 29 October 2026
In short. Aftermade is a service that businesses who make things to order use to run their workshop and to show their customers how their order is coming along.
If you run or work for a business that uses Aftermade, we are responsible for your account data, and this policy explains how we handle it.
If you are a customer of one of those businesses (you received a link to follow your order), the business is responsible for your data and we handle it only on its instructions. See section 3 and our notice for customers.
We don't sell personal data, we don't advertise, we don't use tracking cookies, and we keep data in the European Union wherever our providers allow.
- Who we are
- Our two roles
- Customers of businesses
- What we collect, why, and our legal basis
- Who processes data for us
- Transfers outside the EU
- How long we keep data
- Security
- Cookies and browser storage
- Your rights
- Complaints
- Children, automated decisions, changes
1. Who we are
Aftermade is a trading name of Daniel Brennan, a sole trader established in Ireland, of Unit B7, Smithstown Industrial Estate, Shannon, Co. Clare, Ireland ("Aftermade", "we", "us"). We expect to transfer the business to a company after the pilot; if so, we will update this policy and tell account holders.
Contact for anything about privacy: hello@aftermade.app. We are not required to appoint a Data Protection Officer, but this address reaches the person responsible for data protection.
2. Our two roles
- Controller (GDPR Article 4(7)) for: accounts of business owners and staff, our own website, support and billing, and our security and service records.
- Processor (Article 4(8)) for: everything a business puts into Aftermade about its customers and orders. The business is the controller. We act only on its documented instructions under our Data Processing Agreement (Article 28).
3. If you are a customer of a business that uses Aftermade
The business you ordered from decides what information about you is entered, why, and how long it is kept. Please contact that business first about your data. Its contact details are at the bottom of your order page. We will pass on any request that reaches us, and we help businesses answer requests (for example, by exporting or erasing a customer's data).
When you open your private order page we process: the page address (which contains a private code), the times of your visits, and whether you opened the carrier tracking link or saved your certificate (so the business can see the page is useful to you), a one-way scrambled version of your network address used only to stop abuse (deleted within 24 hours), and technical error reports with personal details removed. More in our notice for customers.
4. What we collect, why, and our legal basis
| Data | Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|---|
| Name, email address, password (stored only as a secure hash), two-step sign-in secret, role in a business | Creating and securing your account; letting you work in your business's workspace | (b) contract with you or your business; (f) legitimate interest in keeping accounts secure |
| Business details you enter (business name, address, colours, logo, opening hours, contact details) | Running the service and showing customers who they ordered from | (b) contract |
| Activity records (who recorded a workshop step, who changed a setting, when) | Audit trail for the business; security; resolving disputes | (f) legitimate interest; (c) where needed to meet legal obligations |
| Technical data: network (IP) address, browser type, time of requests, sign-in events | Security, preventing abuse, keeping the service running | (f) legitimate interest in a secure, working service |
| Error reports (what broke, where in our code, browser type) with personal details stripped before sending | Finding and fixing faults | (f) legitimate interest |
| Emails we send you (invitations, sign-in links, password resets) and their delivery status | Operating your account; proving delivery | (b) contract; (f) legitimate interest |
| Pilot requests from our website: your name, business name, email address, what you make and roughly how many orders a month | Replying to you and setting up your pilot | (b) steps you asked us to take before an agreement; (f) legitimate interest in answering enquiries |
| Correspondence with us; billing details for paid plans | Support; invoicing; tax and accounting records | (b) contract; (c) legal obligation (tax records) |
We do not use your data for advertising or profiling, and we do not sell it. We don't collect special categories of data (Article 9). Businesses must not enter such data about their customers (see our Terms).
Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time (see section 10).
5. Who processes data for us
We use a small number of providers ("sub-processors"). Each one is bound by a data processing agreement with obligations at least as strict as ours. The current list, with what each one does and where, is on our sub-processors page. In summary: database, sign-in and file storage (Supabase, data stored in Ireland); website hosting (Netlify); email delivery (Resend, EU region); error reporting (Sentry, EU data region); place-name lookup for maps (OpenStreetMap Nominatim, only the place name typed).
We may also disclose data where the law requires it (for example, a valid court order), to protect our rights, or to a successor if Aftermade is sold or merged, in which case this policy will continue to apply.
6. Transfers outside the EU/EEA
We store data in the EU. Some of our providers are companies based in the United States, or may access or route data outside the EU (for example, to deliver web pages quickly worldwide). Where that happens, we rely on one of the safeguards in Chapter V of the GDPR:
- an adequacy decision of the European Commission (for example, the UK, or US companies certified under the EU–US Data Privacy Framework); or
- the European Commission's Standard Contractual Clauses, with additional measures where needed.
Data in transit is always encrypted. You can ask us for details of the safeguard that applies to a particular provider.
7. How long we keep data
- Accounts and business data: for as long as the account or business exists. When a business is deleted, its data is removed from our live systems at once and from our backups within 7 days.
- Customer data held for a business: as long as the business decides, and until it erases the customer or deletes its business (see the Data Processing Agreement).
- Abuse-prevention records (scrambled network addresses): up to 24 hours.
- Error reports: up to 90 days.
- Technical logs kept by our providers: for their short, fixed periods (typically days to a few weeks).
- Pilot requests from our website: up to 12 months if you don’t start a pilot, then deleted. If you do, they become part of your account records.
- Invoices and accounting records: 6 years, as Irish tax law requires.
8. Security
We take appropriate technical and organisational measures (Article 32). They include:
- encryption in transit (HTTPS) and at rest
- separation between businesses enforced in the database itself, with automated tests on every change
- two-step sign-in required for business accounts
- private customer links stored only in scrambled (hashed) form
- daily backups
- access limited to people who need it
- a documented process for handling personal data breaches
If a breach is likely to put your rights at risk, we will tell the Data Protection Commission within 72 hours, and you without undue delay, as Articles 33 and 34 require.
9. Cookies and browser storage
We don't use advertising or analytics cookies, and our website loads nothing from third-party servers (our fonts are stored with us). The app stores only what is strictly necessary for a service you asked for, which EU law permits without consent:
- your signed-in session (so you stay signed in);
- on workshop devices, a device identifier and a queue of photos waiting to upload (so nothing is lost on a weak signal).
Customer order pages store nothing in your browser.
10. Your rights
Under the GDPR you have the right to:
- access your data (Art. 15)
- correct it (Art. 16)
- have it erased (Art. 17)
- restrict how it is used (Art. 18)
- receive it in a portable format (Art. 20)
- object to processing based on legitimate interests (Art. 21)
Write to hello@aftermade.app. We will reply within one month (extendable by two months for complex requests, in which case we'll tell you why). We may need to confirm your identity first.
Business owners can export or erase a customer's data, or export or delete their whole business, from inside the app.
If you are a customer of a business, please send requests to that business first (see section 3).
11. Complaints
You can complain to the Data Protection Commission (Ireland), 21 Fitzwilliam Square South, Dublin 2, D02 RD28, dataprotection.ie, or to the supervisory authority where you live or work. We'd appreciate the chance to put things right first.
12. Children, automated decisions, changes
Aftermade is a tool for businesses and is not directed at children. We make no decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22).
If we change this policy, we will post the new version here with a new date, and tell account holders by email about important changes before they take effect.
If you are in the United Kingdom, the UK GDPR gives you equivalent rights; the UK Information Commissioner's Office is at ico.org.uk.