Legal
Privacy
This notice explains what personal data Madeivo uses, why we use it, who we share it with, how long we keep it and the choices and rights available to you.
Last updated 23 September 2026.
Who is responsible for your data
Madeivo is a trading name of Greyrock Enterprises Ltd. Registered in England and Wales under company number 17445984. Registered office: 82A James Carter Road, Mildenhall, IP28 7DE, United Kingdom. That provider is the controller for Madeivo account administration, billing, website operation, security, enquiries and other processing described in this notice where Madeivo determines the purpose and means of processing.
For personal data that a customer puts into its private workspace and controls for its own purposes, the customer is normally the controller and Madeivo acts as its processor. In that situation, the customer's instructions determine how that data is used and requests about that use may need to be directed to the customer organisation.
When Madeivo acts as a processor, the Data Processing Terms form part of the customer contract.
Madeivo is a business service
Madeivo accounts and paid subscriptions are intended for adults using the service for a business, trade or professional purpose. Public Passport pages can be viewed without an account. We do not knowingly create Madeivo accounts for children.
Information we process
- Account and organisation data: name, work email, organisation details, membership, authentication and account-security information.
- Product and workspace data: product, supplier, manufacturer, evidence, document, translation and Passport information entered by customer organisations.
- Billing data: subscription and billing status, Stripe customer/subscription identifiers and limited payment-method metadata such as payment-method type and last four digits when Stripe supplies them. Madeivo does not store full card numbers.
- Enquiries and support: name, work email, company, enquiry topic, message and records needed to respond to or support you.
- Technical and security data: request, session, audit and security information needed to operate, troubleshoot and protect the service.
- Analytics data: the limited website and public Passport activity described below.
Where information comes from
Most information comes directly from you or from another authorised member of your organisation. We can also receive account or operational information from services you choose to use with Madeivo, including Stripe for billing and Shopify when connected. Technical request information comes from your browser/device and the infrastructure that delivers and protects the service.
Information needed to provide the service
Fields marked as required during registration or a transaction are needed to create the account, secure it or complete the requested service. A paid subscription also requires the billing information needed by Stripe and Madeivo to process and reconcile the subscription. If required information is not provided, we may be unable to create the account, complete checkout or provide the relevant feature.
Why we process personal data and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Create and administer accounts, provide the workspace, publish requested Passports and deliver customer support. | Contract, or steps requested before entering a contract. |
| Manage subscriptions, billing and payment administration. | Contract and, where applicable, legal obligations such as accounting or tax requirements. |
| Protect accounts and the service, prevent abuse, maintain audit records and investigate operational or security problems. | Legitimate interests in operating a secure, reliable service and protecting customers and Madeivo. |
| Respond to business enquiries that are not already part of a customer contract. | Steps requested before a contract where relevant, otherwise legitimate interests in responding to genuine business enquiries. |
| Record aggregate marketing-page activity without a persistent analytics identifier. | Legitimate interests in understanding the use and performance of the public website while minimising personal data. |
| Use the optional first-party visitor and session identifiers described below. | Consent. You can withdraw consent at any time from the Cookies page. |
| Meet binding legal, regulatory or law-enforcement requirements. | Legal obligation where the relevant requirement applies. |
Where we rely on legitimate interests, we consider the need for the processing, its effect on individuals and whether a less intrusive approach is reasonably available.
Payments and subscriptions
Paid checkout and billing management use Stripe. Stripe processes payment transactions and hosted billing interactions. Madeivo stores the Stripe customer and subscription identifiers needed to reconcile billing, together with subscription state and limited payment-method metadata such as payment-method type and the last four digits when Stripe supplies them. Full payment-card details are handled by Stripe rather than stored in Madeivo's application database.
Customer workspace data
Madeivo stores organisation, product, supplier, supporting-document and Passport information for customer accounts. Private supporting files are separate from the information intentionally published on a public Passport. Customer organisations are responsible for deciding what personal data they enter and what information they instruct Madeivo to publish.
Automatic translation
When automatic translation is used, the customer-facing text you choose is sent to Madeivo's configured translation provider. Completed translations are stored with the product, so viewing a public Passport does not contact the translation provider again. Manual translation remains available without using the automatic translation allowance.
API and webhook integrations
When an organisation enables integrations, Madeivo stores API key details and a one-way hash of each token, plus webhook URLs, subscribed event types and delivery records. Full API tokens are not stored after creation. Webhook signing secrets are encrypted at rest and shown when an endpoint is created or its secret is changed.
Shopify catalogue integration
When an organisation connects Shopify, Madeivo uses the authorised connection to read core catalogue data and receive selected product and app webhooks. Shopify connection tokens are encrypted at rest. Shopify product and variant IDs are linked to the corresponding Madeivo products rather than replacing them. Disconnecting Shopify stops synchronisation without deleting Madeivo products or published Passport history.
Published Passports
Information a customer instructs Madeivo to publish to a Passport is deliberately made public. Published versions can remain in Passport history so changes to public product information are not silently rewritten. Before publishing personal information about another person, customer organisations should ensure they have an appropriate basis for making it public.
Public Passport analytics
Madeivo records privacy-conscious first-party aggregate activity for published Passports, such as views, Madeivo-generated QR scans, device category, approximate country when a trusted infrastructure signal is available, and the domain of an external referrer.
Passport analytics does not retain raw IP addresses, full referrer URLs, persistent visitor identifiers or advertising profiles, and it does not claim that view counts represent unique people.
Website analytics
Madeivo records first-party aggregate page-view activity for the public marketing site without setting an analytics identifier. If you explicitly allow analytics, we also use a first-party anonymous visitor identifier and short-lived session identifier to understand journeys, referral domains, UTM campaigns, device/browser categories, language, timezone and screen dimensions.
A consented visitor identifier may be associated with a Madeivo account after signup so we can understand the signup journey. We do not persist raw IP addresses or full referrer URLs in the website analytics dataset, use browser fingerprinting or build advertising profiles. Approximate country is recorded only when a trusted infrastructure signal is configured.
Detailed marketing analytics events and visitor records are configured for 395 days of retention. Aggregate marketing analytics reporting is configured for 1,095 days. The Cookies page explains the identifiers and their browser lifetimes.
Who we share data with
We disclose personal data only where needed for the service or another lawful purpose. Recipients can include infrastructure and email service providers, Stripe for payments and subscriptions, the configured translation provider when automatic translation is requested, Shopify when a customer connects it, professional advisers, and public authorities where disclosure is legally required. Customer-configured webhook recipients receive the data included in the events that the customer chooses to send.
Madeivo does not sell personal data and does not share it with third parties to build behavioural advertising profiles.
International transfers
Some service providers may process personal data outside the UK. Where UK data-protection law treats a transfer as restricted, Madeivo uses an available transfer mechanism appropriate to that transfer, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved EU standard contractual clauses, together with any required transfer assessment.
Contact us if you need information about the safeguards relevant to your account or the integrations you have enabled.
Retention and deletion
Retention depends on the information and why it is held. Account and private workspace data is retained while needed to provide the service and for appropriate security, dispute, backup and legal-record purposes. Billing and transaction records may need to be retained for accounting or tax requirements. Published Passport history can require different treatment from private working data because it forms part of the product's publication record.
When information is no longer needed for the purpose for which it was retained, it is deleted or anonymised in line with the applicable retention process. Signed-in users can close an eligible account from Account settings. Self-service closure revokes active account access and anonymises core profile data while preserving records that still need to be retained for audit, billing, security, legal or published-Passport purposes. Sole organisation owners must transfer ownership before closing their account.
Contact us if you need a broader retention, deletion or erasure request assessed. Account closure is not presented as an automatic deletion of every record in which an account may historically appear.
Your data-protection rights
Depending on the circumstances, UK data-protection law can give you rights to access personal data about you, correct inaccurate or incomplete data, ask for deletion, restrict processing and receive or transfer certain data in a portable form. You can also withdraw consent where consent is the lawful basis. These rights are not absolute and the right that applies depends on the context and lawful basis.
Signed-in users can download a self-service JSON export of their Madeivo profile, organisation memberships and account-attributed metadata from Account settings. The self-service file is intended as a convenient account export and does not replace a formal rights request where a wider search or assessment is required.
We normally respond to a valid rights request within one month. We may need enough information to confirm your identity before acting on a request.
Your right to object
You can object to processing based on our legitimate interests. Tell us what processing you object to and why. We will stop that processing unless we have compelling legitimate grounds to continue or need it for legal claims.
If we ever use personal data for direct marketing, you can object to that use at any time and we will stop using it for direct marketing.
Automated decisions
Madeivo's readiness and regulatory checks provide preparation guidance and do not make solely automated decisions about individuals that produce legal or similarly significant effects.
Changes to this notice
We review this notice when the service, our providers or the way we use personal data changes. If we plan a material new use of personal data, we will update the notice and bring the change to the attention of affected users before starting that processing where required.
Questions, rights requests and complaints
Contact hello@madeivo.com with privacy questions, rights requests, or questions about subprocessors and international transfers relevant to your account.
You also have the right to complain to the UK Information Commissioner's Office (ICO). You can find complaint information at ico.org.uk/make-a-complaint. We would welcome the opportunity to address your concern first, but you do not have to contact us before approaching the ICO.