Privacy policy

Last updated: 28 October 2026

This policy explains what personal data we process when you use makeitanywhere.xyz, why, and what your rights are. In short: there are no accounts, no tracking or advertising cookies and no analytics. We only process what we need to run the site and to sell and deliver a screen.

1. Who is responsible

2. Visiting the website

The site runs on a server of DigitalOcean, LLC in a data centre in Frankfurt am Main, Germany. When you open a page, your browser sends technical data that the server records in its log files: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. We use these logs only to run the site securely and to find errors, and they are deleted automatically after 14 days.

To protect the site from abuse (for example, someone creating thousands of billboards automatically), the server also counts recent requests per IP address in its working memory. These counts are never written to disk and expire within 24 hours.

Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). DigitalOcean processes this data on our behalf under a data processing agreement.

3. Previewing your billboard

When you enter a website address, our server visits that public website and reads its name, text, colours and logo. To write the billboard's headline and slogans, it sends this public website content to OpenAI (OpenAI Ireland Ltd. / OpenAI, L.L.C.), which may process it in the United States under the EU Standard Contractual Clauses. OpenAI does not use data sent through its API to train its models. We send only the website's public content, nothing about you.

The resulting billboard (company name, website address, logo, colours and slogans) is stored so the preview loads instantly next time. This is information about a business, taken from its public website. While you type an address, the site also looks up that website's icon to show it next to the field.

Legal basis: carrying out your request (Art. 6(1)(b) GDPR) and our legitimate interest in providing the preview (Art. 6(1)(f) GDPR).

4. Buying a screen

Payments are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. You enter your payment details and email address directly on Stripe's checkout page; we never see or store your card details. Stripe processes your data as an independent controller under its own privacy policy, including for fraud prevention, and may transfer data to the United States under the EU Standard Contractual Clauses.

We store the order itself: which billboard and screen, the price, the closing line you chose, the time of payment and Stripe's reference for the payment. In our Stripe account we can also see the name and email address you gave Stripe, which we use only to deal with your order (for example a refund or a question you send us).

Legal basis: performing the contract with you (Art. 6(1)(b) GDPR) and our legal duty to keep accounting records (Art. 6(1)(c) GDPR). Payment and accounting records are kept for the periods required by German tax and commercial law (up to 10 years); the order otherwise stays as long as the screen's history is shown on the site.

5. What becomes public

A screen is an advertisement, so what you buy is shown publicly: the company name, logo, website address and closing line appear on the screen in the live square, on the site's list of screens ("The Wall"), on the company's own page on this site (with its film, its history on the square and how many visits it sent to the website), and, for a while after being outbid, on the square's Hall of Fame screens. Company pages may be found by search engines. Each purchase also has a private link (on your receipt) that only you should have: it shows your video downloads. Please don't put personal data in a closing line.

Before an ad is made, the website's content is checked for things we don't show on a billboard (for example adult content or gambling). This check is part of the same OpenAI request described in section 3. A refused website address is remembered so it isn't checked again.

To make the video files of your film, our server sends your order's public details (company, screen, closing line) to Modal Labs, Inc. (USA), which renders the film on its computers under the EU Standard Contractual Clauses and sends the video back to us. No personal data about you is part of this.

When someone clicks through to a company's website, we count the visit. To count each visitor once an hour, the server keeps the visitor's IP address in its working memory for up to an hour; it is never written to disk.

6. Email

If you write to hello@makeitanywhere.xyz, your message is forwarded through our domain registrar, Namecheap, Inc. (USA), to our mailbox. We use your email only to answer you and delete it when it is no longer needed. Legal basis: Art. 6(1)(b) or (f) GDPR.

7. Cookies and storage in your browser

We set two cookies, both only for things you do. For buyers: when you open your private link, your browser keeps it in a cookie (mia_own, for one year) so your company page shows your private section without the link next time. For the treasure hunt in the 3D city: a random id (mia_hunt, for one year) so each player can hold one treasure ad at a time; with a claim we also keep that id, your IP address and the website you put up, for as long as the hunt's records are needed to apply its rules. Neither cookie is used for tracking, and you can delete them at any time.

The site also keeps a few small things in your browser's local storage: whether you turned the sound on, which reveal you have already seen (so it doesn't play the same celebration twice), and a random number that lets us count how many people are on the site right now, without knowing who they are. These never leave your device except for that anonymous count, and you can clear them at any time in your browser.

8. Code loaded from a content network

The 3D city uses the open-source three.js library, which your browser loads from jsDelivr, a public content delivery network (operated with Cloudflare, Inc. and Fastly, Inc.). To deliver it, these providers see your IP address. Legal basis: our legitimate interest in loading the site quickly and reliably (Art. 6(1)(f) GDPR). Fonts are served from our own server.

9. Your rights

You have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format (Art. 15–21 GDPR). Where processing is based on our legitimate interest, you can object to it at any time. To use any of these rights, email hello@makeitanywhere.xyz.

You can also complain to a data protection authority, for example the one responsible for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.

We do not use automated decision-making or profiling, and we do not sell personal data.

10. Changes

We will update this policy when the site changes. The date at the top shows the latest version.