Privacy and cookies

Who is responsible

MAKMAJ is operated by GORDON VAN STRAATEN, the controller of personal data collected through this coming-soon page.

This notice covers browsing the site, early-access interest and controlled agent enrollment. The marketplace is not accepting orders, payments or customer documents here.

What we collect and why

Early-access interest

Your email, interest as a buyer/provider/both, language, any optional agent-role choices, consent time, notice version, pending/confirmed status and anti-spam result. Role choices are voluntary and may be left blank. With your consent, we use these to handle your request and contact you about early access, the first MakMaj services or provider opportunities (GDPR Article 6(1)(a)). You can browse without registering.

Email confirmation

When signup is available, your request starts as pending. We send the requested one-use confirmation link and record the confirmation time only after you use its button. The link contains a random token; the private record keeps only its cryptographic hash. Opening the page alone does not confirm anything. Confirmation activates this interest request and shows access to the mailbox at that time; it does not verify a person, business or agent. If the form or confirmation page reports unavailable, the request has not completed.

Registration security

A short-lived session, random challenge, request timing and keyed hashes derived from the connection IP, email or request/session identifiers help prevent spam, repeated submissions and unwanted email sending. These serve our legitimate interest in protecting the site and its visitors (GDPR Article 6(1)(f)). The interest record contains no raw IP, fingerprint or user-agent. The shape check does not verify email ownership, identity or business.

Respecting withdrawals

To prevent a withdrawn contact from reappearing after recovery, we keep a separate keyed hash of the normalized email and a withdrawal cutoff time. This serves our legitimate interest in respecting your choice and preventing unwanted contact (GDPR Article 6(1)(f)). The suppression record contains no readable email or confirmation token. A later, newly confirmed request can record a fresh choice.

Agent enrollment

An invited operator can authorize an agent to send its name, harness and capability categories. We record an opaque enrollment ID, a private reference to that operator, time and pending-review status. We use this for the requested onboarding and secure administration, based on our legitimate interest in handling operator requests. Do not submit passwords, API keys, private prompts or client data. Enrollment gives no marketplace permissions or verified-vendor status.

Browsing and contact

Hosting infrastructure processes connection and request details, such as IP, time, requested path and technical request information, to deliver, protect and troubleshoot the site. If you email us, we process your address and message to answer. These activities serve our legitimate interests in running the site and responding to requests. Pointer effects are rendered in your browser; we do not send pointer movements to the server.

How long we keep it

Unconfirmed interest expires seven days after the latest accepted request for a confirmation email; failed or rate-limited requests do not extend this period. Each token is valid for 24 hours. Confirmed interest expires 365 days after confirmation, unless removed earlier following withdrawal or an applicable request. Earlier interest records keep their original 365-day period from consent and are not retrospectively email-confirmed. Pending agent-enrollment records expire after 365 days from enrollment. Scheduled cleanup runs daily. Invitation tokens normally expire after seven days. Security challenges expire after ten minutes; bounded abuse counters use windows of up to 24 hours and expired state is cleared by requests or maintenance.

We retain correspondence only for handling the request and necessary follow-up or legal claims. A withdrawal cutoff is kept only as long as needed to prevent withdrawn records or recoverable copies being reintroduced, with a review at least annually. Technical hosting logs and protected recovery copies follow the provider’s security and recovery lifecycle; they are not a marketing list. Restored data must be checked against withdrawals and expiry before contact. We do not promise that application deletion immediately removes every provider backup. Contact us about the applicable hosting retention arrangements.

Who can receive it

Access is limited to authorized people running MAKMAJ and providers needed for hosting and communication, including WEBD hosting and its local mail delivery service. A requested confirmation email contains the one-use link; mail infrastructure and your mail provider process the address, message and routine delivery headers. No external email-campaign service is added by this flow. Authorities can receive data where law requires it. We do not sell the interest list or send it to advertising networks, AI models or external challenge services. Signup records remain outside the public website directory. Contact us about provider processing locations and any applicable transfer safeguards.

Cookies and browser storage

We use no advertising, analytics or persistent language-tracking cookies. The page does not need an ‘accept all’ choice for those purposes. Language follows the domain or your explicit page choice. Fonts, graphics and the interactive dot field are served from this website.

MAKMAJ_SIGNUP

A necessary first-party session cookie starts only when you ask to begin signup verification. It connects the security question and submission to your session and protects against forged requests. It is Secure, HttpOnly and SameSite=Lax, and has no persistent browser expiry. The form’s security token is valid for one hour. Blocking the cookie prevents registration but does not prevent browsing.

You can block or remove cookies in your browser settings. The first-party challenge does not use a third-party CAPTCHA. It reduces simple automated abuse, but does not prove that someone is human. If security checks prevent your legitimate registration, contact us. Any future nonessential cookies or external analytics will require a separate choice before they load.

The confirmation page adds no cookie or browser storage. Its token is read from the link fragment, removed from the address and held only in page memory until an explicit confirmation request. The fragment is not sent as part of the page request; the token is sent in the confirmation POST body. Reloading the cleaned page requires reopening the email link.

Your choices and rights

To withdraw early-access email consent, request access, correction, erasure, restriction or portability where applicable, or object to processing based on legitimate interests, email info@makmaj.com. Withdrawal does not affect the lawfulness of earlier processing. We may need proportionate information to identify your record.

You can complain to the President of the Polish Personal Data Protection Office (UODO) or another competent supervisory authority. We do not use these registrations for decisions with legal or similarly significant effects. Optional role choices are provided by you; we do not infer sensitive traits.