Privacy

Privacy policy.

Last updated October 2026

This page explains what personal data we process when you visit mashedlab.com or work with us directly, why we process it, and how you can exercise your rights under the General Data Protection Regulation (GDPR / DSGVO) and the Austrian Data Protection Act (DSG).

Data controller

Company
MASHED Software Solutions GmbH
Chief Executive
Manuel Penaloza
Address
Kasernstraße 30b / Top 104, AT-8010 Graz, Austria
Email
contact@mashedlab.com

What we process, and why

Contact form & email

When you send us an inquiry through the contact form or the project calculator, we process your name, email address, company and the content of your message. The message is delivered to our inbox through SendGrid. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (our legitimate interest in answering your request). We keep the message as long as needed to answer it and for any resulting engagement.

Hosting & server logs

The site is hosted by Vercel and delivered through Cloudflare's network. When you load a page, these providers process access data (IP address, date/time, requested URL, referrer, user agent) to deliver the page, protect it against attacks and diagnose errors. The data is kept for a short period and then deleted. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working website).

Consent management (CookieYes)

We use CookieYes to ask for and store your cookie choices. It stores your choice in the cookieyes-consent cookie (1 year) and logs it, with a consent ID, the time and a truncated IP address, so we can prove consent was given. Legal basis: Art. 6(1)(c) GDPR (our legal duty to prove consent) and Art. 6(1)(f) GDPR. Provider: CookieYes Limited, United Kingdom.

Google Tag Manager

We use Google Tag Manager to load the consent banner and, only after you consent, the analytics tools listed below. Tag Manager sets no cookies of its own, but loading it sends your IP address to Google. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in managing the scripts on our site). Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Analytics (only with your consent)

If you accept analytics in the cookie banner, we use the following tools to understand how the site is used and to improve it. Without your consent, none of them runs.

  • PostHog: page views, clicks, scroll depth, page performance, device and browser type, approximate location (derived from your IP address, which is not stored), and session recordings of your visit. PostHog is loaded through Google Tag Manager, and the data is sent through our own subdomain k.mashedlab.com, which PostHog operates on our behalf. Data is stored in PostHog's EU region (Frankfurt). Provider: PostHog Inc., USA.
  • Amplitude: page views, clicks, device and browser type, approximate location, session recordings, and assignment to experiments (A/B tests) of page variants. Data is stored in Amplitude's EU data centre. Provider: Amplitude, Inc., USA.
  • Leadinfo: matches your IP address against business registers to show us which company visited our site and which pages it looked at. Leadinfo does not identify individuals; if you browse from a private connection, no company is shown. We use this to follow up with businesses that are interested in our services. Provider: Leadinfo B.V., Netherlands.

Session recordings capture how the page reacted to your mouse movements, clicks and scrolling. Anything you type into form fields is masked and not recorded.

Legal basis: Art. 6(1)(a) GDPR and § 165(3) TKG 2021 (your consent). You can withdraw consent at any time through "Cookie settings" in the footer; the tools stop running from your next page view. We keep analytics data for no longer than 24 months.

Map on the contact page

The map on our contact page is a static image hosted on our own servers (map data © OpenStreetMap contributors). Viewing it sends no data to any map provider. Only if you click "Open in OpenStreetMap" are you taken to openstreetmap.org (OpenStreetMap Foundation, United Kingdom), whose privacy policy then applies.

Cookies & local storage

We store the following on your device:

  • Essential, no consent needed: cookieyes-consent (your cookie choice, 1 year) and NEXT_LOCALE (your language choice, 1 year).
  • Analytics, only with your consent: PostHog (ph_…_posthog, 1 year), Amplitude (AMP_…, AMP_MKTG_…, EXP_…, up to 1 year) and Leadinfo (_li_id, 2 years; _li_ses, 30 minutes). Some of these are kept in your browser's local storage rather than as cookies.
  • Advertising: we use no advertising cookies.

You can change or withdraw your consent at any time through "Cookie settings" in the footer.

Processors & data transfers

We work with these providers, each under a data processing agreement:

  • Vercel Inc., USA: hosting
  • Cloudflare, Inc., USA: content delivery and protection against attacks
  • Twilio Inc. (SendGrid), USA: delivering contact form messages
  • Google Ireland Limited, Ireland: Google Tag Manager
  • CookieYes Limited, United Kingdom: consent management
  • PostHog Inc., USA: analytics (data stored in the EU)
  • Amplitude, Inc., USA: analytics (data stored in the EU)
  • Leadinfo B.V., Netherlands: company identification

Some of these providers are based in the USA or are owned by a US company, so US authorities could access the data. We rely on the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Data sent to the United Kingdom is covered by the EU's adequacy decision.

Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you (Art. 15)
  • request correction of inaccurate data (Art. 16)
  • request deletion of your data (Art. 17)
  • restrict processing (Art. 18)
  • data portability in a common machine-readable format (Art. 20)
  • object to processing based on legitimate interest (Art. 21)
  • withdraw consent at any time, without affecting prior lawful processing

To exercise any of these rights, email contact@mashedlab.com. You also have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde) — dsb.gv.at.

Retention

We keep personal data only as long as we need it for the purposes set out above or as required by law (accounting records: seven years under §132 BAO). Analytics data is deleted after at most 24 months. After that, data is deleted or anonymised.

Security

We use TLS in transit, keep software up to date, and limit internal access to personal data. If a breach meaningfully impacts your rights, we notify you and the supervisory authority as required by Art. 33/34 GDPR.

Changes to this policy

We update this policy when our processing or legal obligations change. Significant changes are communicated on this page with a revised "last updated" date above.

Questions about any of the above? Get in touch — we'd rather answer directly than have you guess.