Privacy notice
What data this website processes, who it is passed to, and what rights you have.
DRAFT. Not reviewed by a lawyer. Passages that need
checking or completing before publication are marked in the source of this
document as an HTML comment containing the word CHECK.
Version 2026-08-05.
The German version governs; this translation is for understanding.
1. Controller
[FIRMENNAME], [RECHTSFORM], [ANSCHRIFT] Represented by [VERTRETUNGSBERECHTIGT], e-mail [E-MAIL].
2. The cookies this site sets
Complete, not by way of example:
| Name | Purpose | Lifetime | Kind |
|---|---|---|---|
mh_lang | Remembers which language you last read the site in, so the choice carries into the dashboard. | 1 year | strictly necessary |
| Sign-in session cookies | Keep you signed in. Set only if you sign in. | session or until sign-out | strictly necessary |
That is all of them. This site loads no third-party scripts, uses neither Google Analytics nor anything comparable, sets no advertising or tracking cookies, and runs without a consent banner. A banner here would not be diligence; it would be a claim about something that does not happen.
3. Visiting the website
Visiting processes the data your browser sends: IP address, time, address requested, amount of data transferred, status code, referrer, and details of browser and operating system. Without that processing a page cannot be delivered at all. Legal basis: Article 6(1)(f) GDPR.
4. Waiting list
While registration is closed you can join a waiting list. Exactly the fields the form has are processed: e-mail address (required), company name (optional), approximate number of machines per year (optional), the language you filled the form in, and the page you signed up from. Signing up again with the same address does not create a second record; it updates the existing one.
5. Account and organisation
If you create an account, your e-mail address and your organisation's details are processed. Signing in works through a link sent by e-mail; no password is stored. Legal basis: Article 6(1)(b) GDPR.
Content you upload as a customer is processed on your behalf. The data processing agreement governs that, not this notice.
6. Print requests
A printed copy can be requested from a public manual page. Name, e-mail address, postal address and, if given, the serial number are processed and passed to the manufacturer who sends the manual.
This data is deleted twelve months after the request is handled. A request left open counts from when it arrived, so an unhandled request cannot keep an address forever. The deletion is implemented as a scheduled job in the database, not as an intention.
7. E-mail
Notifications and confirmations are sent through a service provider, sign-in links through the database platform's authentication service. Both are listed under point 9.
8. Audience measurement
Measurement happens server-side and in our own database: which event occurred, on which path, in which language. No identifier is set in the browser and no profile is built; the events cannot be attributed to a person.
9. Recipients and processors
| Service | Legal entity | Purpose | Processing region |
|---|---|---|---|
| Vercel | Vercel Inc., Delaware, USA | Hosting and delivery of the website | worldwide, with functions in the EU |
| Supabase | Supabase, Inc., USA | Database, authentication, file storage | EU (eu-central-1) |
| Brevo | Sendinblue SAS, Paris, France | Sending notifications | EU |
| Stripe | Stripe Payments Europe, Limited, Ireland | Payment processing | EU, with transfer to the USA |
Stripe becomes a recipient only once payment processing is switched on; while it is off, nothing is processed there.
Processing does not happen exclusively within the EU. Vercel and Supabase are companies established in the United States. Even with the database and files in an EU region, access from a third country is not ruled out.
10. Your rights
You have the right of access (Article 15 GDPR), rectification (16), erasure (17), restriction (18), portability (20) and objection to processing based on a legitimate interest (21). Consent given can be withdrawn at any time with effect for the future.
An informal message to [E-MAIL] is enough for all of it.
You may also lodge a complaint with a supervisory authority, Article 77 GDPR.