1. Who is responsible
The controller of the personal data described in this policy is MB AE Motors, company code 307601914, VAT code LT100020138218, registered address Svirbygalos g. 13A-9, LT-46280 Kaunas, Lithuania. Contact for privacy questions: info@cueload.com.
This policy covers visitors of the website, people with a CueLoad account, and billing contacts. Data that an organization puts into its CueLoad workspace (its team, projects, clients, crew pay and so on) is handled differently: there the organization is the controller and we only process the data for it – see section 3 and the Data Processing Agreement.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR) | How long |
|---|---|---|---|
| Account: name, email address, password (stored only as a secure hash), language | Create and run your account, sign you in, send sign-in and password reset codes | Contract – Art. 6(1)(b) | While the account exists |
| Sign-in security data: IP address, browser and device type, sign-in times | Keep accounts secure, detect misuse | Legitimate interest in security – Art. 6(1)(f) | While the sign-in session lasts; security log entries as kept by our database provider |
| Acceptance of these documents: which document, which version, when, by which account (and for the DPA, for which organization) | Prove what was agreed | Legitimate interest in proving the agreement – Art. 6(1)(f) | While the account exists |
| Billing: email address of the owner or admin who pays, organization name, billing address, VAT code, subscription status and number of seats. Card details are entered at Stripe only | Take payments, issue invoices, calculate VAT | Contract and legal obligation (accounting, tax) – Art. 6(1)(b) and (c) | Subscription data while the organization exists; invoices for as long as accounting and tax laws require |
| Settings: theme, language, list density, column widths | Remember how you like to use the app | Contract – Art. 6(1)(b) | Until you change them or the account or membership ends |
| Push notifications (only if you turn them on): the push address of your browser, its encryption keys and browser type | Deliver notifications to your device | Contract – Art. 6(1)(b); you can turn them off at any time | Until you turn them off, sign out, or the browser reports that the device is gone |
| Calendar link (only if you create one) | Show your projects in your calendar app | Contract – Art. 6(1)(b) | Until you revoke the link (we keep only a hash of it) |
| Emails you send to us | Answer you and keep a record of the request | Legitimate interest – Art. 6(1)(f) | As long as needed to handle the request |
| Website and app requests: IP address, page, time, browser (server logs of our hosting provider) | Run the Service and keep it secure | Legitimate interest – Art. 6(1)(f) | A short time, as set by the hosting provider |
You need to give your name, email address and a password to create an account; without them we cannot provide CueLoad. Everything else is optional.
We do not use analytics, advertising or social media tools, and we do not build profiles of you. We do not make decisions about you based solely on automated processing.
3. Data in your organization's workspace
When you work in an organization, that organization decides what goes in and is the controller of it. This includes:
- team members, their roles, invitations (email address and role) and who is assigned to which project;
- projects and quotes with client names, venues, addresses and notes; supplier contacts for rented equipment;
- the history of who loaded, returned or changed equipment and when – it is never rewritten, so the records stay correct;
- crew pay, if the organization uses it: hours, rates, amounts, payouts, expenses and photos or PDFs of receipts;
- equipment photos, company logo, letterheads and documents.
We process this data only to provide CueLoad to the organization, under the Data Processing Agreement. For questions or requests about it, contact the organization; if you write to us, we will pass your request on. Note: equipment photos are stored at addresses that work without signing in, so anyone with a photo's address can open it – do not upload photos of people or private information as equipment photos.
4. Who receives the data
We do not sell personal data and do not share it for advertising. We use these providers to run CueLoad; they process data only on our instructions:
- Supabase – database, sign-in and file storage (EU – Ireland);
- Vercel – hosting of the website and the app;
- Stripe – payments, invoices and VAT; for payments Stripe also acts as an independent controller under its own privacy policy;
- Resend – sending account emails;
- our email hosting provider (Hostinger) – messages you send to the contact address;
- the push service of your own browser, only if you turn notifications on – Google (Chrome, Android), Mozilla (Firefox), Microsoft (Edge, Windows), Apple (Safari, iOS). Notifications are encrypted end to end; the push service cannot read them.
The full list with locations and links is on the Subprocessors page. We may also disclose data when the law requires it, for example to a court or a public authority.
5. Transfers outside the EU
The CueLoad database and files are stored in the EU (Ireland). Some providers are US companies or may access data from outside the European Economic Area. Such transfers are covered by the EU Standard Contractual Clauses (Supabase, Vercel, Resend) or by the EU-U.S. Data Privacy Framework (Stripe, Resend). Details and links to each provider's terms are on the Subprocessors page.
6. How long we keep data
- Account data is kept while the account exists.
- An organization's data is kept while the organization exists – also when it has no subscription and is view-only, so nothing is lost if you come back.
- You can ask us to delete your account or your organization (owner only) at info@cueload.com. We delete or irreversibly anonymize the data within 30 days and confirm by email. What the law requires us to keep, such as invoices, is kept for the required time.
- Deleted data can remain in backup copies until those copies are deleted.
7. Your rights
Under the GDPR you have the right to:
- get a copy of your personal data and information about how we use it;
- have incorrect data corrected – you can change your name and settings in the app yourself;
- have your data deleted, or its use restricted;
- receive your data in a machine-readable format and have it moved to another provider;
- object to processing based on our legitimate interest;
- withdraw consent at any time where we rely on consent.
Write to info@cueload.com. We answer within one month. We may ask you to confirm your identity, for example by writing from your account's email address.
You can also complain to the Lithuanian data protection authority: State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, ada@ada.lt, vdai.lrv.lt, or to the authority in the EU country where you live or work.
8. Security
Every organization's data is separated at the database level: a person sees only the organizations they belong to, and only what their role allows (equipment photos are the exception described in section 3). Connections are encrypted (HTTPS), our providers encrypt stored data, secret keys are kept only on the server, and we make a backup before every change to the database structure. More in the Data Processing Agreement.
9. Children
CueLoad is a work tool and is not meant for children. We do not knowingly collect personal data of children under 16.
10. Changes to this policy
When this policy changes, we publish the new version here with its date and version number. About important changes we tell you in the app or by email, and the app asks you to accept the new version.
11. Contact
MB AE Motors, company code 307601914, VAT code LT100020138218, registered address Svirbygalos g. 13A-9, LT-46280 Kaunas, Lithuania. Email: info@cueload.com.