How we collect, use, and protect your personal data — in plain language.
Masto Control Oy ("Masto Control", "we", "us") is the data controller for personal data collected through the Masto Control service and this website. We are registered in Finland (Y-tunnus: 3633010-8) and operate under Finnish law and the EU General Data Protection Regulation (GDPR).
This policy explains what data we collect, why we collect it, how long we keep it, and what rights you have.
When you create an account we collect your email address, password (hashed — never stored in plain text), your craft field (e.g. candles, ceramics), and preferred language. If you sign up via Google or Microsoft we receive your name and email from that provider.
Subscription and payment data (card type, last four digits, billing address) is collected and stored by Paddle, our payment provider and the Merchant of Record for your subscription (see Data location below). We do not store full card numbers. We receive confirmation of successful payments and invoice records.
We use privacy-friendly, cookieless website analytics (Plausible) to understand aggregate website usage, referral sources, UTM campaign performance, page views, and general device or browser statistics. This data does not identify you individually and helps us improve the website and product. If you accept analytics cookies via our cookie banner, Google Analytics 4 also processes similar aggregate usage data — see Cookie & Analytics Notice for full detail and how to change your choice.
When you contact us by email or through website forms, we retain the content of those messages to handle your request and improve our support.
If you connect a Shopify store (or another sales channel we support), we receive order data - order ID, order number, date, and line items (product SKU and quantity) - so we can automatically deduct sold items from your inventory. We do not request, receive, or store your customers' names, email addresses, phone numbers, or shipping/billing addresses as part of this integration. We push inventory quantity updates back to Shopify; this does not involve any personal data.
We use strictly necessary cookies and browser storage to keep the service secure and usable. The public website uses Plausible Analytics without cookies, localStorage, or persistent browser identifiers. With your consent via our cookie banner, we also use Google Analytics 4, which sets analytics cookies. We do not load advertising cookies, remarketing pixels, or cross-site ad tracking tools. See Cookie & Analytics Notice for full detail.
We do not sell personal data. We share data only with the following sub-processors, all operating under GDPR-compliant data processing agreements:
We may disclose data to Finnish authorities if required by law.
Account, product, and business data you enter into the Service is stored and processed within the European Economic Area (EEA). We do not transfer this data to countries outside the EEA.
Payment and billing data (name, email, billing address, and payment method details) is collected and processed directly by Paddle, our payment provider and the Merchant of Record for your subscription. Paddle is based in the United Kingdom and processes this data under its own privacy policy and safeguards for international transfers. See Paddle's Privacy Policy for details on how Paddle handles your data.
As a data subject in the EU/EEA you have the following rights. To exercise any of them, email us at hello@mastocontrol.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).
We use industry-standard measures to protect your data: HTTPS encryption in transit, encrypted storage at rest for our production database, hashed passwords, and access controls limiting who can see personal data. We will notify you and the relevant authorities in the event of a data breach as required by GDPR.
We may update this policy as the service evolves. If we make material changes we will notify you by email at least 14 days before the changes take effect. The current version is always available at this URL.
For any privacy-related questions or to exercise your rights: