This policy describes how A.B. Intermedia Consulting Srl, with registered office at Via Giovanni Spadolini 7, 20141 Milan (MI), Italy, VAT IT09105910963 (the "Controller"), processes the personal data of users of the MacDisplay application and visitors to the macdisplay.app website (formerly macdisplay.it), in accordance with Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.
01 Data controller and contacts
The data controller is A.B. Intermedia Consulting Srl, reachable at support@macdisplay.it for any matter relating to the processing of personal data, as well as to exercise the rights set out in section 7.
- Company
- A.B. Intermedia Consulting Srl
- Registered office
- Via Giovanni Spadolini 7, 20141 Milan (MI), Italy
- VAT
- IT09105910963
- Privacy contact
- support@macdisplay.it
02 Types of data processed
MacDisplay is designed around the principles of privacy by design and data minimisation: we collect only the data strictly necessary to deliver the service.
2.1 Data processed while using the app
During normal use of the application:
- the app operates exclusively on the user's local network;
- it sends no traffic to the Controller's servers;
- the content of the transmitted screens stays exclusively on the local network.
The Controller does not collect, store, transmit or share: video content of the screens; usage habits, telemetry or analytics relating to how the app is used; files, documents or other information on the user's devices. All app activity remains on the user's device and local network.
2.2 Data processed when purchasing a licence
Licences are purchased through Link (Sold through Link, LLC), a Stripe group company acting as Merchant of Record: it collects the payment, issues the receipt and invoice, and handles indirect taxes and support for the transaction. For this processing, Link and the Stripe group companies that process the payment act as independent controllers, under their own privacy policy.
The data needed for payment — your card or other payment-method details, billing data and email address — are entered directly into Stripe's secure payment form. The Controller neither receives nor stores full payment-card details.
After the purchase, Stripe makes available to the Controller the order data needed to provide the licence: email address, name, country and billing address and, if provided, the VAT number. The Controller uses them to: send the licence key; provide technical support; communicate any critical software updates; meet accounting and tax obligations. Providing this data is necessary to purchase the licence: without it, the transaction cannot be completed and the service cannot be provided.
2.3 Device hardware identifier (licensing)
On licence activation, the licensing system generates a unique identifier ("fingerprint") from the hardware characteristics of the Mac, in the form of an irreversible hash (the original hardware data cannot be derived from the identifier). This identifier is used exclusively to enforce the limit of 3 devices per licence and to prevent abuse.
Licence and activation management is entrusted to Keygen (keygen.sh), a provider based in the United States, acting as a data processor on the Controller's behalf (Art. 28 GDPR). For licence management, Keygen processes: the licence key; the hardware fingerprint (irreversible hash); the Mac's name; the customer's email address.
The hardware identifier is technical data linked to the device; it does not directly contain the user's name, but it can be associated with the purchased licence and is therefore considered personal data under the GDPR. The Controller does not use the hardware identifier for any purpose other than licence management.
2.4 AI assistants and voice commands (optional, from version 3.0.2)
From version 3.0.2 the user can choose to connect MacDisplay to an AI assistant (for example Claude, ChatGPT or a local model) and to Siri and Shortcuts. These features are used only if the user connects an assistant or adds the commands. The connector runs exclusively on the user's Mac and opens no network ports; the Controller receives no data from it.
What the assistant reads (MacDisplay's status, nearby Macs, settings, logs including the names of transferred files, and the in-app guide) becomes part of the user's conversation with the assistant's provider (for example Anthropic or OpenAI) and is processed by that provider under its own terms and privacy policy, as an independent service chosen by the user. The connector never opens the user's files. With the “Anonymous names” option the assistant sees generic names instead of the real names of Macs and files; with a local model the information stays on the Mac. Voice requests to Siri are handled by Apple under its own terms; MacDisplay only receives the resulting command on the Mac.
2.5 Video tutorials in the in-app guide (optional, from version 3.0.2)
From version 3.0.2 some sections of the in-app guide include a video tutorial hosted on YouTube. Until the user presses play, the guide shows only a cover image stored inside the app and loads nothing from the internet. When the user presses play, the video is loaded from YouTube in its privacy-enhanced mode (youtube-nocookie.com): YouTube (Google) then receives the technical data needed to play it, such as the IP address and information about the device and browser, and processes it under its own terms and privacy policy, as an independent service. MacDisplay does not store YouTube cookies or data on disk: they are kept in memory only and discarded when the user leaves the video. The Controller receives no data about which videos are watched. The “Watch on YouTube” link opens the video in the user's browser.
03 Purposes and legal bases
Data is processed for the following purposes:
Performance of the licence agreement
Sending the licence key; managing activations/licences; technical support at the user's request. Legal basis: performance of a contract or pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR).
Tax and accounting obligations
Proper keeping of accounting and tax records related to sales. Legal basis: compliance with a legal obligation to which the Controller is subject (Art. 6(1)(c) GDPR).
Communications about critical security or compatibility updates
Sending communications strictly necessary to inform the user about updates essential to the security or compatibility of the software with the operating system. Legal basis: performance of the contract and compliance with legal obligations on digital content and conformity.
The Controller does not use the email address for direct marketing or newsletters, except with the user's specific, separate consent. Without such consent, the user receives only technical or service communications. No decisions are made solely on automated processing that produce legal effects on the data subject.
04 Processing methods and parties
Personal data is processed using electronic tools, adopting technical and organisational measures appropriate to ensure a level of security suited to the risk, in compliance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.
4.1 Providers and data processors
To deliver the service, the Controller uses the following providers, which process personal data on its behalf as data processors (or sub-processors) under Art. 28 GDPR, on the basis of specific agreements:
- Stripe (Stripe Payments Europe, Ltd — Ireland): stores the order data in the Controller's account on its behalf (email address, name, country and billing address). For the payment itself, Stripe and Link act as independent controllers (see section 2.2).
- Keygen (keygen.sh — United States): licence management and the 3-device-per-licence limit. Processes the licence key, the hardware fingerprint (irreversible hash), the Mac's name and the customer's email address.
- Resend (United States): sending transactional email. Processes the customer's email address to deliver the licence key.
4.2 Instructions and updates to the list
All the providers listed above process personal data exclusively on the Controller's behalf and on documented instructions, in compliance with Art. 28 GDPR. An up-to-date list of processors can be requested from the Controller via the contacts in section 1.
05 Data retention
The buyer's email address is kept for the period necessary to deliver the service and manage the licence and, afterwards, for the time required by Italian civil and tax law (as a rule, up to 10 years from the accounting entry).
The device hardware identifier is kept in the licensing systems managed by Keygen on the Controller's behalf for the entire validity of the associated licence; on licence deactivation or refund, the identifier is dissociated or removed.
Once the retention period has elapsed, personal data is deleted, anonymised or rendered no longer attributable to the data subject, save for further retention obligations required by law.
06 Data transfers outside the European Union
Some of the providers the Controller uses (in particular Keygen and Resend) are based in the United States and may therefore process personal data outside the European Economic Area. Stripe is a company based in Ireland (EU); Link (Sold through Link, LLC) is based in the United States and processes payment data as an independent controller, under its own privacy policy. For transfers to third countries, the Controller adopts appropriate safeguards under Chapter V of the GDPR, such as European Commission adequacy decisions (where they exist) and/or standard contractual clauses.
07 Your rights as a data subject
As a data subject, you have the right to:
- obtain confirmation as to whether or not personal data concerning you is being processed and, if so, access to the data and information about the processing;
- obtain rectification of inaccurate data or completion of incomplete data;
- obtain erasure of personal data in the cases provided by law;
- obtain restriction of processing in the cases provided by law;
- receive the personal data you provided in a structured, commonly used, machine-readable format and, where technically feasible, transmit it to another controller (portability);
- object to the processing of personal data in the cases provided by law.
To exercise these rights, you can contact the Controller at support@macdisplay.it. Requests are handled within the time limits set by the GDPR (as a rule, within 30 days). The Controller remains the point of contact for exercising rights relating to data processed on its behalf by the providers listed in section 4 (licence management, email delivery, order data). For payment and invoice data, processed by Link as an independent controller, you can also contact Link.
08 Right to lodge a complaint
If you believe that the processing of your personal data infringes applicable law, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali), without prejudice to any other administrative or judicial remedy.
10 Changes to this policy
The Controller reserves the right to amend this policy to align it with regulatory, technical or organisational developments. The date of the last update is shown at the top of the document. In the event of substantial changes that significantly affect users' rights, the Controller may notify users who have purchased a licence, for example by email.