Privacy Policy
Last updated: 9 September 2026
We, MASHED Software Solutions GmbH, take the protection of your personal data seriously. This policy explains what we collect, why, on what legal basis, and who we share it with.
It covers two things: this marketing website, and the Stokee Inventory application at inventory.stokee.net. Where a section applies to only one of them, it says so.
1. Who is responsible
The controller for the processing described here is:
- MASHED Software Solutions GmbH
- Kasernstraße 30b, AT-8010 Graz, Austria
- Represented by: Manuel Penaloza
- Email: contact@stokee.net
- Phone: +43 681 10526513
2. What we process on this website
Server logs
Our hosting provider, Vercel Inc., records technical data when you load a page — IP address, browser and device type, referring page and time of access. We use this to keep the site available and secure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure website).
Analytics
We use Google Tag Manager to understand how visitors move through the site, so we can tell which parts explain the product and which do not. This may record page views, clicks and navigation paths. Analytics only load once you consent, and you can withdraw consent at any time. Legal basis: Art. 6(1)(a) GDPR (consent).
Demo requests
If you send a demo request, we process the name, email address, company and message you provide. We use them only to answer you and, if it goes further, to arrange a demo. The message is delivered to contact@stokee.net through Mailgun Technologies, Inc. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering a contract).
Spam protection
The demo form is protected by Google reCAPTCHA v3, which analyses how the form is used in order to tell people from bots. This sends technical data, including your IP address, to Google. We do this to keep the form usable rather than drowned in automated submissions. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse).
Your display preferences
Your language and light/dark choice are stored in your own browser so the site remembers them. They are not sent to us and are not used to identify you.
3. What we process in the Stokee Inventory application
The application is a tool your employer or organisation uses. In most cases they decide what goes into it and are the controller for that content; we process it on their behalf under a data processing agreement.
Account and organisation data
To give you an account we process your email address, name, chosen language, role within your organisation, and — if you sign in with a password — a securely hashed version of it. You may instead sign in with Google, in which case Google confirms your identity to us and we receive your email address and basic profile information. Authentication and storage run on Supabase Inc., on infrastructure located in the European Union (Ireland, eu-west-1). Legal basis: Art. 6(1)(b) GDPR (performance of the contract).
Inventory content
The application stores what you put into it: equipment records, categories, locations, customers, jobs, crew assignments, check-outs and returns, condition notes and activity history. Some of this is personal data — for example which member of staff took a particular item and when. Legal basis: Art. 6(1)(b) and Art. 6(1)(f) GDPR.
Photographs
Photos of assets and profile pictures are held in Supabase Storage. Please note that these files are served from URLs that are not access-restricted: anyone who has or guesses the URL can open the image, even without an account. Do not upload photographs containing personal or confidential information you would not want reachable by link.
AI-assisted import
If you use the AI import, the contents of the file you upload — column headings and row values — are transmitted to Anthropic, PBC in the United States so that its model can interpret and clean the data. The file is processed to produce the import you then review; the resulting assets are stored by us, not by Anthropic. Please do not upload files containing personal data beyond what your inventory genuinely requires. Legal basis: Art. 6(1)(b) GDPR (performance of the contract, at your instruction).
Google Calendar synchronisation
If you connect a Google account, we process the calendar authorisation and the event data needed to keep jobs and calendar entries in step. This is optional, off unless you enable it, and can be disconnected at any time. Legal basis: Art. 6(1)(a) GDPR (consent).
Push notifications
If you allow notifications, your browser gives us a push subscription — an endpoint address and keys — which we store to send alerts such as an overdue return. You can revoke this in your browser or device settings. Legal basis: Art. 6(1)(a) GDPR (consent).
Billing
For paid plans, payment is handled by Stripe, Inc. Stripe processes the payment details directly; we receive the subscription status, plan and invoice records, not your full card number. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (statutory retention of accounting records).
Service email
Emails the application sends — invitations, password resets, notifications — are delivered through Mailgun Technologies, Inc.
4. Who we share data with
We do not sell personal data. We use the following processors, each under a data processing agreement:
- Vercel Inc. — website and application hosting
- Supabase Inc. — database, authentication and file storage for the application, hosted in Ireland (EU)
- Anthropic, PBC — AI processing of files you submit to the import feature
- Google Ireland Ltd. / Google LLC — Tag Manager, reCAPTCHA, Google sign-in and Google Calendar synchronisation
- Mailgun Technologies, Inc. — email delivery
- Stripe, Inc. — payment processing for paid plans
5. Transfers outside the EEA
Your account and inventory data are stored in the European Union (Ireland). Some of our other providers are based in, or process data in, the United States — Anthropic, Google, Mailgun and Stripe. Where personal data leaves the European Economic Area, the transfer is covered by the European Commission’s Standard Contractual Clauses and, where applicable, the provider’s certification under the EU–US Data Privacy Framework.
The AI import in particular involves sending the contents of your uploaded file to a provider in the United States. If that is not acceptable for a given file, do not use the AI import for it — assets can always be created manually instead.
6. How long we keep it
- Demo requests: kept while we are in contact and for up to two years afterwards, so we can follow up sensibly.
- Account and inventory data: kept for as long as your organisation has an account, and deleted or returned on request when the account is closed.
- Files submitted to the AI import: used to produce the proposed import; we do not retain the original file after processing.
- Invoices and accounting records: kept for seven years, as Austrian law requires.
- Server logs: kept for a short period for security and troubleshooting.
7. Your rights
Under the GDPR you may request access to your data, correction of inaccurate data, erasure, restriction of processing, and portability, and you may object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time without affecting what was done beforehand.
If the data sits in an organisation’s Stokee Inventory account, that organisation is usually the controller — we will pass your request to them and support them in answering it.
To exercise a right, write to contact@stokee.net. You also have the right to complain to a supervisory authority; in Austria this is the Datenschutzbehörde (Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at).
8. Cookies and similar technologies
We use what is strictly necessary to make the site and application work — for example keeping you signed in and remembering your language. Analytics are only set once you consent, and you can change or withdraw that choice at any time.
9. Changes to this policy
We update this policy when the product or our processors change. The date at the top always reflects the current version.