Privacy Policy

1. Who we are (data controller)

The data controller for the website middlethings.co and for the Middle Control desktop application is MIDDLE THINGS SAS, registered in Paris under SIREN 999 040 793, with registered office at 229 rue Saint-Honoré, 75001 Paris, France. We are the entity that decides why and how your personal data is processed.

For any privacy question or to exercise your rights, write to [email protected].

2. What the website collects, and why

We try to collect as little as possible. The following table lists every category of personal data the <strong>website</strong> processes, the purpose, and the legal basis (under GDPR Article 6). Data processed by our Middle Control desktop application is described separately in section 3.

Orders placed on the online store (store.middlethings.co) are processed separately on Shopify and have their own privacy notice on that domain.

3. The Middle Control application

Separately from the website, we publish Middle Control, a macOS application you download and install. When you use it, we process a limited amount of data, in two categories.

a) Licence activation & software updates

When you activate, run, or update Middle Control, the application contacts our servers to verify your licence or trial and to check for new versions. For this we process a device identifier, your licence or order reference, and basic technical information about your device — its operating-system version, device model, and the device name you have given your Mac.

• Why: to deliver and protect the software — confirming a copy is licensed, providing free trials, preventing fraud and unauthorised use, and offering updates.
• Legal basis: performance of our contract with you, and our legitimate interest in protecting our software against piracy and abuse.
• Retention: for the duration of the licence or trial, plus up to 3 years for fraud-prevention and accounting purposes.

b) Crash diagnostics & usage analytics

To fix bugs and understand how features are used, Middle Control uses Google's Firebase (Crashlytics for crash diagnostics and Analytics for usage statistics). These collect pseudonymised usage events and, if the application crashes, a diagnostic report containing a device identifier, the app version, your operating-system version, and a technical crash log.

• Why: to diagnose crashes, measure feature usage, and improve the application.
• Legal basis: our legitimate interest in maintaining and improving the software.
• <strong>Recipient:</strong> Google (see section 5). Google may process this data outside the EEA under the EU-US Data Privacy Framework.
• Retention: Google's standard periods — currently up to 90 days for crash reports and up to 14 months for analytics.

Middle Control also talks directly to your cameras, gimbals, and control surfaces over your local network. That traffic stays on your network — the video from your cameras and the content of your productions are never sent to us.

4. Children

The website is not directed at children under 16. We do not knowingly collect personal data from minors. If you believe a child has provided data, contact us and we will delete it immediately.

5. Who we share data with

We share personal data only with the following categories of recipients:

• Our hosting provider (SiteGround Spain S.L., based in the EU) — to operate the website.
• Google Ireland Ltd. — for Google Analytics 4. Analytics data is pseudonymised; IP-anonymisation is enabled. We do not enable Google Signals or ad-personalisation features. Google may transfer data to the United States under the EU-US Data Privacy Framework.
• <strong>Google (Firebase)</strong> — for the Middle Control application's crash diagnostics (Crashlytics) and usage analytics (Analytics), as described in section 3. Data may be processed in the United States under the EU-US Data Privacy Framework.
• The Rocket Science Group LLC d/b/a Mailchimp — for newsletter management. Mailchimp is based in the United States and processes EU data under the EU-US Data Privacy Framework + Standard Contractual Clauses.
• Shopify Inc. — for the online store, hosted on a separate sub-domain (store.middlethings.co). Shopify has its own data-processing notice you should consult when placing an order.

We do not sell, rent, or trade your personal data, and we never have.

6. International data transfers

Some of our processors (Google, Mailchimp, Shopify) are based outside the European Economic Area. When personal data is transferred outside the EEA, we rely on one of the safeguards recognised by GDPR Articles 45–46:

• Adequacy decisions (e.g. the EU-US Data Privacy Framework for certified US recipients), or
• Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by additional technical safeguards where needed.

7. Your rights (GDPR)

If you are in the European Economic Area, the UK, or Switzerland, you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — ask us to delete your data when there is no overriding reason to keep it.
• Restriction — ask us to limit how we use your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — at any time, where processing relies on consent (e.g. analytics cookies, newsletter).
• Complaint to a supervisory authority — file a complaint with the French CNIL (cnil.fr) or your local DPA.

To exercise any right, email [email protected]. We will respond within one month.

8. California residents (CCPA / CPRA)

If you reside in California, you additionally have the right to:

• Know what categories of personal information we collect, why, and with whom we share it (described above).
• Request deletion of your personal information.
• Opt out of "sale" or "sharing" of personal information — although as noted above, we do not sell or share your personal information for cross-context behavioural advertising.
• Not be discriminated against for exercising any of these rights.

To exercise these rights, email [email protected] with "California Privacy Request" in the subject.

9. Security

We use TLS encryption in transit, restrict internal access to personal data on a need-to-know basis, and review our processors' security posture annually. No system is ever 100 % secure, but we take reasonable precautions to protect what you share with us.

10. Cookies

For details on the cookies and similar technologies we use, see our dedicated Cookie Policy.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will also be announced via our newsletter or a banner on the website.