Privacy Policy

MAKI Pack Configurator at custom.maki-batteries.com.

Last updated: 30 April 2026 · Effective immediately.

This privacy policy applies only to the MAKI Pack Configurator at custom.maki-batteries.com. For the marketing site maki-batteries.com, the Second Ride mobile app and the MAKI newsletter, see the main MAKI privacy policy.

1. Who is responsible

The data controller within the meaning of Art. 4(7) GDPR is:

Second Ride GmbH
Carlo Schmid & Sebastian Marten (Managing Directors)
Im Marienpark 3, 12107 Berlin, Germany
E-mail: info@maki-batteries.com

2. What the Configurator does

The Pack Configurator lets you design a custom, repairable lithium-ion battery pack in the browser, save configurations to a personal account, generate PDF datasheets and STEP CAD files locally on your device, and send a configuration to MAKI engineering as a quote request.

You can use the Configurator without an account to sketch a pack and produce PDF and STEP exports. Saving a configuration across devices, naming packs, and submitting a quote request require an account.

3. Data we collect

3.1 When you visit anonymously

Like every web server, our hosting infrastructure briefly processes technical request data: IP address, user agent, requested URL, referrer, timestamp. This is required to deliver the page and to defend against abuse. The data is held in standard server logs for up to 30 days and is then deleted or anonymised. Legal basis: Art. 6(1)(f) GDPR, legitimate interest in operating a secure website.

3.2 When you create an account or log in

To create an account we collect:

E-mail address (required, used as your login)
Password (required, stored only as a salted hash by our ERP system; we never see it in plain text)
First name (required)
Last name, organisation, mobile number (each optional)

Legal basis: Art. 6(1)(b) GDPR — performance of a contract or pre-contractual measures at your request. Without an account we cannot save your configurations or process a quote request.

3.3 When you save a pack

Saved packs are stored on our server with the following fields: internal identifier, your chosen pack name, the full pack configuration (cell format, chemistry, series and parallel count, polygon outline, corner radius, BMS / connector / SOC placement), and the e-mail address of the account that owns it. Saved packs are visible only to you and to authorised MAKI engineers when you explicitly involve them in a configuration review.

3.4 When you request a quote

If you click "Request quote" we transmit:

the current pack configuration (same fields as a saved pack);
the free-text message you optionally write into the quote dialog;
your account e-mail and, if provided, name and organisation, so our sales team can reach you.

The data lands in our internal CRM (see "Processors" below) and is processed by MAKI engineering and sales. Legal basis: Art. 6(1)(b) GDPR. Once a quote process is initiated, retention follows the commercial-law obligations under §§ 147 AO and 257 HGB (typically 6 to 10 years for invoiceable correspondence).

3.5 When you export a PDF or STEP file

PDF datasheets and STEP CAD files are generated entirely in your browser; the file content itself never reaches our servers. If you are logged in we record a small operational log entry: account e-mail, export type (pdf or step), the key pack parameters and a timestamp. We use this to prioritise pre-validated shapes in our engineering roadmap and to detect abuse. Legal basis: Art. 6(1)(f) GDPR. Retention: 12 months, then automatic deletion.

4. Cookies and analytics

We keep cookies and stored values to a minimum and disable analytics until you explicitly accept them.

Strictly necessary (no consent needed): a session cookie that keeps you logged in (7 days), a small record of your cookie-banner choice, and a local-only draft of the pack you are currently sketching — that draft never leaves your device unless you actively save the pack.

Analytics — only after you accept in the cookie banner:

Google Analytics 4 by Google Ireland Limited, loaded with Consent Mode v2. Anonymous, IP-truncated usage statistics. Cookies live up to 2 years; events are retained for 2 months. May involve transfers to the United States under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(a) GDPR.
PostHog by PostHog Inc., EU instance at eu.posthog.com: pseudonymous product analytics. Retention 12 months. Data stays within the European Economic Area. Legal basis: Art. 6(1)(a) GDPR.

You can revoke consent at any time via "Cookie settings" in the Configurator footer. Optional cookies are then deleted on your next page load.

5. Processors and recipients

We rely on the following processors to operate the Configurator. We have a data-processing agreement (Art. 28 GDPR) in place with each of them.

Processor	Purpose	Location
Second Ride GmbH (own infrastructure)	Application hosting, saved packs, session management, operational event log.	Germany
ERPNext / Frappe (self-hosted)	Customer accounts, contact records, quote pipeline (CRM).	Germany — operated by Second Ride GmbH on its own servers; not a third-party SaaS.
Google Ireland Limited (Google Analytics 4)	Anonymous usage analytics. Consent required.	EU + transfers to USA under the EU-US Data Privacy Framework.
PostHog Inc. (EU instance)	Product analytics. Consent required.	European Economic Area only — no third-country transfer.
Google LLC (Google Fonts via `fonts.googleapis.com`)	Web typography (Inter, JetBrains Mono).	USA. Connecting to Google Fonts transmits your IP address to Google.

Beyond these, we share quote-request data with our internal sales and engineering teams under standard employment confidentiality. Saved configurations are not shared with anyone unless you explicitly involve MAKI in a review.

6. International transfers

The Configurator and its CRM run on servers located in Germany. Transfers to the United States happen only when you grant analytics consent (Google Analytics 4) or when your browser loads Google Fonts. For these transfers we rely on the safeguards offered by the EU-US Data Privacy Framework and on the Standard Contractual Clauses adopted by the European Commission.

7. How long we keep data

Data category	Retention
Server access logs (anonymous browsing)	Up to 30 days, then deleted or anonymised.
Account data (e-mail, name, organisation, mobile)	For the lifetime of the account, until you delete it.
Saved pack configurations	For the lifetime of the account, until you delete the pack or the account.
Quote requests linked to an active sales process	6–10 years (commercial-law obligations under §§ 147 AO, 257 HGB).
Operational export log (PDF / STEP)	12 months, then automatic purge.
Google Analytics 4 events	2 months (Google's default for our property).
PostHog raw events	12 months, then automatic purge.

8. Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you (Art. 15);
Rectification of inaccurate data (Art. 16);
Erasure of your data, subject to retention obligations (Art. 17);
Restriction of processing in defined situations (Art. 18);
Data portability: receive your saved packs and account data in a machine-readable format (Art. 20);
Object to processing based on legitimate interest (Art. 21);
Withdraw consent at any time, with effect for the future (Art. 7(3));
Lodge a complaint with a supervisory authority — for us, the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI).

To exercise any of these rights, write to info@maki-batteries.com. We will respond within one month.

9. Account deletion

You can request deletion of your account at any time by writing to info@maki-batteries.com. On deletion we remove your account, your saved packs, your operational export log, your CRM contact entry and any analytics identifier associated with you. Quote requests linked to an invoiceable sales process may be retained in pseudonymised form to satisfy the retention obligations cited in Section 7.

10. Security

The Configurator is served exclusively over HTTPS. Passwords are hashed using standard algorithms before storage; we never have access to your plain-text password. Session cookies are HttpOnly and Secure. Server access is restricted to authorised MAKI staff over keyed SSH. We review our infrastructure for security issues on an ongoing basis; material incidents that affect personal data are reported to the competent supervisory authority within 72 hours as required by Art. 33 GDPR.

11. Changes to this policy

We may update this policy when we add features that change the way data is processed (for example, when we introduce additional integrations or change retention windows). The "Last updated" date at the top of this page reflects the most recent change. Material changes are flagged inside the Configurator on your next visit; non-material changes (typos, structural edits) are silent.