MakeRoll is operated by Autom8 LLC. The controller is Autom8 LLC, represented by Michael Lip. Address: Davtashen, Pirumyan Street, Building 4/3, Apt. 12, Yerevan 0054, Armenia. Data protection contact: hello@makeroll.com, or by post to Autom8 LLC at the address above. For any privacy request, contact hello@makeroll.com. We reply within two business days, Monday to Friday, and complete requests within one month.
Version 2026-10-01. Effective on publication.
Autom8 LLC is established outside the EU and EEA. When we offer MakeRoll to people in the EU or EEA, the EU General Data Protection Regulation (GDPR) applies to our processing of their data, and this notice describes that processing.
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Website hosting and security logs: IP address, browser details, pages requested, time, security signals | To run and secure the site | Legitimate interests (Art. 6(1)(f)) |
| Google Analytics data on how you found the site and what you did on it (see Analytics and cookies below) | To learn which channels, such as social media, bring visitors and what they do on the site | Your consent (Art. 6(1)(a)) in the EEA, the UK and Switzerland. Legitimate interests (Art. 6(1)(f)) elsewhere. |
| Telegram data when you start the MakeRoll bot: numeric user ID, chat ID, username, the profile fields Telegram provides, and your messages and commands to the bot | To tie your checkout and membership to one Telegram account, and to support you | Contract (Art. 6(1)(b)) |
| Billing address (from Checkout) and the country that issued your card (from Stripe) | To check that we sell in your country, to refund buyers outside it, and to keep tax location evidence | Legal obligation (Art. 6(1)(c)) and contract |
| Membership records: chosen offer; Stripe customer, subscription, Checkout, invoice, payment, refund and dispute references; payment state; paid-through time; the terms version you accepted, with timestamp; invitation state; an action log | To give, extend, pause and end access correctly, and to handle refunds and disputes | Contract; legal obligation (tax and accounting); legitimate interests (fraud prevention, defending claims) |
| Lifetime member key and kit downloads: a hash of your member key (never the key itself), when it was issued, last used and revoked, and each kit file downloaded with its time | To deliver the kit to Lifetime members only, enforce the download limit, revoke keys on withdrawal, refund or dispute, and detect a shared key | Contract; legitimate interests (preventing licence abuse) |
Free Basics progress, once you send /basics: which lessons you received and when, and whether you stopped | To send the free lessons you asked for, one a day, and nothing after /basics stop or /stop | Contract (Art. 6(1)(b)), for the free service you request |
| Unfinished checkout: whether a Checkout you opened in the bot was paid | To send you one reminder, once ever, after a checkout you started expires unpaid. Send /stop to opt out | Legitimate interests (Art. 6(1)(f)) |
Withdrawal requests sent through the page at makeroll.com/withdraw/, the /withdraw command or email: what you enter, the membership it refers to, and the date and time received | To confirm and carry out your withdrawal and refund, and to prove when you asked | Legal obligation and contract |
| Support emails | To answer you | Contract and legitimate interests |
| Your posts, media and participation in the private Telegram group | To run the community and the critique | Contract |
| Recordings of your featured segment in a live session | To give members a replay | Your consent (Art. 6(1)(a)). We record your segment only if you say Yes in writing beforehand; no answer means No. You can withdraw consent at any time, and we then cut or blur your segment. |
Stripe collects your card details directly. MakeRoll never receives or stores full card numbers. The bot gives access only after a signed Stripe payment event; the return page after checkout is not used as proof of payment.
Embedded videos and external links. Some examples on the homepage load Instagram's player, or a YouTube player from youtube-nocookie.com, only when you press play. Meta or Google may then set their own cookies. Links to Instagram and other sites open the creator's original post, and those services process your data under their own privacy policies.
Automated access decisions. The bot automatically grants and removes group access according to your payment status and the country check. If you think a decision is wrong, email hello@makeroll.com and a person will review it.
We use Google Analytics 4 to learn which channels bring people to makeroll.com, such as Instagram, TikTok, Telegram, YouTube or a search engine, and what they do once they're here. It shows us which posts are worth making. We don't use it for ads, and we never sell what it collects.
With analytics on, the page sends Google the pages you view, the link or campaign tag that brought you, your device type, browser, screen size and language, and an approximate location. It also counts a few actions, such as pressing a join button, opening a Telegram link, playing one of our videos, loading an Instagram reel, opening an FAQ answer or coming back to the welcome page from checkout.
When you come back from Stripe Checkout, the welcome page records a checkout return. Before any page address goes to Google, the page removes every query parameter except the utm_ campaign tags, so no Checkout or payment reference reaches Google. Google reads your country and city from your IP address and then drops the address. GA4 doesn't log or store IP addresses. We never send Google your name, email address, Telegram ID or card details.
Two first-party cookies let GA4 recognize a repeat visit from the same browser. They hold random IDs and nothing else about you.
| Name | What it holds | Kept for |
|---|---|---|
_ga | A random ID for your browser | 13 months from your last visit |
_ga_<container-id> | Your current session and visit count on makeroll.com | 13 months from your last visit |
mr_consent_v1 (browser storage, not a cookie) | Your answer in the cookie banner and when you gave it | Until you change it or clear site data. We ask again after 13 months. |
In the EEA, the UK and Switzerland, nothing loads from Google until you press Accept in the banner. Google's tag doesn't load before then, and it never loads if you decline. In those countries we rely on your consent (Art. 6(1)(a) GDPR). The cookie rules ask for the same consent, under Art. 5(3) of the ePrivacy Directive and the national laws that implement it, and under the UK's PECR. We ask in Switzerland too.
Everywhere else, analytics is on when the page loads. We rely on our legitimate interest in knowing which channels work (Art. 6(1)(f)), and you can switch it off at any time. To decide whether to show the banner, the page asks Cloudflare, which already hosts the site, which country your connection comes from. We don't store that answer.
If you switch analytics off outside the EEA, the UK and Switzerland, the analytics cookies stop. Google's tag may still send short signals without a cookie or an ID, carrying the consent state, the time, your browser type and the page that referred you. Like any web request, the tag and each signal reach Google from your IP address.
Google LLC, and Google Ireland Limited where Google's terms name it, process this data for us as our processor under the Google Ads Data Processing Terms. We keep Google signals and advertising features switched off, so we don't link analytics data to Google accounts or use it for ads. GA4 deletes event data after 14 months.
Google may process the data in the United States. Google LLC is certified under the EU-US Data Privacy Framework, and Google's terms also include the European Commission's standard contractual clauses.
You can change your choice at any time with Cookie settings, here or at the foot of any page. If you withdraw consent, analytics stops and we delete the _ga cookies from your browser. Data sent before that stays in GA4 until its 14 months run out. You can also block Google Analytics on every site with Google's opt-out add-on at tools.google.com/dlpage/gaoptout, or block cookies in your browser.
| Recipient | Role |
|---|---|
| Stripe | Payments, billing, fraud screening, receipts and the billing portal. Stripe also acts as an independent controller for some of its own purposes under its privacy policy. |
| Telegram | Carries bot messages and hosts the private group, under its own privacy policy as a separate controller. |
| Cloudflare | Hosts the website, the membership application and its database (D1), and a private backup. |
| Porkbun and Google | Porkbun forwards mail sent to hello@makeroll.com, and Google (Gmail) hosts the mailbox that receives it. |
| Google (Google Analytics) | Measures visits and site actions for us, as our processor under the Google Ads Data Processing Terms. See Analytics and cookies above. |
| Our accountant or tax adviser, where we use one | Receives payment records needed for tax and accounting. |
We share only what each needs, and data that the law or a court requires. We never sell personal data, and we keep payment and Telegram identifiers out of invitation names and group posts.
International transfers. We are based in Armenia, outside the EU and EEA, and you give your data directly to us and to the providers above so that we can provide the service you ask for. Stripe, Telegram, Cloudflare, Porkbun and Google process data in several countries, including the United States. Where a provider moves personal data from the EEA to a country that has no EU adequacy decision, the transfer relies on the EU-US Data Privacy Framework (where the provider is certified) or on the European Commission's standard contractual clauses in that provider's terms. You can ask us at hello@makeroll.com for details of the safeguard a provider uses.
The private group is a Telegram group. Other members can see your posts, media and the profile details that your Telegram settings allow, including your phone number if your settings expose it. Check Telegram's phone-number privacy settings, and do not post confidential client material without permission. We need your separate permission before using your work, or a recording of you, in public marketing.
| Data | Kept for |
|---|---|
| Payment, refund, dispute, invoice and tax records, including country evidence | 5 years from the end of the calendar year in which the related tax payment was due, then deleted |
| Membership records (Telegram IDs, entitlement, terms acceptance, action log, member-key hashes and the kit download log) and withdrawal requests | For your membership and 24 months after it ends, to handle disputes and claims; then deleted or de-identified. Anything needed as tax or consent evidence is kept with the payment records. |
| Unfinished checkout records | 90 days |
| Support emails | 24 months after the last message |
| Live-session replays | While the members' archive is offered to entitled members, unless you withdraw your recording consent, in which case we cut or blur your segment. If the service closes, replays are deleted within 90 days after the closure notice period ends. |
| Website security logs held by MakeRoll | Up to 30 days, plus whatever Cloudflare keeps under its own settings |
| Google Analytics event data | 14 months, then GA4 deletes it. Reports that only show totals can stay longer. |
| Analytics cookies in your browser | 13 months from your last visit, or until you withdraw consent or clear them |
When your access ends, we remove you from the group promptly and keep only the records above. Telegram may keep its own copies, and we cannot recall material that members have already downloaded.
You can ask us to:
You can also withdraw your recording consent or your analytics consent at any time. Use Cookie settings for analytics, and email hello@makeroll.com for the rest.
If you ask us to delete the records that tie your Telegram account to your payment while your membership is active, we may have to end the membership, because we can no longer verify access. We will tell you before doing so.
You can complain to a data protection supervisory authority, in particular in the EU or EEA country where you live or work, or where you believe an infringement took place.
MakeRoll is for people aged 18 or over. We do not knowingly collect data from children.
We will post any update here with a new version date, and tell members about material changes by bot message or email.