Privacy Policy

Last updated: 2026. This page may be updated — admin-editable in a future release.

Data Controller

Megawatt Market operates this platform. For any privacy-related inquiries, contact us at admin@megawattmarket.com.

What We Collect and Why

We collect only what is necessary to provide the service. Below is a complete inventory of personal data collected, the purpose, and the lawful basis under GDPR.

Account data

Contract

Your email address, password hash (derived key only — we never store your plaintext password), and account role (buyer / operator / admin). Required to create and maintain your account and to deliver the service.

Listing data

Contract

Datacenter details submitted by operators: name, address, technical specifications, photos, and contact website. Required to operate the marketplace directory. This data is submitted voluntarily by operators and is publicly displayed.

RFQ data

Contract

Request for Quotation messages sent by buyers to operators: capacity requirements, timelines, and contact intent. Required to connect buyers and operators. RFQ records are retained as a business audit trail even after account deletion, but personal identifiers are removed.

Theme preference

Consent (implied)

Your light/dark theme preference is stored locally in your browser's localStorage under the key mw-theme. This value is never transmitted to our servers.

Cookie acknowledgment

Legitimate interest

We store a single flag in localStorage under the key mwm_cookie_ack to record that you have seen the cookie notice. This is never transmitted to our servers and is used solely to avoid showing the notice repeatedly.

What We Do NOT Collect

No tracking cookies or advertising cookies of any kind
No analytics scripts or telemetry (no Google Analytics, Mixpanel, Hotjar, etc.)
No third-party scripts on any page
No IP address logging
No user-agent or browser fingerprinting
No referrer tracking
No raw passwords — only a PBKDF2-derived key (100,000 iterations, SHA-256) is stored

Data Retention

Active accounts: Your account data is retained for as long as your account is active or as needed to provide the service.

Account deletion: When you request account deletion, your personal data is anonymized within 7 days. Your email is replaced with an opaque identifier, your password hash is zeroed, your name is set to "Removed user", and your account role is set to deleted. You may cancel the deletion request within this 7-day grace period.

RFQ records: RFQ records are retained for legitimate interest (business audit trail) even after account deletion, but all personal identifiers (email, name) are removed and replaced with anonymized references.

Listing data: Datacenter listings submitted by operators remain in the directory. Personal identifiers associated with the operator account are anonymized on account deletion. Operators may contact us to request removal of their listing data.

Your Rights

Under GDPR, you have the following rights regarding your personal data:

Right to access

Use "Download my data" in your account settings to export a JSON file of everything we store about you.

Right to erasure

Use "Delete my account" in your account settings. Your data will be anonymized within 7 days.

Right to rectification

Use "Edit profile" in your account settings to correct your personal information.

Right to object

Right to data portability

Use "Download my data" in your account settings to receive your data in a portable JSON format.

Contact

For any privacy-related questions, data access requests, or complaints, please contact us at admin@megawattmarket.com.