Privacy Notice

1. Controller

Vasileios Stamatiou, Einzelunternehmen, ModelWarden, c/o POSTFLEX PFX-464-608, Emsdettener Straße 10, 48268 Greven, Germany

Privacy contact: privacy@modelwarden.ai

2. Data minimisation

ModelWarden processes only data needed for accounts, licensing, security, support, and legal duties. The locally operated proxy does not automatically send tool content or local audit records to the portal.

At launch we do not use advertising profiles, newsletters, analytics cookies, or non-essential tracking technologies.

3. Data categories

Account data: name, email address, verification status, and a secure password hash. The plaintext password is not stored.

Session and security data: random session tokens, hashed verification and reset tokens, and technical security events.

Contract and licence data: plan, licence status, activations, signed-token metadata, and Paddle customer, transaction, and subscription identifiers. ModelWarden does not store full payment-card details.

Communications: support messages and withdrawal declarations that you submit.

Change records: the type, time, and affected record for administrative or security-relevant changes. Secrets and sensitive values are redacted.

4. Purposes and legal bases

Account operation, ordering, licence delivery, support, and contract administration are processed to perform a contract or take requested pre-contract steps under Article 6(1)(b) GDPR.

Accounting, commercial, and tax records are processed to comply with legal obligations under Article 6(1)(c) GDPR.

Abuse prevention, system security, limited change records, and legal defence rely on legitimate interests under Article 6(1)(f) GDPR. Scope and retention are limited and sensitive values are redacted.

5. Recipients and payment processing

Hosting, email, and infrastructure suppliers receive only the data needed for their services and are contractually bound as processors where the law requires it.

Paddle processes order and payment data as authorized reseller and Merchant of Record under its own data-protection responsibility. Paddle's privacy notice also applies to that processing.

Data is disclosed to authorities or other recipients only where legally required or necessary to establish, exercise, or defend legal claims.

6. Cookies and local storage

The portal uses only technically necessary cookies for sign-in, CSRF protection, and checkout. They are needed to provide the requested service; there is no advertising or analytics consent flow.

7. Retention

Session, verification, and reset tokens are regularly deleted after expiry. Unverified accounts are deleted seven days after the verification token expires unless another legal basis applies.

Detailed activation records are normally retained for 120 days. Security and change records are normally retained for 365 days.

Contract and support records are normally retained for three years after the relationship ends. Accounting and invoice records are normally retained for eight years under the currently applicable statutory rules.

Rolling backups are overwritten within 30 days unless a targeted copy is required for a security incident or legal duty.

8. Your rights

Where the legal conditions apply, you may request access, correction, erasure, restriction, portability, and object to processing. Consent can be withdrawn for the future; the launch service does not rely on marketing consent.

The signed-in dashboard provides data export and account deletion. Use the contact address for other requests. We may request reasonable identity evidence before disclosing or changing personal data.

You may complain to a competent data-protection authority, particularly where you habitually reside, work, or believe an infringement occurred.

9. Security and international transfers

Controls include transport encryption, password hashing, access restrictions, secret redaction, and separated licence-signing keys. No method can guarantee absolute security.

Where a recipient processes data outside the European Economic Area, we use an applicable adequacy decision or another transfer mechanism permitted by Chapter V GDPR.

10. Automated decisions and changes

We do not make solely automated decisions producing legal or similarly significant effects within Article 22 GDPR.

We update this notice for material changes. The published version and effective date identify the applicable edition.