Legal
Privacy Policy
Last updated 13 September 2026.
1. Who controls your data
Wardris, a sole trader established in Malta, is the data controller for the personal data described below. Contact: info@wardris.com. Given our size and the nature of our processing, we are not required to appoint a Data Protection Officer under Article 37 GDPR.
2. What we actually collect, and why
This table reflects what the Portal's code collects today, not a generic template:
| Data | Source | Why |
|---|---|---|
| Email address, display name, and a provider ID (Google sub or GitHub user ID) | Google or GitHub, when you sign in | To create and identify your Portal account. We never see or store a password — sign-in is SSO-only. |
| Billing name, email, and a Stripe customer/subscription ID | Stripe, when you subscribe to a paid tier | To create and manage your subscription. We never receive or store your card number — Stripe handles payment details directly; we only ever see an opaque customer/subscription reference. |
| A hash of your license key (never the key itself) | Generated when a license is issued | To validate the key later without being able to reconstruct it if our database were ever compromised. |
| A session cookie (signed JWT) | Set on login | To keep you signed in. Strictly necessary — the Portal doesn't work without it, so it isn't behind a cookie-consent banner. |
We do not use analytics or advertising trackers on the Portal, and we have no visibility into the traffic, data, or logs of your own self-hosted Gate or Rules instances — those run entirely on your infrastructure and never phone home except to validate a license key. This website (wardris.com) does not use analytics or advertising trackers either.
3. Legal basis (GDPR)
- Account and login data: necessary to perform our contract with you (providing the Portal).
- Billing data: necessary to perform our contract, and to comply with our own tax/accounting legal obligations.
- Security-related data (e.g. rejected login attempts, license-key hash lookups): our legitimate interest in keeping the service secure.
4. Who we share data with
We share personal data with a small number of processors, only as needed to run the service:
- Stripe — payment processing. Stripe's own privacy policy governs the card data it holds directly.
- Google Cloud Platform — hosts the Portal (Cloud Run) and our database provider.
- A managed database provider — hosts the Portal's database.
- Google / GitHub — as your chosen identity provider, they see that you're signing in to Wardris; we don't receive anything from them beyond your basic profile (email, name, provider ID).
We do not sell personal data, and we do not share it with anyone for their own marketing purposes.
5. International transfers
Your account data (email, name, license and billing records) is stored in a database located in the EU. The Portal application itself runs on Google Cloud, in the United States, so processing your request (for example, validating a login or a license key) involves a transfer of personal data to the US. Google Cloud participates in the EU-U.S. Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection for this kind of transfer. Stripe, our payment processor, similarly relies on its own recognised transfer mechanisms for any data it processes outside the EEA.
6. How long we keep it
We keep account and license data for as long as your account is active. Billing and invoice records are kept for 7 years after account closure, matching our bookkeeping and tax obligations. Other account data is deleted within a reasonable period after account closure, on request or otherwise.
7. Your rights
Subject to applicable law, you can ask us to access, correct, delete, or export your personal data, or object to or restrict certain processing. Contact info@wardris.com to exercise any of these. You also have the right to complain to your local data protection authority, or to Malta's Information and Data Protection Commissioner (idpc.org.mt).
8. Changes to this policy
We'll update this page if what we collect or why changes, and post the new date below.