Privacy Policy

01Who We Are

Warden (“we”, “us”, or “our”) operates modelwarden.io — a model trust and security auditing platform that helps teams evaluate open-weight AI models for deployment. This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use our website and services.

By accessing or using Warden, you agree to the collection and use of your information as described in this policy. If you do not agree, please do not use our services.

02Information We Collect

We collect information in the following ways:

Information you provide directly

• Account registration data: name, email address, and password (stored as a bcrypt hash — we never store your plain-text password).
• Profile information: optional company or organisation name.
• Payment details: processed by our payment processor (Stripe). We do not store raw card numbers.
• Communications: messages sent to our support channels.

Information collected automatically

• Usage data: pages visited, features used, scan history (model IDs submitted), timestamps, and in-app actions.
• Device and browser data: browser type, operating system, viewport size, and referring URL.
• IP address and approximate geolocation (city/country level).
• Session tokens stored in secure, HTTP-only cookies to keep you signed in.
• Vercel Analytics data (page views, Web Vitals) — anonymised and aggregated.

Information from third parties

• If you sign in with Google, we receive your Google account email address, display name, and profile picture URL from Google OAuth.
• Hugging Face Hub metadata (model architecture, license, parameter counts) — this is public data and not tied to your identity.

03How We Use Your Information

We use collected information to:

• Provide, operate, and improve the Warden platform.
• Authenticate your identity and maintain your session.
• Enforce plan limits (scan quotas, probe counts) and process upgrades.
• Send transactional emails: account verification, password reset, alert subscriptions you opt into.
• Respond to support requests and diagnose technical issues.
• Detect and prevent abuse, fraud, and violations of our Terms of Service.
• Analyse aggregate usage trends to guide product development (no individual profiling).
• Comply with applicable laws and legal obligations.

We do not sell your personal data to third parties. We do not use your audit data (model IDs, scan results, private notes) for advertising purposes.

04Data Storage and Security

Your data is stored in a managed PostgreSQL database hosted in the EU (Ireland) via Neon. All data in transit is encrypted using TLS 1.2 or higher. Passwords are hashed using bcrypt with a cost factor of at least 10. Session tokens are signed and stored in secure, HTTP-only cookies.

Access to production systems is limited to authorised Warden engineers. We conduct periodic security reviews and follow responsible-disclosure practices. Despite our safeguards, no system is completely immune to attack — we will notify you promptly if a breach affects your personal data.

05Cookies and Tracking

We use the following cookies and similar technologies:

• Session cookie (better-auth.session_token) — required for authentication. HTTP-only, SameSite=Lax (Strict on secure origins). Expires after 7 days or sign-out.
• Vercel Analytics — anonymous, cookieless page-view and performance metrics. No personal identifiers are transmitted.

We do not use advertising trackers, retargeting pixels, or behavioural analytics that build cross-site profiles.

06Data Sharing and Disclosure

We share your information only in the following limited circumstances:

• Service providers: Vercel (hosting and analytics), Neon (database), Stripe (payments), Resend (transactional email), and Google (OAuth). Each provider is bound by a data processing agreement.
• Legal requirements: When required by law, court order, or to protect the rights, property, or safety of Warden, our users, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before such a transfer takes effect.

07Retention

We retain your account data for as long as your account is active. If you delete your account, we remove your personal data (name, email, hashed password) within 30 days, except where we are legally required to retain it (e.g. billing records, which are kept for 7 years per financial regulations).

Aggregated, anonymised usage statistics (e.g. total scan counts) may be retained indefinitely as they cannot be linked back to you.

08Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update inaccurate or incomplete data via your profile page, or by contacting us.
• Deletion: Request deletion of your account and associated personal data.
• Portability: Request an export of your data in a machine-readable format.
• Objection / restriction: Object to certain processing activities or request we restrict processing while a complaint is resolved.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, email privacy@modelwarden.io. We will respond within 30 days.

09Children's Privacy

Warden is not directed to children under 13 (or 16 in the EU). We do not knowingly collect personal data from minors. If you believe a minor has provided us with their information, contact us at privacy@modelwarden.io and we will delete it promptly.

10International Transfers

Our primary infrastructure is hosted in the United States and the European Union. If you access Warden from outside these regions, your data may be transferred to and processed in these jurisdictions. We apply appropriate safeguards (including Standard Contractual Clauses where required under GDPR) for any international transfers.

11Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page and, for material changes, notify registered users by email. Continued use of Warden after changes take effect constitutes acceptance of the updated policy.

12Contact Us

For privacy-related enquiries, data requests, or to report a concern, contact us at: