Privacy policy

This policy explains what personal data Wrennick handles, why, and what rights you have. We keep it short where we can, because we collect very little.

Who is responsible

The controller under the GDPR is your full legal name, trading as Wrennick,street, postal code, city, Austria. Email: hello@wrennick.com. More details are in the imprint. We are not required to appoint a data protection officer and haven't done so.

The short version

• No analytics, no tracking, no advertising, no selling of data.
• Browsing the site needs no account and stores nothing about you beyond short-lived server logs.
• If you sign in, we store your name, email address and profile picture from Discord or Google.
• If you buy something, Stripe handles the payment. We never see your card details.

Visiting the website

The site is hosted by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). To deliver pages and protect the site against attacks, Cloudflare processes technical data such as your IP address, the page requested, the time, and your browser type. Error and request logs are kept for at most 7 days. Fonts are served from our own server, so no requests go to Google Fonts.

Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Cloudflare acts as our processor under a data processing agreement.

Cookies

We only use cookies that are strictly necessary. When you sign in, we set a session cookie that keeps you signed in, and during sign-in a short-lived cookie that protects the sign-in step against forgery. Cloudflare may set a security cookie to tell people apart from bots. Because these cookies are required for a service you asked for, no consent is needed (§ 165(3) TKG 2021). We use no tracking or advertising cookies.

Your account

You can create an account by signing in with Discord or Google. When you do, they send us your name, email address, profile picture and your account ID with them. We store this to run your account: to show your downloads and purchases, give you access to what you've bought, and contact you about it. Discord and Google also give us access tokens. We store them encrypted and only use them for signing in. We don't read your Discord servers, messages, Google Drive, contacts or anything else.

To keep your account safe, each sign-in session is stored with your IP address and browser type. A session ends when you sign out or after 7 days without a visit, and expired sessions are deleted. We also keep a log of sign-ins (time, sign-in method, IP address and browser) for 90 days, so we can spot misuse, plus the time of your last sign-in.

Legal basis: providing the account you asked for (Art. 6(1)(b) GDPR), and our legitimate interest in protecting accounts from misuse (Art. 6(1)(f) GDPR). We keep your account data until you delete your account, which you can do at any time on your account page. Deleting it removes your profile, sessions and connected sign-in methods straight away. Purchase records we're legally required to keep are the exception, see below.

For the sign-in step itself, Discord and Google are independent controllers under their own policies: Discord privacy policy, Google privacy policy.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't transfer it to anyone, use it for advertising, or use it to train AI models.

Downloads and purchases

Paid products are sold through Stripe, which acts as reseller and merchant of record and appears at checkout as Link: Stripe takes your payment, handles VAT and sales tax, and sends your receipt. Stripe processes your payment details and billing address as an independent controller under its own privacy policy. We never receive your card or bank details.

From Stripe we receive your email address, what you bought, the price, the date and your country, and we record which free plugins you download with your account. We use this to give you access to your products, help you with problems and handle refunds.

Legal basis: fulfilling your purchase (Art. 6(1)(b) GDPR) and our legal duty to keep business records (Art. 6(1)(c) GDPR). Austrian tax law requires us to keep purchase records for 7 years (§ 132 BAO), even if you delete your account. After that we delete them.

Emailing us

Email sent to hello@wrennick.com is forwarded by Cloudflare to our mailbox at your email provider. We use your message and address to answer you, based on your request (Art. 6(1)(b) and (f) GDPR), and delete conversations once they're finished, at the latest after 3 years, unless they're part of records we must keep longer.

Our Discord server

If you join our community on Discord, Discord processes what you post under its own privacy policy. We can see what you post there, like any other member or moderator, and only use it to run the community and give support.

Who receives data

• Cloudflare: hosting, our database and email forwarding, as our processor.
• Stripe: payments, as an independent controller and merchant of record.
• Discord and Google: sign-in, as independent controllers.
• Authorities, only where the law requires it.

We don't sell personal data or share it with anyone for advertising.

Data outside the EU

Our database is stored in a Cloudflare data centre in Europe. Cloudflare, Stripe, Discord and Google are US companies, so data can reach the USA. Where a company is certified under the EU-US Data Privacy Framework, the transfer relies on the European Commission's adequacy decision. Otherwise it relies on the Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

Your rights

Under the GDPR you have the right to:

• get a copy of the data we hold about you (Art. 15)
• have wrong data corrected (Art. 16)
• have your data deleted (Art. 17)
• have processing restricted (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on our legitimate interests (Art. 21)

Write to hello@wrennick.com and we'll answer within one month. You can also complain to a data protection authority. In Austria that's the Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, www.dsb.gv.at, or the authority in the EU country where you live.

Other things you should know

• You don't have to give us any data to use the website. Without signing in, you just can't download or buy products.
• We don't make automated decisions about you or build profiles (Art. 22 GDPR).
• You need to be at least 14 to create an account.

Ember

Ember Cloud isn't open yet. Before it opens, we'll add here exactly what it processes, including which AI providers receive game dialogue.

Changes

If we change how we handle data, we update this page and the date at the top. If a change affects your account in a significant way, we'll email you before it takes effect.