Privacy Policy

This Privacy Policy explains how WardenAuth ("we", "us", or "our") collects, uses, and protects personal data when you visit wardenauthz.com or use the WardenAuth platform (the "Service"), and the rights you have under the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data Controller

The data controller is WardenAuth, operating WardenAuth. For any privacy matter, write to privacy@wardenauthz.com.

2. Our Two Roles

Controller. We decide how to process the data of the people who visit our website, create an account, or contact us. This policy covers that processing.

Processor. Data that our customers put into the Service about their own users (subject identifiers, attributes, roles, and the audit trail of their access checks) is processed on the customer's behalf and under their instructions, as set out in our Data Processing Agreement. If you are one of our customer's users, please contact that customer to exercise your rights.

3. Information We Collect

• Account data: email address, organization name, and your password (stored only as a hash by AWS Cognito) and MFA settings. If you sign in with Google, we receive your email address and basic profile from Google.
• Usage and security data: API requests, access-check counts, audit log entries, IP addresses, and user agent strings.
• Billing data: payments are processed by Stripe. We keep only your Stripe customer ID, plan, and subscription status — never card numbers.
• Correspondence: what you send us by email.
• Terms acceptance: when you create an organization we record your user ID, the organization, the version of these documents you accepted, the date, and your IP address.
• Website analytics (only with your consent): if you accept analytics on wardenauthz.com, Google Analytics collects pseudonymous usage data through cookies.

4. Purposes and Legal Bases

• Performance of a contract (Art. 6(1)(b)) — creating and running your account, providing the Service, billing, and support.
• Legitimate interests (Art. 6(1)(f)) — securing the Service, preventing abuse and fraud, debugging, and keeping evidence of the contract. We balance these interests against your rights.
• Legal obligation (Art. 6(1)(c)) — accounting and tax records.
• Consent (Art. 6(1)(a)) — website analytics. You can withdraw it at any time by clearing this site's data in your browser; the consent banner will then ask again.

We do not sell your personal data, use it for advertising, or use it to train AI models.

5. Where Your Data Is Stored and Transfers

The Service runs on Amazon Web Services in the us-east-1 region (N. Virginia, United States): Aurora PostgreSQL and DynamoDB databases, S3 archives, Lambda, Cognito, SES email, and CloudFront. Data is encrypted in transit and at rest.

Transfers to the United States rely on the EU–US Data Privacy Framework, under which AWS, Stripe, and Google are certified, and on the European Commission's Standard Contractual Clauses included in their data processing terms.

6. Sub-processors

• Amazon Web Services, Inc. — hosting, databases, authentication, and transactional email (United States)
• Stripe, Inc. — payment processing (United States / global)
• Google LLC — our email inbox (Google Workspace) and, only with consent, website analytics (United States)

Each is bound by data processing terms as required by Article 28 GDPR. We will announce new sub-processors at least 30 days in advance as described in the DPA.

7. How Long We Keep Data

• Account and organization data: while your account is active. When you delete your organization, its data is removed from our live databases immediately, and the sign-in account of every user who belongs to no other organization is erased.
• Audit logs: 7 to 180 days depending on your plan, plus an optional archive of up to 360 days on paid plans. Archives are purged when the organization is deleted, unless the customer enabled compliance-mode retention, in which case they are deleted when that retention period ends.
• Backups: database backups are kept for up to 12 months and are then overwritten. Deleted data is not restored from them except to recover from an incident.
• Server logs: 1 month.
• Terms acceptance records: 5 years after the account closes, the limitation period for contractual claims under Spanish law.
• Invoices and billing records: 6 years, as required by Spanish commercial and tax law.

8. Your Rights

You have the right to:

• Access (Art. 15) — get a copy of your personal data
• Rectification (Art. 16) — correct inaccurate or incomplete data
• Erasure (Art. 17) — have your data deleted; you can also delete your organization from the dashboard settings
• Restriction (Art. 18) — limit how we process your data in certain circumstances
• Portability (Art. 20) — receive your data in a structured, machine-readable format
• Objection (Art. 21) — object to processing based on our legitimate interests
• Withdraw consent (Art. 7(3)) — at any time, without affecting earlier processing

Write to privacy@wardenauthz.com. We reply within one month (extendable by two more months for complex requests, in which case we will tell you). If you are not satisfied, you can complain to the Spanish Data Protection Agency (aepd.es) or to the authority of your country of residence.

9. Automated Decision-Making

We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing (Article 22 GDPR). The access decisions the Service computes are made for our customers, under their own policies.

10. Cookies and Local Storage

• Strictly necessary: the dashboard sets a secure, httpOnly cookie that keeps you signed in, and stores interface preferences (such as your cookie-banner choice) in your browser's local storage. These need no consent.
• Analytics: Google Analytics cookies are set on wardenauthz.com only if you click "Accept" in the consent banner. If you decline, no analytics scripts load.

Fonts and all other assets are served from our own domains; no other third-party content is loaded.

11. Children

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect data from minors; if you believe a minor has given us data, contact us and we will delete it.

12. Changes to This Policy

We will notify account holders of material changes by email before they take effect. The date at the top shows the current version.

13. Contact

Privacy questions or requests: privacy@wardenauthz.com