Privacy Policy
This is an English translation provided for convenience. The Polish version is binding. In case of any discrepancy the Polish version prevails.
This policy describes how MADD processes personal data in connection with MaddLabs and the maddlabs.co website. It provides the information required by Article 13 of Regulation (EU) 2016/679 (GDPR). Other MADD products, including the DomaAI application, have their own privacy policy at madd.im/privacy-policy.html.
Controller
- The controller is Marcin Kisielinski, a sole trader doing business as MADD Marcin Kisielinski, registered in CEIDG, ul. Kajki 10-12, 10-547 Olsztyn, Poland, VAT ID PL7422297084, REGON 545106682 ("MADD").
- For personal data matters write to prywatnosc@madd.im or by post to MADD's address. MADD has not appointed a data protection officer because it is not required to.
MADD's role
- MADD is the controller of the data of Customers and contact persons: Account data, invoicing data, payment data, request metadata and correspondence.
- When a Customer or a Marketplace (for example OpenRouter) sends personal data of its users in API requests, MADD processes that data as a processor or subprocessor, only to generate the response and without storing it. The controller of that data is the Customer or its customer. The rules are set out in the Data Policy and the Data Processing Addendum.
Purposes, legal bases and retention
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Creating and keeping the Account, sign-in | e-mail address, name, optional company name, language, Google account identifier and the name and e-mail from Google (when signing in with Google), hashes of sign-in codes (valid for 10 minutes), session identifier | Art. 6(1)(b) GDPR (contract) | until the Account is closed; sign-in codes until they expire; session until sign-out, no longer than 30 days |
| Record of acceptance of the Terms | date and time of acceptance | Art. 6(1)(f) GDPR (legitimate interest: proving conclusion of the contract) | until claims become time-barred |
| API Keys, budgets and limits | hashes of API Keys, key names, budgets and spending limits set, usage tier | Art. 6(1)(b) GDPR | until the key is deleted or the Account is closed |
| Payments and Balance | amount, currency, status and Stripe payment identifier, Balance history; MADD never receives the full card number | Art. 6(1)(b) and (c) GDPR | 5 years from the end of the year in which the invoice was issued |
| Issuing invoices, KSeF, EU VAT checks | name or company name, address, country, VAT ID, result of the VIES check | Art. 6(1)(c) GDPR (tax and accounting law) and (b) | 5 years from the end of the year in which the invoice was issued |
| Billing of requests, reliability statistics, abuse detection | request metadata: time, hashed key identifier, model, token counts, HTTP status, latency and time to first token; no request content | Art. 6(1)(b) GDPR (billing) and (f) (reliability and security of the services) | up to 5 years from the end of the year in which the invoice was issued |
| Connection security and abuse prevention | IP address and technical connection data | Art. 6(1)(f) GDPR (legitimate interest: security) | only in memory for rate limiting attempts; the server keeps no access log with IP addresses |
| Correspondence, complaints, requests | data provided in the message | Art. 6(1)(b), (c) (consumer complaints) and (f) GDPR | until claims become time-barred |
| Service e-mails | e-mail address | Art. 6(1)(b) GDPR; notices of changes to documents: (c) | until the Account is closed |
| Establishing, pursuing and defending claims | data needed in the matter | Art. 6(1)(f) GDPR | until claims become time-barred |
After an Account is closed, MADD deletes the Account data, except data it must keep under tax and accounting law or to establish, pursue or defend claims.
Whether providing data is required
Providing an e-mail address is voluntary but necessary to create an Account. Invoicing data is a statutory requirement when topping up the Balance. Signing in with Google is optional.
Recipients
- Data may be received by providers that perform services for MADD: server hosting, GPU server rental, DNS, payments, invoicing, e-mail delivery and Google sign-in. The current list with purpose, data and location is on the Subprocessors page.
- Invoices that the law requires are sent to the Polish National e-Invoicing System (KSeF) run by the Ministry of Finance. Data may be disclosed to public authorities where the law requires it.
- The Website loads fonts from Google Fonts. Your browser then connects to Google's servers, which receive your IP address and browser information. Google Fonts does not set cookies.
Transfers outside the EEA
Some providers (Stripe, Google, Cloudflare, Runpod) belong to groups based in the United States or may process data outside the European Economic Area. Such transfers rely on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework where the provider is certified) or on the Standard Contractual Clauses adopted by the European Commission, as offered by the provider. A copy of the safeguards can be requested at prywatnosc@madd.im. The GPU servers that process request content are currently located in Iceland, within the EEA.
Your rights
- You have the right to access your data, to rectify, erase and restrict its processing, to data portability for data processed under a contract, and to object to processing based on legitimate interest.
- To exercise your rights, write to prywatnosc@madd.im from your Account e-mail address. MADD replies without undue delay and in any case within one month. You can change some data yourself in the Dashboard.
- You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland, or with the supervisory authority in the country of your habitual residence or place of work.
Automated decision-making
MADD does not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect a person (Article 22 GDPR). The automatic assignment of a usage tier based on total top-ups and the rejection of requests over the limits or with an exhausted Balance follow directly from the Terms and are not profiling.
Cookies and browser storage
The Website uses only a strictly necessary session cookie, a short-lived cookie during Google sign-in and the browser's local storage to remember the language and selected tabs. There are no analytics or advertising cookies. Details: Cookies.
Security
All communication is encrypted (TLS, and an SSH tunnel between the API gateway and MADD's server in Poland). API Keys and sign-in codes are stored only as cryptographic hashes. Request content is not stored. Only the business owner has access to the servers.
Changes
Changes are published on this page. MADD informs Customers with an Account of material changes by e-mail before they take effect.
Changelog
- 2.1 (8 November 2026): SSH tunnel encryption to MADD's own server in Poland.
- 2.0 (6 November 2026): Polish version added; table of purposes, legal bases and retention; whether data is required; transfers outside the EEA; automated decisions; cookies; Google Fonts; list of providers moved to the Subprocessors page.
- 1.1 (6 November 2026): accounts, payments, invoices and VIES.
- 1.0: first version in English.