Privacy Policy
Effective 20 July 2026
This policy explains how Chadwin processes personal data when you use our website, create an account, subscribe to a plan, or use the Chadwin API.
1. Who is responsible for your data
Chadwin AB, organization number 559525-6438, is the data controller. Our address is Tegelviksgatan 4 B, 116 50 Stockholm, Sweden. You can contact us at +46 76 107 00 68 or support@chadwin.co.
2. Data we process
Account and authentication
We process your email address, email-verification state, session tokens and expiry, and security information such as IP address and user agent. One-time sign-in codes are stored only as hashes and expire after 10 minutes. We use this data to create and secure your account and provide the service under our contract with you. Security and abuse-prevention processing is also based on our legitimate interests.
Subscriptions and billing
We process Stripe customer, checkout, subscription, product, and price identifiers; subscription status and billing periods; and limited webhook and checkout-attempt records. We use this data to start and administer your subscription, provide paid access, handle billing questions, and meet accounting, tax, and legal obligations. Stripe and Link collect and process payment-card and bank details; Chadwin does not store those payment credentials. Subscription administration is necessary to perform our contract with you; accounting, tax, and compliance records are processed to meet legal obligations.
API credentials and usage
We store an API key name, prefix, cryptographic digest, creation and revocation state, your plan entitlement, the request count for the current billing period, and the time of the latest request. We do not store plaintext API keys or a durable per-route request history. We use these records to authenticate requests, enforce plan quotas, operate the API, and resolve account or usage disputes. Service delivery is necessary to perform our contract with you. Proportionate security, reliability, abuse prevention, and dispute handling is based on our legitimate interests in operating and protecting the service.
Service messages and support
We process your email address and message content when we send authentication or service emails or when you contact support. If you choose to receive a newsletter, we retain your consent or opt-out preference until your account is deleted so that we can respect your choice. Account and service messages are necessary to perform our contract, while proportionate support processing is based on our legitimate interest in resolving requests. Newsletter delivery is based on consent, which you can withdraw at any time. After withdrawal, we retain the opt-out under our legitimate interest in honoring your choice and preventing unwanted messages.
Optional analytics
After you grant measurement consent, Cloudflare Web Analytics measures aggregate traffic and performance without cookies, and PostHog records page views and page leaves to help us understand how the product is used. We do not use PostHog session recording, automatic interaction capture, or browser exception capture. You can change or withdraw your choice at any time through Cookie Preferences. See our Cookie Policy for details.
3. Service providers and international transfers
We use the following providers to operate Chadwin:
- Cloudflare processes application traffic, Worker logs and traces, and consented Web Analytics
- Supabase hosts account and application data in Postgres
- Stripe Managed Payments and Sold through Link provide checkout, billing, fraud prevention, merchant-of-record, subscription management, and transaction-support services. For some regulated payment, fraud, and compliance activities they act as independent controllers
- Resend delivers authentication and service emails
- PostHog processes consented product analytics in its EU Cloud
- Google Workspace handles support correspondence
Where a recipient processes personal data outside the EEA, the transfer is protected by an applicable adequacy decision, the EU-US Data Privacy Framework, or contractual safeguards such as the European Commission's Standard Contractual Clauses.
4. How long we keep data
- Browser consent remains until you change it or clear browser storage
- One-time sign-in codes expire after 10 minutes
- Cloudflare Worker logs are retained for seven days
- Account, session, API-key, and service state is kept while your account exists, with limited security records retained longer where needed to prevent abuse or resolve claims
- Billing and webhook records are kept while needed to provide the service and meet accounting, tax, consumer-law, dispute, and other legal obligations
- Support correspondence is kept while needed to resolve the request and any related legal claim
- Analytics data is kept according to the active provider settings for product measurement
When a retention purpose ends, we delete or anonymize the data unless a dispute, legal hold, or other lawful obligation requires continued retention.
5. Your rights
Depending on the circumstances, you may ask us to give you access to your personal data, correct it, erase it, restrict its use, or provide it in a portable format. You may object to processing based on legitimate interests and withdraw consent at any time without affecting processing that was lawful before withdrawal. Legal retention duties may limit erasure in some cases.
Contact support@chadwin.coto exercise a right or ask a privacy question. You may also lodge a complaint with Sweden's data protection authority, Integritetsskyddsmyndigheten (IMY).
6. Security and changes
We use technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, and disclosure. No online service can guarantee absolute security. If a personal-data breach requires notification, we will notify the competent authority and affected people as required by law.
We may update this policy when our service, providers, or legal duties change. The effective date above identifies the current version.