Privacy, without
the vague promises.

Who is responsible

Ganado international s.r.o., IČO 19322119, Příčná 1892/4, Nové Město, 110 00 Praha 1, Czech Republic. Contact: info@ganado.cz.

Early-access requests

We store your email address, selected operating system, selected use case, a coarse campaign source (such as GitHub or direct), consent version and signup timestamp. If you later receive an invitation or purchase access, its status may be recorded. We do not ask for payment details, local files, passwords or API keys in the signup form.

With your consent, we use these details to manage the early-access list, understand which workflows to prioritize, and email you about Ganado Bridge access. Joining does not subscribe you to accounting promotions. We do not sell this list.

Hosting and protection

This website, the live relay service and Ganado Core run on Ganado’s own server. Ganado Core stores signup records, aggregate counters and managed-relay records. HTTPS requests to the website, the relay and Core pass through Cloudflare, which processes request and response content and connection metadata, including IP addresses, to deliver and secure those requests on Ganado’s behalf. External providers and their subprocessors may process data outside the EEA under applicable safeguards; Cloudflare’s processing terms are set out in its Data Processing Addendum. The website does not install advertising pixels or analytics cookies. Technical logs on Ganado’s server and at Cloudflare may contain IP addresses, request metadata and timestamps.

The signup API temporarily uses a hash of the request IP in memory for per-instance rate limiting. It does not write that value into the waitlist. We also use input validation, a honeypot and database admission limits to reduce abuse. Authorized business administrators can access the list; public visitors cannot read it.

Retention and withdrawal

Unconverted waitlist entries are retained for up to 90 days. Maintenance removes expired entries; backups may retain deleted data for the applicable backup period. You can withdraw consent or request removal at any time by emailing us with the subject “Remove me from Bridge”. Withdrawal does not affect processing already performed on the basis of consent.

Your rights

Where applicable, you may request access, correction, deletion, restriction or portability of your personal data, and object to processing. You may complain to the Czech Office for Personal Data Protection (ÚOOÚ) or your competent supervisory authority. We may need proportionate verification that a request comes from the relevant email owner.

Local agent and managed relay

The public website does not access your machine by itself. If you explicitly run the managed relay agent and pair it to a supported MCP client, requested file contents, paths, images and command output travel through the relay to that client. Relay jobs store short-lived encrypted request/result envelopes; routing metadata such as account/device identifiers, tool name, timestamps and status remains plaintext. Device and OAuth tokens are stored server-side only as one-way hashes, while the device private key remains on the Mac. The live relay process necessarily sees a requested tool call before encrypting it for queueing and sees the returned result after decryption before sending it to your AI client; this is not end-to-end secrecy from Ganado’s live relay process. Your AI provider’s own privacy terms also apply. The managed relay is a technical preview and is not a public ChatGPT-directory release.

General rights information: European Commission — data protection for individuals.

Commercial orders

When checkout is available, purchases are processed by Stripe Managed Payments through Link. Link collects the billing, contact, payment and tax information required for the transaction, provides its own privacy notice, and handles payment-related communication. Ganado receives the order information necessary to establish licence rights, reconcile payments, provide product support and process refunds. We do not receive full card numbers. Order information is processed to perform the contract and meet applicable accounting/legal obligations, not added to marketing lists without consent. Accounting records may need retention beyond the interest-list period; the 90-day waitlist limit does not apply to mandatory transaction records.

The local agent still has no automatic usage telemetry. Download requests on GitHub and merchant checkout events are not proof of installation or active use. A voluntary GitHub activation report is public; do not put personal data, device paths or private logs in it.

Aggregate website measurement

We count page views and clicks to installation, download and licence pages. The stored record contains only a UTC date, a fixed event name, an allowlisted page path, a coarse source such as GitHub, a test flag and an aggregate count. We do not store an analytics cookie, visitor identifier, device fingerprint, raw URL, referrer, email or IP address in these counters. The event API temporarily uses a hashed request IP in memory for rate limiting; it is not added to the aggregate table. Hosting providers still handle ordinary technical request metadata.

These counters cannot identify unique visitors, prove a download finished or establish product activation. Automated and self-test events are marked separately where detected. Measurement is skipped when your browser sends Do Not Track or Global Privacy Control. Aggregate buckets expire after 30 days through daily retention. You may block /api/events without preventing downloads, signup or purchase.

Relay retention and deletion

Pairing codes expire after 10 minutes; OAuth authorization codes after 5 minutes; access tokens after one hour; rotating refresh tokens after 30 days. Expiry means a credential no longer authorizes access, not that every database record is immediately erased. Queue jobs expire after 45 seconds. Current queue maintenance removes completed envelopes older than 10 minutes and expired or failed envelopes once they are more than 10 minutes past expiry when later queue activity runs. This is opportunistic cleanup, not a guaranteed ten-minute deletion timer. A period with no new queue activity can delay physical deletion.

Device/account records, hashed credentials, revocation records and security admission metadata support operation and abuse prevention. The preview does not currently promise an automatic maximum deletion interval for all inactive device/account records. Disconnect revokes access; request full account/device deletion at info@ganado.cz with the subject Bridge data request. Do not send raw tokens or private keys. Backups and external provider logs follow their applicable retention arrangements. These operational records are not counted as independent users or used to inspect file contents for marketing.

Disclosure updated 8 October 2026. No new analytics collection was added by this update. Publisher details and release status are available separately.