Privacy Policy

Last updated: August 28, 2026

TL;DR: modelBridge collects almost no data. Your API key, generation history, and preferences are stored only on your own computer, and we never see what you generate. What we do hold: your license key and a device identifier, on a Cloudflare Worker we operate, so we can validate your subscription — plus anything you choose to send us, such as a bug report or a satisfaction rating. Error reporting and analytics are off by default; you opt in from Settings → Privacy. Your email is held by LemonSqueezy, and by us only if you send us a report. You can read or delete everything we hold with the /api/user-data endpoints in Section 7 — with one honest exception, a satisfaction rating, which is unlinked to your account by design and therefore cannot be looked up (Section 7).

1. Who is Responsible for Your Data?

Data controller:

Niklaz Hallberg (sole trader) Stockholm, Sweden Email: info@modelbridge.app

modelBridge is operated by Niklaz Hallberg as a sole trader. Under the EU General Data Protection Regulation (GDPR, Regulation EU 2016/679), Niklaz Hallberg is the data controller for the limited personal data described in this policy.

A Data Protection Officer (DPO) has not been appointed, as no appointment is required under GDPR Article 37 — modelBridge does not carry out large-scale systematic monitoring, does not process special categories of data, and is not a public authority.

2. What Personal Data modelBridge Processes

modelBridge’s architecture is designed to minimize data collection. Here is a complete picture.

Data processed by modelBridge (directly)

Data	Purpose	Legal basis (GDPR Art. 6)	Stored where
License key	Validating your active subscription	Art. 6(1)(b) — necessary to perform the subscription contract	Your local machine, and a Cloudflare Worker operated by modelBridge, which validates it against LemonSqueezy. Retained while the subscription is active (up to 3 years), then 90 days
Device identifier	Enforcing the device activation limit per license	Art. 6(1)(b) — necessary to perform the subscription contract	Your local machine; sent alongside the license key to modelBridge’s licence Worker, and on to LemonSqueezy
Email address	Purchase confirmation, subscription management; replying to a report you send us	Art. 6(1)(b) for the subscription; Art. 6(1)(f) for replying to a report you initiated	LemonSqueezy’s servers. Also our Cloudflare Worker in two cases: the subscription record created from LemonSqueezy’s webhook, and any bug report or feature request you choose to send (see “Bug reports and feature requests” below). Retained as for the license key; reports for 180 days

Anonymous error reporting (optional)

When an unexpected error occurs during use, the Plugin sends a brief, anonymous report to a Cloudflare Worker operated by modelBridge. This helps us find and fix bugs.

Data	Purpose	Legal basis (GDPR Art. 6)	Stored where
Error type, source, HTTP status	Identifying which errors occur and how often	Art. 6(1)(f) — legitimate interest in maintaining and improving the Plugin	Cloudflare Worker KV (one record per unique error type — subsequent occurrences update a counter, not stored individually)
Model ID (public identifier, e.g. `fal-ai/flux-2-pro`)	Understanding which models trigger errors	Same as above	Same as above
Error message excerpt (max 300 characters)	Diagnosing the root cause of a bug	Same as above	Same as above
Plugin version, host app version, and platform (e.g. `1.0.5`, `PPRO 25.1`, `MacIntel`)	Knowing which software versions are affected	Same as above	Same as above
Retryable flag and timestamp	Understanding error severity and timing	Same as above	Same as above

No prompts, filenames, API keys, or personally identifying information are included in error reports. Reports contain only the technical error context listed above.

Opt-out: You can disable error reporting at any time in Settings → Privacy. When disabled, no error data leaves your computer.

IP address and rate limiting: To prevent abuse of the error reporting endpoint, the server reads your IP address solely to enforce a rate limit (max 20 reports per minute). The IP address is held in Cloudflare’s infrastructure for 60 seconds and then automatically deleted. It is never logged, associated with your identity, or used for any other purpose.

Behavioral analytics (optional, off by default)

If you switch on any of the three analytics settings in Settings → Privacy, the Plugin sends anonymous event counts to the same Cloudflare Worker.

Data	Purpose	Legal basis (GDPR Art. 6)	Stored where
Event counts (e.g. a generation started, a model was selected, a tab was opened)	Understanding which parts of the Plugin are used, so development effort goes where it helps	Art. 6(1)(a) — consent, given by switching the setting on	Cloudflare Worker KV, aggregated per installation. 90-day TTL per installation; 365-day global aggregate
Installation ID (16-character hash, see Section 4)	Grouping events from one installation without identifying you	Same as above	Same as above

No prompt text, file name, model output, API key or license key is ever included; those field names are stripped before sending and again on arrival. Switching the setting off stops collection immediately — nothing is queued or sent retroactively.

Bug reports and feature requests (only when you send one)

Nothing here is collected in the background. A report is sent only when you write one in Settings → Feature Request & Bug Report and press Send.

Data	Purpose	Legal basis (GDPR Art. 6)	Stored where
Your message, and whether it is a bug or an idea	Diagnosing and fixing the problem you describe	Art. 6(1)(f) — legitimate interest in supporting a report you initiated	Cloudflare Worker KV, 180 days
Your name and email, if you fill them in — pre-filled from your license email when your subscription is active	Replying to you	Same as above	Same as above
License ID and instance ID, when your subscription is active	Matching the report to an account so we can reply to the right person. This is a lookup key, not proof of identity — we confirm you through your account before any billing or account change	Same as above	Same as above
System context — plugin, Premiere and OS versions, installed model count, recent error text with paths, links and prompt text stripped out	Reproducing the issue	Same as above	Same as above
Screenshots you attach (up to 3)	Same as above	Same as above	Same as above

Your prompt text is included only if you are in Developer Mode and explicitly tick “Include my prompt text”. Your clip, footage and file paths are never sent. Reports go to a private inbox that only we can read; they are never posted publicly.

Satisfaction rating (only when you send one)

Once you have been using the Plugin for a while, a small card in the Generate tab asks how satisfied you are, from 1 to 5, with an optional comment box. It asks once. Nothing is sent unless you press Send — dismissing the card sends nothing at all.

Data	Purpose	Legal basis (GDPR Art. 6)	Stored where
Your score (1–5), and your comment if you write one	Understanding whether the Plugin is working for people, and what to fix next	Art. 6(1)(f) — legitimate interest in improving a product, on an answer you chose to send	Cloudflare Worker KV, 1 year
Plugin, Premiere Pro and operating system versions, and how many generations you had run	Telling an answer about an old version apart from one about the current one	Same as above	Same as above
A random rating ID	Recognising that two answers came from the same installation, so one person answering twice is not counted as two people	Same as above	Same as above

The rating ID is generated at random on your own machine. It is deliberately not the analytics installation ID and not the licence installation ID, so a rating cannot be joined to your licence, your email or your usage. No name, no email, no licence key, no model, no prompt and no media travels with a rating — the endpoint refuses those fields outright rather than storing them.

Your comment is sent on to us as a phone notification when it arrives, through Pushover (Section 3). It carries what you wrote and nothing that identifies you. Because there is no way for us to reply to a rating, please keep personal details out of the comment box — use a bug report instead if you want an answer.

That is the full extent of personal data that modelBridge processes.

modelBridge performs periodic license validation by sending your license key and a device identifier to a Cloudflare Worker that we operate, which validates them against LemonSqueezy and returns the result. The plugin does not contact LemonSqueezy directly. No personal data other than the license key and device identifier is transmitted during validation. LemonSqueezy acts as Merchant of Record for all payments — see LemonSqueezy’s privacy policy for payment data handling.

Data stored locally on your machine (not accessible to modelBridge)

The Plugin stores the following data on your local disk — in your system credential store, in a settings file inside the modelBridge data folder, and in localStorage. None of it is transmitted to modelBridge:

fal.ai API key — Entered by you, stored locally in your system credential store and in an unencrypted settings file in the modelBridge data folder (outside the plugin folder, so it survives updates). Sent directly to fal.ai when you initiate a generation. Important: that settings file is not encrypted. Anyone with physical or remote access to your computer can read this key. You are responsible for your device security. We recommend not sharing your computer login with untrusted individuals. If you believe your API key has been compromised, regenerate it immediately in your fal.ai account.
Model configurations and parameters — Your saved presets and last-used settings per model
Generation history — Log of your generation requests and results
Cost tracking data — Estimated and recorded API costs for your reference
User preferences — Interface settings and plugin configuration

You have full control over this data. You can view, export, or delete it at any time by managing the Plugin’s local storage or uninstalling the Plugin.

Data modelBridge does NOT process

For avoidance of doubt, with respect to any personal data that you choose to include in prompts, media, or other inputs processed by fal.ai, modelBridge does not determine the purposes and means of such processing and does not process such data on your behalf. You — together with fal.ai — remain the controller(s) for that processing within the meaning of Article 4(7) GDPR. modelBridge does not act as a processor (Article 4(8) GDPR) or joint controller (Article 26 GDPR) for such data.

3. What Data Is Sent to Third Parties

fal.ai

When you initiate a generation, the Plugin sends your fal.ai API key and generation parameters (prompts, model selection, settings, and any input media you provide) directly from your computer to fal.ai’s servers. modelBridge has no server or intermediary in this data flow.

You, not modelBridge, directly instruct fal.ai to process your data by initiating generation requests. modelBridge provides the interface; the contractual relationship for API usage is between you and fal.ai. fal.ai is an independent data controller with respect to your API usage data.

fal.ai’s Privacy Policy: https://fal.ai/legal/privacy-policy

LemonSqueezy

LemonSqueezy is operated by Sold through Link, LLC (a Stripe company).

When the Plugin validates your license, it sends your license key and a device identifier to LemonSqueezy’s API. The device identifier is used solely to enforce the 2-device activation limit per license. LemonSqueezy processes license and billing data as an independent controller within the meaning of Article 4(7) GDPR, not as a processor on behalf of modelBridge. LemonSqueezy also holds the email address and payment details you provided at purchase.

LemonSqueezy’s Privacy Policy: https://www.lemonsqueezy.com/privacy

Cloudflare

The anonymous error reporting endpoint (see Section 2) runs on a Cloudflare Worker. Cloudflare processes the request on our behalf, including briefly holding the sender’s IP address for rate limiting (60-second TTL). No personal data is stored beyond this. Cloudflare acts as a data processor under GDPR.

Cloudflare’s Privacy Policy: https://www.cloudflare.com/privacypolicy/

Anthropic (Agent Mode only)

If you use Agent Mode, the Plugin sends your messages, project metadata (clip, bin, sequence and project names, timecodes, file paths, marker comments, effect values) and — when a timeline clip is selected — a small number of sampled still frames of that clip, directly from your computer to Anthropic, authenticated with your own Anthropic API key. modelBridge has no server in this path and never sees the conversation. Frame sending is on by default and can be turned off permanently in Settings → Privacy → “Timeline frames to the agent”. Anthropic is an independent controller for this processing under its own API terms.

Anthropic’s Privacy Policy: https://www.anthropic.com/legal/privacy

Pushover (notifications to us)

Operational alerts to our own phone — a licence event, a failed payment, a new bug report, a new satisfaction rating — are delivered through Pushover, operated by Superblock LLC. Pushover acts as a data processor.

What it receives is deliberately narrow: identifiers such as a licence key ID or a subscription ID, never an email address and never a name. The one piece of text you write that travels this way is a satisfaction rating’s comment, which carries no identifier of any kind. Bug report text, prompts, media, generated content and file paths are never sent to Pushover.

Pushover’s Privacy Policy: https://pushover.net/privacy

No other third parties

modelBridge does not share your data with any other third parties. There are no analytics providers, advertising networks, tracking pixels, or other data recipients.

4. What modelBridge Does NOT Collect

To be explicit:

No behavioral analytics or tracking unless you switch it on — Analytics is off by default. The Plugin ships three optional analytics settings (Usage analytics, Product analytics, Share anonymous aggregates) in Settings → Privacy. Leave them off and we learn nothing about which features you use, which models you select, or how many generations you make. Switch one on and it sends anonymous event counts keyed to an installation ID, never content
No usage logging — We do not log what you generate, what prompts you write, or what files you use
No cookies — The Plugin runs inside Adobe Premiere Pro, not in a browser
No IP address storage — Our error reporting endpoint briefly reads your IP address for rate limiting only (held for 60 seconds, then deleted). We do not log, store, or associate IP addresses with any other data
No user accounts — There is nothing to sign up for and no password. License validation sends only a license key and device identifier to our Cloudflare Worker
No access to your Premiere Pro projects — The Plugin does not read, transmit, or process your timeline, project files, or media library except for the specific input you explicitly select for a generation
No hardware identifiers — We never collect serial numbers, MAC addresses or hardware IDs. If you opt into analytics, the Plugin derives one anonymous 16-character installation ID by hashing four basic display and locale settings of your machine. It is not reversible, is not linked to your license or fal.ai account, and is never sent unless analytics is on. Because it is derived rather than random, clearing the Plugin’s data recreates the same ID — switching analytics off is what stops it being sent
No content moderation — We have no technical ability to see, review, store, or monitor your prompts, inputs, or generated outputs

Under GDPR Article 6, the legal bases for our processing are:

License key validation — Article 6(1)(b): necessary for the performance of the subscription contract. Without license validation, we cannot provide the service.
Subscription communications (via LemonSqueezy) — Article 6(1)(b): necessary for contract performance (billing, renewal notifications).
Anonymous error reporting — Article 6(1)(f): legitimate interest in maintaining software quality and fixing bugs. We have assessed that the minimal, anonymous data collected (error type, model ID, plugin version) does not override your rights and freedoms. You can opt out at any time in Settings with no impact on functionality.
IP-based rate limiting — Article 6(1)(f): legitimate interest in preventing abuse of the error reporting endpoint. The IP address is held for 60 seconds only and never stored or logged.

6. Data Retention

License key and subscription record (including the email from LemonSqueezy’s webhook): Held in our Cloudflare Worker’s KV store for the duration of your active subscription, up to 3 years, then 90 days after it ends, after which it is cleaned up automatically. You can delete it sooner — see Section 7. LemonSqueezy separately manages license records per their own policies, and upon cancellation may retain transaction records for legal and accounting purposes.

Bug reports and feature requests you send us: Retained 180 days in the same KV store, then deleted.

Satisfaction ratings you send us: Retained 1 year in the same KV store, then deleted automatically.

Error telemetry: Error reports are deduplicated by type. The first occurrence of each unique error type is stored with its technical context (error message excerpt, model ID, plugin version). Subsequent occurrences of the same error type only update a counter and timestamp — they are not stored individually. There is no TTL on error records; they persist until manually reviewed and cleared by the developer. IP addresses used for rate limiting are automatically deleted after 60 seconds.

Locally stored data: Persists on your computer until you clear it or uninstall the Plugin. modelBridge has no technical ability to access, modify, or delete your local data remotely.

Email and purchase records: Held by LemonSqueezy per their retention policy. modelBridge does not independently hold copies.

7. Your Rights

Under GDPR Chapter III (Articles 12–23), you have the following rights:

Right of access (Art. 15): Your personal data on our side is limited to your license key status, managed through LemonSqueezy. Your local data is on your own machine. You can also request a machine-readable export of all server-side data associated with your license key by sending a GET request to https://modelbridge-telemetry.niklaz-a-hallberg.workers.dev/api/user-data?license_key=YOUR_KEY. A satisfaction rating you have sent is not part of that export, because it is not connected to your licence — see the note under erasure below.

Right to erasure (Art. 17): Uninstall the Plugin and delete the extension folder. For LemonSqueezy records, contact LemonSqueezy directly. To delete all server-side data associated with your license, send a DELETE request to https://modelbridge-telemetry.niklaz-a-hallberg.workers.dev/api/user-data with your license key in the request body. This removes subscription metadata, trial records, and license mappings. A minimal fraud-prevention record (timestamp only, no PII) is retained under legitimate interest (Art. 6(1)(f)). You may also contact info@modelbridge.app to request erasure without using the API.

A satisfaction rating is the one thing that request cannot reach, and for the reason the rating exists at all: it is not linked to your licence, your email or your installation, so there is nothing to look it up by. Every rating deletes itself one year after it is sent. If you want yours removed sooner, send the exact wording of your comment to info@modelbridge.app and we will delete any answer that matches it.

Right to data portability (Art. 20): Local data is stored as JSON files and can be copied or exported at any time.

Right to rectification (Art. 16): Contact LemonSqueezy to correct purchase/account details.

Right to restriction of processing (Art. 18): Contact us at info@modelbridge.app.

Right to object (Art. 21): We do not conduct tracking, profiling, or marketing based on your data.

Right regarding automated decision-making (Art. 22): modelBridge does not make automated decisions that significantly affect you.

To exercise any of these rights, contact info@modelbridge.app. We will respond within 30 days. You also have the right to lodge a complaint with the Swedish Data Protection Authority (IMY) at www.imy.se or with your local supervisory authority.

For users in California (CCPA/CPRA)

Under the California Consumer Privacy Act (as amended by CPRA), California residents have specific rights regarding personal information:

Right to know: We collect only your license key (for validation). We do not collect additional personal information.
Right to delete: See GDPR erasure rights above — the same process applies.
Right to opt-out of sale: We do not sell, share, or disclose personal information to third parties for monetary or other valuable consideration. There is nothing to opt out of.
Right to non-discrimination: We do not discriminate against users who exercise their privacy rights.
Categories of personal information collected (per CA Civil Code § 1798.130): Identifiers (license key). No other categories are collected.

For users in Brazil (LGPD)

Under Brazil’s Lei Geral de Proteção de Dados, you have rights similar to those described under GDPR above, including access, correction, deletion, and data portability. Contact info@modelbridge.app to exercise these rights.

For users in the United Kingdom

Under the UK GDPR and Data Protection Act 2018, you have the same rights as described in the EU/EEA section above. The UK Information Commissioner’s Office (ICO) is the relevant supervisory authority: ico.org.uk.

For users in other jurisdictions

modelBridge applies GDPR-level privacy protections as a baseline for all users globally, regardless of location. If your jurisdiction (including Canada under PIPEDA, Australia under the Privacy Act 1988, Japan, South Korea, or other countries) provides additional rights not covered above, you may contact us and we will make reasonable efforts to accommodate your request.

8. International Data Transfers

When you use the Plugin, data transfers occur between your device and the following services:

fal.ai (US-based): Your API key and generation parameters are sent directly from your device to fal.ai in the United States. This transfer is initiated by you and governed by fal.ai’s privacy policy and data transfer mechanisms.
LemonSqueezy: May process payment and license data in the United States or other countries per their privacy policy.
Cloudflare (global edge network): Anonymous error reports are sent to a Cloudflare Worker. Cloudflare may process the request at any of its global edge locations. No personal data beyond the 60-second rate-limit IP is involved.

modelBridge does not facilitate, intermediate, or control the fal.ai or LemonSqueezy transfers.

9. Children’s Privacy

modelBridge is not intended for individuals under the age of:

16 in the EU/EEA (per GDPR Article 8)
13 in the United States (per COPPA)
The minimum age required by applicable law in your jurisdiction

We do not knowingly collect personal data from minors. If you believe a minor has obtained a modelBridge subscription, contact us at info@modelbridge.app and we will take appropriate steps including contacting LemonSqueezy.

10. Security

modelBridge’s data-minimal architecture is itself a security measure — we cannot expose data we don’t hold.

License key transmission to LemonSqueezy occurs over encrypted HTTPS
Your locally stored API key is in unencrypted localStorage and JSON files — its security depends on your device security
You are responsible for keeping your fal.ai API key secure
We recommend not sharing your computer login with untrusted individuals

11. Data Breach Notification

If we become aware of a personal data breach affecting personal data for which modelBridge is the controller (for example, license key information obtained through a breach of our systems or processes), we will assess the risk and, where required by GDPR Articles 33 and 34, notify the relevant supervisory authority without undue delay (and within 72 hours where feasible) and notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

Where a breach concerns data processed solely by LemonSqueezy or fal.ai as independent controllers, notification obligations remain with those providers. modelBridge has no access to their systems and cannot assess or report on breaches within their environments.

12. Changes to This Policy

We may update this Privacy Policy from time to time. For changes that are editorial or non-material, we will update the “Last updated” date at the top.

For changes that materially expand how we process personal data, we will seek your explicit consent before the changes take effect, communicated via the modelBridge website and where feasible through the Plugin or email via LemonSqueezy.

13. Contact

Data controller: Niklaz Hallberg — info@modelbridge.app Stockholm, Sweden

For questions about this policy, your personal data, or to exercise your privacy rights under any applicable law, please email the above address. We aim to respond within 30 days.

Swedish Data Protection Authority (IMY): www.imy.se | Box 8114, 104 20 Stockholm, Sweden

UK Information Commissioner’s Office (ICO): ico.org.uk

EU Online Dispute Resolution: https://ec.europa.eu/consumers/odr

modelBridge is developed by Niklaz Hallberg, Stockholm, Sweden.