Privacy Policy

Last updated: March 25, 2026

TL;DR: modelBridge collects almost no data. Your API key, generation history, and preferences are stored only on your own computer — never on modelBridge servers (which don’t exist). The only personal data we process is your license key (validated via LemonSqueezy). Your email is held by LemonSqueezy, not by us. We don’t track you, we don’t run analytics, and we don’t see what you generate.

1. Who is Responsible for Your Data?

Data controller:

Niklaz Hallberg (sole trader) Stockholm, Sweden Email: niklaz@modelbridge.app

modelBridge is operated by Niklaz Hallberg as a sole trader. Under the EU General Data Protection Regulation (GDPR, Regulation EU 2016/679), Niklaz Hallberg is the data controller for the limited personal data described in this policy.

A Data Protection Officer (DPO) has not been appointed, as no appointment is required under GDPR Article 37 — modelBridge does not carry out large-scale systematic monitoring, does not process special categories of data, and is not a public authority.

2. What Personal Data modelBridge Processes

modelBridge’s architecture is designed to minimize data collection. Here is a complete picture.

Data processed by modelBridge (directly)

Data	Purpose	Legal basis (GDPR Art. 6)	Stored where
License key	Validating your active subscription via LemonSqueezy’s API	Art. 6(1)(b) — necessary to perform the subscription contract	Your local machine; transmitted to LemonSqueezy API on validation checks
Device identifier	Enforcing the 2-device activation limit per license	Art. 6(1)(b) — necessary to perform the subscription contract	Your local machine; transmitted to LemonSqueezy API alongside the license key during validation
Email address	Purchase confirmation, subscription management	Collected and held by LemonSqueezy; modelBridge does not independently collect or store your email	LemonSqueezy’s servers

That is the full extent of personal data that modelBridge processes.

modelBridge performs periodic license validation by sending your license key and a device identifier to LemonSqueezy’s API. No personal data other than the license key and device identifier is transmitted during validation. LemonSqueezy acts as Merchant of Record for all payments — see LemonSqueezy’s privacy policy for payment data handling.

Data stored locally on your machine (not accessible to modelBridge)

The Plugin stores the following data in localStorage and JSON files on your local disk. This data never leaves your computer to modelBridge — no such servers exist:

fal.ai API key — Entered by you, stored locally in unencrypted localStorage and local JSON files. Sent directly to fal.ai when you initiate a generation. Important: localStorage is not encrypted. Anyone with physical or remote access to your computer can read this key. You are responsible for your device security. We recommend not sharing your computer login with untrusted individuals. If you believe your API key has been compromised, regenerate it immediately in your fal.ai account.
Model configurations and parameters — Your saved presets and last-used settings per model
Generation history — Log of your generation requests and results
Cost tracking data — Estimated and recorded API costs for your reference
User preferences — Interface settings and plugin configuration

You have full control over this data. You can view, export, or delete it at any time by managing the Plugin’s local storage or uninstalling the Plugin.

Data modelBridge does NOT process

For avoidance of doubt, with respect to any personal data that you choose to include in prompts, media, or other inputs processed by fal.ai, modelBridge does not determine the purposes and means of such processing and does not process such data on your behalf. You — together with fal.ai — remain the controller(s) for that processing within the meaning of Article 4(7) GDPR. modelBridge does not act as a processor (Article 4(8) GDPR) or joint controller (Article 26 GDPR) for such data.

3. What Data Is Sent to Third Parties

fal.ai

When you initiate a generation, the Plugin sends your fal.ai API key and generation parameters (prompts, model selection, settings, and any input media you provide) directly from your computer to fal.ai’s servers. modelBridge has no server or intermediary in this data flow.

You, not modelBridge, directly instruct fal.ai to process your data by initiating generation requests. modelBridge provides the interface; the contractual relationship for API usage is between you and fal.ai. fal.ai is an independent data controller with respect to your API usage data.

fal.ai’s Privacy Policy: https://fal.ai/legal/privacy-policy

LemonSqueezy

When the Plugin validates your license, it sends your license key and a device identifier to LemonSqueezy’s API. The device identifier is used solely to enforce the 2-device activation limit per license. LemonSqueezy processes license and billing data as an independent controller within the meaning of Article 4(7) GDPR, not as a processor on behalf of modelBridge. LemonSqueezy also holds the email address and payment details you provided at purchase.

LemonSqueezy’s Privacy Policy: https://www.lemonsqueezy.com/privacy

No other third parties

modelBridge does not share your data with any other third parties. There are no analytics providers, advertising networks, crash reporting services, CDNs, or other data recipients.

4. What modelBridge Does NOT Collect

To be explicit:

No analytics or telemetry — We do not track how you use the Plugin
No usage logging — We do not log which models you use, how many generations you make, or what you generate
No cookies — The Plugin runs inside Adobe Premiere Pro, not in a browser
No IP address logging — modelBridge has no servers that receive requests
No user accounts — There are no modelBridge servers or accounts; license validation sends only a license key and device identifier to LemonSqueezy
No access to your Premiere Pro projects — The Plugin does not read, transmit, or process your timeline, project files, or media library except for the specific input you explicitly select for a generation
No device fingerprinting — We do not collect hardware identifiers, device information, or browser fingerprints
No content moderation — We have no technical ability to see, review, store, or monitor your prompts, inputs, or generated outputs

Under GDPR Article 6, the legal bases for our processing are:

License key validation — Article 6(1)(b): necessary for the performance of the subscription contract. Without license validation, we cannot provide the service.
Subscription communications (via LemonSqueezy) — Article 6(1)(b): necessary for contract performance (billing, renewal notifications).

We do not rely on consent as our legal basis, because the processing is necessary to deliver the service you subscribed to.

6. Data Retention

License key: Retained for the duration of your active subscription. LemonSqueezy manages license records per their own policies. Upon cancellation, LemonSqueezy may retain transaction records for legal and accounting purposes.

Locally stored data: Persists on your computer until you clear it or uninstall the Plugin. modelBridge has no technical ability to access, modify, or delete your local data remotely.

Email and purchase records: Held by LemonSqueezy per their retention policy. modelBridge does not independently hold copies.

7. Your Rights

Under GDPR Chapter III (Articles 12–23), you have the following rights:

Right of access (Art. 15): Your personal data on our side is limited to your license key status, managed through LemonSqueezy. Your local data is on your own machine.

Right to erasure (Art. 17): Uninstall the Plugin and delete the extension folder. For LemonSqueezy records, contact LemonSqueezy directly.

Right to data portability (Art. 20): Local data is stored as JSON files and can be copied or exported at any time.

Right to rectification (Art. 16): Contact LemonSqueezy to correct purchase/account details.

Right to restriction of processing (Art. 18): Contact us at niklaz@modelbridge.app.

Right to object (Art. 21): We do not conduct tracking, profiling, or marketing based on your data.

Right regarding automated decision-making (Art. 22): modelBridge does not make automated decisions that significantly affect you.

To exercise any of these rights, contact niklaz@modelbridge.app. We will respond within 30 days. You also have the right to lodge a complaint with the Swedish Data Protection Authority (IMY) at www.imy.se or with your local supervisory authority.

For users in California (CCPA/CPRA)

Under the California Consumer Privacy Act (as amended by CPRA), California residents have specific rights regarding personal information:

Right to know: We collect only your license key (for validation). We do not collect additional personal information.
Right to delete: See GDPR erasure rights above — the same process applies.
Right to opt-out of sale: We do not sell, share, or disclose personal information to third parties for monetary or other valuable consideration. There is nothing to opt out of.
Right to non-discrimination: We do not discriminate against users who exercise their privacy rights.
Categories of personal information collected (per CA Civil Code § 1798.130): Identifiers (license key). No other categories are collected.

For users in Brazil (LGPD)

Under Brazil’s Lei Geral de Proteção de Dados, you have rights similar to those described under GDPR above, including access, correction, deletion, and data portability. Contact niklaz@modelbridge.app to exercise these rights.

For users in the United Kingdom

Under the UK GDPR and Data Protection Act 2018, you have the same rights as described in the EU/EEA section above. The UK Information Commissioner’s Office (ICO) is the relevant supervisory authority: ico.org.uk.

For users in other jurisdictions

modelBridge applies GDPR-level privacy protections as a baseline for all users globally, regardless of location. If your jurisdiction (including Canada under PIPEDA, Australia under the Privacy Act 1988, Japan, South Korea, or other countries) provides additional rights not covered above, you may contact us and we will make reasonable efforts to accommodate your request.

8. International Data Transfers

modelBridge itself does not transfer your data internationally — we do not operate servers.

When you use the Plugin, data transfers occur directly between your device and third-party services:

fal.ai (US-based): Your API key and generation parameters are sent directly from your device to fal.ai in the United States. This transfer is initiated by you and governed by fal.ai’s privacy policy and data transfer mechanisms.
LemonSqueezy: May process payment and license data in the United States or other countries per their privacy policy.

modelBridge does not facilitate, intermediate, or control these transfers.

9. Children’s Privacy

modelBridge is not intended for individuals under the age of:

16 in the EU/EEA (per GDPR Article 8)
13 in the United States (per COPPA)
The minimum age required by applicable law in your jurisdiction

We do not knowingly collect personal data from minors. If you believe a minor has obtained a modelBridge subscription, contact us at niklaz@modelbridge.app and we will take appropriate steps including contacting LemonSqueezy.

10. Security

modelBridge’s data-minimal architecture is itself a security measure — we cannot expose data we don’t hold.

License key transmission to LemonSqueezy occurs over encrypted HTTPS
Your locally stored API key is in unencrypted localStorage and JSON files — its security depends on your device security
You are responsible for keeping your fal.ai API key secure
We recommend not sharing your computer login with untrusted individuals

11. Data Breach Notification

If we become aware of a personal data breach affecting personal data for which modelBridge is the controller (for example, license key information obtained through a breach of our systems or processes), we will assess the risk and, where required by GDPR Articles 33 and 34, notify the relevant supervisory authority without undue delay (and within 72 hours where feasible) and notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

Where a breach concerns data processed solely by LemonSqueezy or fal.ai as independent controllers, notification obligations remain with those providers. modelBridge has no access to their systems and cannot assess or report on breaches within their environments.

12. Changes to This Policy

We may update this Privacy Policy from time to time. For changes that are editorial or non-material, we will update the “Last updated” date at the top.

For changes that materially expand how we process personal data, we will seek your explicit consent before the changes take effect, communicated via the modelBridge website and where feasible through the Plugin or email via LemonSqueezy.

13. Contact

Data controller: Niklaz Hallberg — niklaz@modelbridge.app Stockholm, Sweden

For questions about this policy, your personal data, or to exercise your privacy rights under any applicable law, please email the above address. We aim to respond within 30 days.

Swedish Data Protection Authority (IMY): www.imy.se | Box 8114, 104 20 Stockholm, Sweden

UK Information Commissioner’s Office (ICO): ico.org.uk

EU Online Dispute Resolution: https://ec.europa.eu/consumers/odr

modelBridge is developed by Niklaz Hallberg, Stockholm, Sweden.