Privacy Policy

1. Data controller

The controller is MetaWrap di Elvis Morelli, VAT number IT01304200452, Via Leandro Biselli 16, 54033 Gragnana, Carrara (MS), Toscana, Italia. Privacy and account requests: hello@metawrap.ai.

2. Data we process

• Waitlist: email address, optional workflow answer, consent and signup timestamps.
• Account and login: email, Supabase user identifier, authentication provider and session/security metadata.
• Private beta: an owner-approved e-mail address, invitation delivery time, access expiry, account binding and redemption/revocation state.
• Commerce: Stripe checkout, customer and transaction identifiers, product, price, currency, totals, tax, discount, payment and refund/dispute status. MetaWrap does not receive full card details.
• Licensing and delivery: entitlements, device name, public device key and fingerprint, activation and lease records, download/update records and security events.
• Security: rate-limit counters and a keyed, pseudonymous digest of network addresses. Raw IP addresses are not written to the MetaWrap application database.
• Support: information you choose to send by email or Discord. Do not send passwords, payment credentials, customer assets or license secrets.

3. Local files and 3D content

The downloadable MetaWrap add-on processes meshes, textures, projects and local paths on your computer. The licensed local workflow does not upload those files to MetaWrap.ai. The separate Web Instant Conform service is not part of the current launch and is not exposed in the customer account.

4. Purposes and legal bases

• Contract: create your account, take and verify an order, deliver downloads, activate devices, issue licenses and provide support.
• Legal obligations: preserve accounting, tax, refund and dispute evidence where required.
• Legitimate interests: secure the service, prevent fraud and abuse, diagnose failures and protect software entitlements. We minimise and pseudonymise this data.
• Consent: optional launch or marketing email. You may withdraw consent at any time without affecting earlier lawful processing.

There is no sale of personal data, behavioural advertising or automated decision with legal or similarly significant effects.

5. Providers and international transfers

• Supabase: authentication, database and private file delivery (configured project region: eu-west-1 (Ireland)).
• Vercel: website and serverless API hosting.
• Stripe / Sold through Link: Merchant of Record checkout, tax, fraud, payment, refund and dispute processing.
• Google: optional OAuth sign-in.
• Resend: transactional and consent-based email.
• Discord: optional community and support messages.
• Cloudflare and OpenAI: the clearly identified Discord support assistant. It receives a question only when invoked; the assistant is configured not to retain model responses and MetaWrap stores only pseudonymous counters and feedback state.

Providers may process data outside the EEA. We use applicable data-processing terms and lawful transfer mechanisms, such as adequacy decisions and Standard Contractual Clauses, as appropriate.

6. Retention

• Waitlist data: until unsubscribe, and no later than 12 months after public launch unless you separately opt in again.
• Account, purchase and entitlement records: for the life of the account and afterwards only as needed for the contract, fraud prevention and mandatory legal retention.
• Short-lived activation, nonce and rate-limit records: automatically removed after their security purpose expires.
• Unredeemed private-beta contact records: normally removed 90 days after expiry or revocation.
• License/security events: normally 12 months; Stripe event evidence: normally 24 months, unless a dispute or legal duty requires longer.
• Support correspondence: normally 24 months after closure, unless a longer period is needed to establish or defend a claim.

Financial and tax records may be retained for the period required by applicable law. A deletion request does not override a legal retention duty.

7. Cookies and local storage

MetaWrap uses authentication storage and strictly necessary security state. It currently uses no advertising cookies and no behavioural analytics. Details are listed in the Cookies & Storage Notice.

8. Your rights

Subject to the GDPR, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent. Signed-in users can export account data or open a deletion request in My MetaWrap; you can also email hello@metawrap.ai. We may need to verify your identity and normally respond within one month.

You may complain to the Italian Data Protection Authority or your local EEA authority.

9. Security and changes

We use access controls, encryption in transit, private storage, signed licensing, least-privilege server credentials, rate limits and event monitoring. No internet service is risk-free. Material changes to this notice will be dated here and, when appropriate, communicated in the account or by email.