makion.dev · Version 1.0-launch-minimum · Effective 2026-08-16
These are the authoritative English-language terms. The Paddle Buyer Terms govern the sale itself (Paddle is the Merchant of Record); this document is provided for transparency. This notice covers checkout purchases; the separate website privacy policy covers the contact form.
The public-facing Privacy Notice for checkout buyers. The internal inventory behind it is.
Scope note: this notice covers the data Licensor holds around a checkout purchase — the consent-evidence log and the refused-order log. It does not cover data processed inside the Software on the Licensee's own infrastructure, which never reaches Licensor (EULA §14), nor content sent to an AI Provider (EULA §14.3), nor Paddle's own processing under Paddle's own privacy terms.
1. Who is responsible for your data (controller), and how to reach us
Controller: Eduard Kibkalo, an individual registered in Ukraine as a private entrepreneur, publisher of Makion.
Business address: St. Kyrylivska 3A, Lviv, Ukraine.
Independent controllers. For buyer data shared through the Merchant of Record flow, the Paddle MSA and Data Sharing Addendum make Paddle and Makion independent controllers — each is separately responsible for its own processing. Paddle is the seller / Merchant of Record; Makion is the independent controller for the customer data it holds. Paddle's processing is described in Paddle's own privacy terms.
EU / UK representative (GDPR / UK GDPR Article 27): none appointed. For data-protection matters, contact the controller directly at the address and email above. (Operator decision, 2026-08-15: no Art. 27 representative is appointed at launch.)
2. Data we collect directly from you
From the checkout and licence flow, as specified in :
your acceptance of the EULA on a Makion-rendered surface — which document version and control wording you accepted, with a timestamp;
records that required disclosures were displayed to you (the purchase disclosures, the renewal disclosure, the in-product licence screen) — the displayed text's version and hash and the render timestamp. These record what was shown; they are not records of anything you accepted or consented to;
licence events — delivery of your licence, and licence-key redemption timestamps (first download or activation);
on the business path: business name, VAT/tax number (VIES-validated where an EU VAT ID), country, and your explicit confirmation of professional use.
We do not collect your IP address on any record. Acceptance is proved by the document hash + timestamp + Paddle order_id.
3. Data we receive from Paddle
When you buy through the checkout, the seller is Paddle (the Merchant of Record). Under the Paddle Data Sharing Addendum, the Shared Personal Data available to us as Supplier includes:
your name and address;
your email address;
your purchasing history;
order/transaction identifiers (including transaction, customer, subscription and invoice identifiers and the invoice document), SKU and price, and billing country;
the transactional analytics available to the Supplier in the Paddle Dashboard.
This notice serves as the information owed to you about that Paddle-sourced data (GDPR Article 14 — a duty the Data Sharing Addendum places on the Data Receiver). See also §10.
Apart from Paddle acting as Merchant of Record, Makion does not share buyer personal data with any other processor for this checkout flow.
4. Why we process this data, and on what legal bases
The purposes: delivering and operating your licence (delivery, redemption, updates); proving what was agreed and disclosed at your purchase; handling refunds, chargebacks and disputes; preventing fraud and purchase-and-refund abuse; keeping the tax records required of a Ukrainian private entrepreneur; and operating the geofence (EU/EEA + Switzerland + UK).
The legal bases:
Art. 6(1)(b) — contract: the delivery and licence data needed to provide the Software and operate the licence you bought.
Art. 6(1)(f) — legitimate interest (with a documented Legitimate Interests Assessment and a defined retention period): the contract, fraud and dispute evidence; and the records kept to satisfy the Ukrainian tax record-keeping duty (ПКУ Art. 44). Ukrainian tax law is third-country law, so it is not a valid Art. 6(1)(c) basis (Recital 45 — only Union or Member-State law grounds Art. 6(1)(c)); the correct basis for that retention is Art. 6(1)(f).
Art. 6(1)(c) — legal obligation: only where a genuine EU or Member-State obligation applies to us.
5. Legitimate interests we rely on
Where the basis is legitimate interest (Art. 6(1)(f)), the interests are: proving the contract and the disclosures made; defending refund, chargeback and consumer claims; preventing fraud and purchase-and-refund abuse; keeping the records required by Ukrainian tax law; and demonstrating that the geofence is enforced. Each is supported by a documented balancing test (LIA) and a defined retention period (§8).
6. Who receives your data (processors and recipients)
Paddle — as independent controller, not as our processor (§1). Apart from Paddle acting as Merchant of Record, Makion does not share buyer personal data with any other processor for this checkout flow.
No sale of personal data; no advertising use; no sharing with AI providers. Your AI Provider relationship is your own (EULA §12): Makion never sees the customer's SAP code, but the customer's own AI provider does — we do not claim "nothing leaves".
7. International transfers and safeguards
Personal data submitted directly by you to Makion is processed by a Ukrainian controller subject to the applicable extraterritorial requirements of EU or UK data-protection law. Personal data disclosed by Paddle to Makion is a controller-to-controller transfer governed by the Paddle Data Sharing Addendum, including the applicable EU Standard Contractual Clauses (Module 1) and the UK Approved Addendum. The parties and applicability of those safeguards must be verified before launch.
Separately, where Makion transfers personal data out of Ukraine to its own service providers (for example non-Ukrainian hosting or email providers), that outbound transfer is governed by the Ukrainian Law No. 2297-VI cross-border-transfer regime (Art. 29) as well as by the relevant EU/UK safeguards — see §9a. The Paddle→Makion disclosure above is inbound to Makion and is not governed by Art. 29.
8. How long we keep data (retention by category)
Retention periods are purpose-derived, not indefinite:
Records that evidence your purchase and consent — the immutable licence-document text and its hash, the licence ID, the EULA version and hash, the acceptance and Delivery timestamps, and the licence status: kept for as long as your licence exists and, after it ends, for the limitation period for any related contract or consumer claim (up to 6 years for United Kingdom buyers).
Business- and tax-status fields you provide (business name, tax identifier, professional-use confirmation): kept for a shorter, separate purpose-based period, not for the full life of the licence.
Tax and accounting records, including the invoice snapshot for your purchase: kept for the period we are required to retain them under Ukrainian tax law (at least three years under Article 44 of the Ukrainian Tax Code).
Refused (geofence-blocked) order records: kept in minimal form only (country, timestamp, product and the reason for refusal) for about 12 months, then deleted or anonymised.
9. Your rights, and how to complain
You have the rights mandatory data-protection law gives you — including access, rectification, erasure, restriction, portability and objection, where they apply — exercisable at [email protected]. You also have the right to lodge a complaint with a supervisory authority:
EU/EEA: the supervisory authority of your habitual residence (or place of work or place of the alleged infringement).
United Kingdom: the Information Commissioner's Office (ICO).
Switzerland: the Federal Data Protection and Information Commissioner (FDPIC).
Ukraine: the competent Ukrainian data-protection authority.
9a. Ukrainian data-protection law (Law No. 2297-VI)
Makion's controller is a Ukraine-registered private entrepreneur, so the Ukrainian Law No. 2297-VI "On Personal Data Protection" applies in parallel with the GDPR / UK GDPR, not instead of it. Under that law:
Legal basis. Processing is carried out on the bases permitted by the Law, including the controller's legitimate interest where the data subject's rights are not overridden (Art. 11) — aligned with the GDPR bases in §4.
Information you are given (Art. 12). Where we collect your data directly from you, you are informed — through this notice — of the controller, the composition and purpose of the data collected, your rights, and the third parties to whom the data is transferred. Where we obtain your data other than from you (for example from Paddle), you are informed within 30 working days.
Protection of the data (Art. 24). Makion, as a private entrepreneur, is personally responsible for securing the personal data it holds and applies organisational and technical measures to protect it.
Cross-border transfer (Art. 29). Where Makion transfers personal data out of Ukraine to a foreign recipient (see §7), it does so under the conditions the Law permits.
Your rights and complaints. Your rights under the Law (access, rectification, objection, deletion, and others) may be exercised via the contact in §1; you may also complain to the competent Ukrainian supervisory authority (§9).
10. The Paddle data source, stated plainly
The seller for your purchase is Paddle, under the Paddle Buyer Terms. Paddle is the source of the Transaction data described in §3, and Paddle processes your data as an independent controller under its own privacy terms. Statutory withdrawal and refund rights are determined and processed under the Paddle Buyer Terms, the Paddle Refund Policy in effect at the time of the Transaction, and applicable mandatory law (Refund Policy §1).