Privacy and data handling

Local-first behavior, disclosed connections.

MCVM does not send the collection database or usage analytics to the seller merely because the application is installed or used.

What stays local

Collection records, private Research History, media, settings, AI logs, diagnostics, and backups remain in customer-selected or controlled locations unless a user deliberately invokes a connected feature. A Verified Support Package is created locally, shown to the user for review, and never sent automatically.

Purchasing and licensing

Paddle is the intended merchant of record. After production qualification, Paddle will process purchaser identity, institutional and billing details, payment, tax, fraud-prevention, invoice, portal, cancellation, and refund records. MCVM will retain the minimum independent customer, assent, entitlement, transaction-reference, and delivery records needed to honor the perpetual institutional license. No live Paddle checkout or production data flow exists yet.

Connected actions

AI: BYOK sends user-authorized request content directly to the customer-configured provider. Managed AI is a planned part of active MCVM Care+, used under the applicable policy and annual fair use. Managed AI availability is confirmed when commercial purchasing opens.
Public sharing: Netlify receives only the reviewed generated public-site package when a user chooses to publish. Private Research History is excluded.
Updates: Update hosts receive the requested channel or release path, MCVM version, IP address, time, and ordinary network metadata.
Correspondence: Cloudflare and Gmail process messages sent to MCVM role addresses. No separate website lead-storage system is active.

Use only the reviewed Verified Support Package for ordinary support. Its closed structured contract excludes collection records and media, backups, settings, credentials, raw logs and error messages, identifying paths, museum names, and Windows user names. Do not email databases, backups, collection media, screenshots containing customer data, credentials, raw logs, Change Protection PINs, or payment information.

How long records are kept

License evidence: for the life of the license and seven years after it ends.
Transaction, tax, and accounting records: seven years after the end of the calendar tax year of the transaction, subject to professional accounting advice.
Managed AI usage records (no prompt or response content): deleted 25 months after each request.
Retired-installation credentials: deleted within 90 days after retirement.
Support-transfer files: deleted by a 14-day storage expiry, or earlier when the case requires it.
Support and business email: may remain in MCVM’s mailbox according to operational needs and legal and business requirements; no automatic deletion period applies. Mail that is part of a license, transaction, legal, tax, or dispute record is kept for that record’s period.
Sensitive support files: never by email. They go through MCVM’s support-transfer service, which deletes them by a 14-day expiry.
Collection data and AI prompts and responses: not retained by MCVM, unless emailed contrary to these instructions.

A dispute, chargeback, legal requirement, or tax audit can hold related records until it is resolved. Deleted records can remain briefly in providers’ recovery systems, and copies held by Paddle, OpenAI, Cloudflare, or Google follow those providers’ terms.

The final versioned Privacy and Data Handling Disclosure will be supplied before purchase. Questions may be sent to privacy@mcvmcollectionmanager.com.