Privacy Policy

VARDEX PRIVACY POLICY
Vardex | melbius.com
Last updated: 2026-08-31

This Privacy Policy covers melbius.com, the Vardex purchase/checkout
process, and -- in Section 2 below -- a plain-language description of
what categories of information the installed Vardex software itself
processes on your device. Section 6 ("Your Data") of the End-User
License Agreement remains the operative statement that Vardex stores
captured network data locally on your own machine and we do not
collect, receive, or have access to it; this policy exists alongside
that section for transparency, not to replace it.

This policy is provided by The Trustee for THE THREE WANDERERS TRUST
(ABN [add ABN here]) ("we", "us", "our"), trading as Melbius Security.

1. WHAT THIS SITE COLLECTS
   melbius.com is a static website. It does not use cookies, does not
   run visitor analytics or tracking scripts, and does not have a
   contact form or account system. Visiting the site does not create
   any record beyond what our hosting provider (Netlify) logs as a
   normal part of serving any website -- standard web server access
   logs (IP address, browser user agent, requested page, timestamp),
   which we do not separately collect, analyse, or retain ourselves.

2. WHAT THE SOFTWARE PROCESSES ON YOUR DEVICE
   This section is about the installed Vardex application, not this
   website. To do its job, Vardex processes network information locally
   on the machine it runs on: IP addresses and MAC addresses of devices
   on the network you point it at, vendor names derived from those MAC
   addresses, hostnames where available, and metadata about the network
   events it detects (timestamps, ports, categories, and similar
   technical details).

   Because Vardex watches a shared network rather than just your own
   device, this can include information about devices belonging to
   other people who use that network -- for example, other members of
   your household, or colleagues on a network you administer at work --
   not only your own device. Section 2 of the End-User License Agreement
   explains that monitoring a network you don't solely control is your
   responsibility, including with respect to any privacy obligations you
   may owe to those other people.

   All of this processing happens locally, on the machine running
   Vardex. As stated in Section 6 ("Your Data") of the End-User License
   Agreement, we do not collect,
   receive, or have access to it -- it never reaches us. If you enable
   an optional third-party integration (Section 6 below), the specific
   data you choose to send that provider is governed by that provider's
   own terms, not this policy.

3. PURCHASING A LICENSE
   Vardex licenses are sold through Lemon Squeezy, a third-party
   merchant of record. Lemon Squeezy is the seller of record for your
   purchase. When you buy a license, your payment details (card
   number, billing address, etc.) are collected and processed
   directly by Lemon Squeezy under Lemon Squeezy's own privacy policy
   -- we do not receive, see, or store your payment information.
   Lemon Squeezy provides us with your email address and the license
   key issued to you, so we can identify your purchase if you contact
   us for support.

4. SOFTWARE UPDATE CHECKS
   The installed Vardex application periodically checks melbius.com
   for the latest available version, so it can let you know when an
   update is available. This check is a standard web request to a
   small version file and, like any web request, inherently includes
   your IP address and basic request metadata as part of how the
   internet works. We do not log, collect, or retain this data
   ourselves beyond whatever our hosting provider keeps as normal
   server access logs.

5. LICENSE KEY VALIDATION
   The Vardex software periodically validates your license key with
   Lemon Squeezy to confirm it is still active, as described in the
   End-User License Agreement. This sends only the license key itself
   -- not any of your network monitoring data.

6. THIRD-PARTY SERVICES YOU CONFIGURE YOURSELF
   If you choose to enable optional integrations inside the Vardex
   software (AbuseIPDB, GreyNoise, MaxMind GeoLite2, Slack, Discord,
   email, or Anthropic's Claude API), your use of those services is
   governed by their own privacy policies, not this one. See Section 5
   of the End-User License Agreement for details -- those connections
   run directly from your machine to the provider, not through us.

7. THE INFORMATION WE ACTUALLY HOLD, AND WHY
   Putting the sections above together, the only personal information
   we hold about you is:

     - your email address, and
     - the Vardex license key issued to you,

   both supplied to us by Lemon Squeezy when you purchase, plus any
   correspondence you send us. We hold it for one purpose: to identify
   your purchase and support you as a customer -- for example, to
   answer a support question, to re-issue or deactivate a license key,
   or to tell you about a security issue affecting the version you
   bought. We do not sell, rent, or trade personal information, we do
   not use it for advertising, and we do not use it to build a profile
   of you.

   For people in the EEA or the UK: our lawful bases under the GDPR /
   UK GDPR are performance of a contract with you (issuing and
   supporting your license) and our legitimate interests in supporting
   our customers and securing our product. Where we ever rely on
   consent, you can withdraw it at any time.

8. OVERSEAS RECIPIENTS
   We are based in Australia. The service providers we use to sell and
   host Vardex are based overseas, which means your information is
   handled outside Australia:

     - Lemon Squeezy (merchant of record, payments, license issuing)
       -- United States
     - Netlify (website hosting) -- United States

   Both are established providers with their own published privacy
   commitments. We do not otherwise disclose personal information to
   overseas recipients.

9. HOW LONG WE KEEP IT
   We keep your email address and license key for as long as your
   license is active, and afterwards only for as long as we need it to
   meet our record-keeping and tax obligations (in Australia, business
   records are generally kept for five years). Support correspondence
   is kept for up to two years. After that it is deleted or
   de-identified.

10. HOW WE PROTECT IT
   We take reasonable steps to protect personal information from
   misuse, interference, loss, and unauthorised access, modification,
   or disclosure. In practice this is straightforward, because we hold
   very little: no payment data, no network monitoring data, and no
   account passwords. The accounts we use to access Lemon Squeezy and
   our email are protected by strong, unique credentials and
   multi-factor authentication.

11. ACCESS, CORRECTION, AND YOUR OTHER RIGHTS
    You can ask us to give you a copy of the personal information we
    hold about you, and to correct it if it is wrong or out of date.
    Contact us via melbius.com. We will respond within a reasonable
    period (we aim for 30 days). There is no charge for making a
    request. If we cannot give you access or make a correction, we
    will explain why in writing.

    If you are in the EEA or the UK, you also have the right to ask us
    to erase your information, to restrict or object to how we use it,
    and to receive it in a portable format. Note that we may need to
    keep some information to meet the legal obligations described in
    Section 9.

12. COMPLAINTS
    If you think we have mishandled your personal information, please
    tell us first via melbius.com. We will acknowledge your complaint,
    investigate it, and write back to you with the outcome, normally
    within 30 days.

    If you are not satisfied with our response, you can complain to
    the Office of the Australian Information Commissioner (OAIC) at
    oaic.gov.au, or by phone on 1300 363 992. If you are in the EEA or
    the UK, you can complain to your local data protection authority
    (in the UK, the Information Commissioner's Office at ico.org.uk).

13. CHANGES TO THIS POLICY
    We may update this policy as the site or product changes. The "Last
    updated" date above reflects the most recent revision. This policy
    is available free of charge at melbius.com/privacy.

14. CONTACT
    Questions about this policy, or requests relating to your personal
    information, can be sent via melbius.com.

---
This document is a plain-language privacy policy template prepared for
use by The Trustee for THE THREE WANDERERS TRUST and has not been
reviewed by a lawyer. It is provided as a starting point, not legal
advice, and should be reviewed by a qualified lawyer (ideally one
familiar with the Australian Privacy Act 1988 and the Australian
Privacy Principles) before being relied upon commercially, particularly
before Vardex reaches significant sale volumes.