Data processing
Who processes what personal data when you use Candor UI, and where a data processing agreement fits. This is a statement of how Candor works, not legal advice. Last updated 8 November 2026.
The short version
Candor UI is source code you install into your own application. The components run in your app and send nothing to Methodic. We hold a small amount of data about you as a buyer and see a little more when you install paid items; we don't process your customers' or users' personal data, because it never reaches us.
What your application does
The components take the data you give them and draw it. They make no network requests of their own: no analytics, no error reporting, no calls home. The candor-ui command line tool reads the registry and writes files into your project; it sends no usage data. So the personal data in your app, and in what your agents read and write, stays between your app and the services you choose. Those are yours to cover in your own agreements, and Candor isn't one of them.
What we process, and in what role
- Your name, email and what you bought. Polar sells the licence and gives us this, to support you and keep the licence honest. We decide why we hold it, so Methodic is the controller of this data.
- Payment details, tax and refunds. Polar and the payment providers it uses handle these, as seller of record, under its own privacy policy.
- Your licence key, when you install a paid item (
candor-ui add), or runcandor-ui update,candor-ui verify,candor-ui list --installed,candor-ui keyorcandor-ui doctor. The registry server (api/registry.ts) forwards the key to Polar to check it. A valid answer is remembered for up to 10 minutes in the server's memory, as a one-way hash of the key. The key is not stored or logged. - IP address, item requested and time. Our host, Vercel, keeps these in its standard server logs for the site, the registry and the docs MCP server, to run and secure the service, as for any website.
- Message counts per IP address. The docs MCP server (
/mcp) counts messages from each address for a minute, per server instance, to stop a runaway client. The count lives in memory; nothing is written to disk.
The docs MCP server needs no key, keeps no sessions and stores nothing. The site has no analytics. It sets one cookie, methodic-theme, only when you pick light or dark, and the theme builder keeps your work in your own browser. See Privacy for the plain account of each.
Our processor
Polar (polar.sh) processes purchase and licence data for us and sells to you as the seller of record. Polar publishes the terms it works under with the sellers on its platform in its Data Processing Addendum, and lists its sub-processors. Vercel hosts the site and the registry.
A signed agreement
Because we don't process personal data on your behalf, there is nothing for a processing agreement between you and us to cover, and we don't sign one as a matter of course. If your company's procurement asks for a document anyway, email info@themethodic.com with what it needs and we'll tell you what we can say.
Questions
GDPR says how the regulation applies to the above and how to exercise your rights. Email info@themethodic.com for anything else. Methodic LLC, Loudoun County, Virginia, United States.