Privacy Policy

1. Information we collect

1.1 Information you give us

• Account information: your email address, a password (stored hashed), and, if you sign up with Google or GitHub, the basic profile information those providers return
• Billing information: your plan, billing history, and the billing details you enter at checkout. Card numbers go directly to Stripe; we never see or store them
• Content you create: the code, files, configuration, and data in your projects, and the prompts and conversations you have with the App Builder
• Support and correspondence: messages you send us by email, live chat, or Discord, and anything you choose to include in them

1.2 Information we collect automatically

• Device and browser information: browser type and version, operating system, screen size, language
• Log data: IP address, timestamps, pages and features used, requests to our APIs, and error and performance data
• Approximate location: a country- or city-level estimate derived from your IP address. We do not collect precise location
• Referral and campaign data: the page that referred you and any UTM or click-ID parameters in the link you arrived on

1.3 Information from other sources

• Sign-in providers: if you sign in with Google or GitHub, we receive your email address and basic profile from them
• Payment provider: Stripe tells us whether a payment succeeded, the country your card was issued in, and the last four digits of the card
• Anti-abuse checks: we check the domain part of a sign-up email address against a disposable-email reputation service. Only the domain is sent, never the full address

2. How we use it, and our legal basis

We do not sell your personal information, and we do not use your content to train AI models.

3. AI features and your prompts

When you use the App Builder, your prompts and the relevant parts of your project are sent to our AI model provider, Anthropic, so a response can be generated. Anthropic processes this data on our behalf under a commercial agreement that does not permit them to train models on it.

We store your App Builder conversations so you can return to them, and so we can debug problems and measure usage.

Our AI features automatically flag prompts that look like they violate our Acceptable Use rules, such as a request to build a phishing or credential-harvesting site. A member of our team may review a flagged conversation and may act on it, including by suspending an account.

4. Cookies, analytics, and advertising

We use cookies and similar technologies to keep you signed in, remember your preferences, measure how the site and product are used, and measure the performance of our advertising. The tools we use are:

Essential cookies are always on, because without them you cannot sign in and we cannot keep your session secure. Analytics and advertising are optional: the banner shown on your first visit to modelence.com asks for your consent before we use them, and your choice is remembered for a year. Rejecting them does not affect your ability to use the Services.

You can change or withdraw your consent at any time using the "Cookie Preferences" link in the footer of every page, by clearing the cookies your browser has stored for modelence.com, or by emailing [email protected]. You can also opt out of Google advertising through your Google ad settings, and block trackers with your browser's tracking-prevention settings or an ad blocker.

5. Who we share it with (our service providers)

We share personal information with service providers who process it on our behalf, under contract, and only for the purposes we specify. The main ones are:

We also disclose personal information when the law requires it or in response to valid legal process, when we need to investigate suspected abuse or protect the rights and safety of people or of Modelence, and to a buyer or successor in connection with a merger, acquisition, or sale of assets, in which case we will tell you before your information becomes subject to a different privacy policy.

We do not sell your personal information, and apart from the advertising measurement described in Section 4, we do not disclose it to third parties for them to market their own products to you.

6. Data inside your applications

The Services let you build applications that collect and store data from your own end users ("Customer Application Data"). For that data:

• You are the controller and we are your processor. We handle Customer Application Data on your instructions, to provide the Services to you
• You are responsible for having a lawful basis to collect it, for giving your end users the notices the law requires, and for obtaining any consents
• We access it only where necessary to run the Services, to respond to a support request from you, to comply with the law, or to investigate a violation of our Terms
• This Privacy Policy does not describe how it is used; that is your privacy notice, not ours

When we process Customer Application Data, the infrastructure providers listed in Section 5 that we use to run the Services, such as Amazon Web Services, MongoDB Atlas, Cloudflare, and Anthropic, act as our subprocessors.

If you need a data processing agreement, contact [email protected].

7. Where your information is processed

We operate from the United States and our infrastructure and service providers are located there. If you use the Services from outside the United States, your information will be transferred to and processed in the United States, where data protection law differs from the law where you live. Where we transfer personal information out of the EEA, the UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

8. How long we keep it (data retention)

We keep your personal information for as long as your account is open. When you close your account we delete or de-identify it, except where we need to keep it to comply with a legal obligation (for example, we retain billing and tax records for seven years) or to resolve a dispute or enforce our agreements. Backups are deleted on their own rolling schedule.

To close your account and have your data deleted, contact [email protected].

9. Security

We protect your information with measures appropriate to the risk, including encryption in transit over TLS, encryption at rest for our managed databases and storage, hashed passwords, access controls that limit internal access to staff who need it, and monitoring and alerting on our infrastructure. Each customer's application data is isolated from every other customer's.

No system is perfectly secure, and we cannot guarantee that unauthorized access will never happen. If a breach affects your personal information, we will notify you and the relevant regulators as the law requires. You can report a security issue to [email protected]. We appreciate good-faith reports, but we do not operate a bug bounty program and do not pay rewards, fees, or compensation of any kind for vulnerability reports.

10. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you, and get a copy of it
• Correct information that is inaccurate or incomplete
• Delete your personal information
• Object to or restrict how we process it
• Receive it in a portable format, or have it sent to another provider
• Withdraw consent you have given, without affecting processing that already happened
• Not be discriminated against for exercising any of these rights

Email [email protected] to exercise any of them. We will verify your identity, respond within the time the law allows, and will not charge you unless a request is manifestly excessive. If you are unhappy with our response you can appeal by replying to us, and you can complain to your local data protection authority; in the EEA, that is the supervisory authority where you live or work.

If you are in California: we do not sell your personal information, and never have. The advertising tools described in Section 4 may count as "sharing" personal information for cross-context behavioral advertising under the CCPA, and you can opt out by rejecting optional cookies on our banner or by emailing us. The categories we collect, why, and who we disclose them to are set out in Sections 1, 2, and 5. You may use an authorized agent to make a request on your behalf.

11. Children

The Services are not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, email [email protected] and we will delete it.

12. Changes to this policy

We may update this policy. If a change is material, we will tell you by email or in the product before it takes effect, and we will always update the date at the top of this page.

13. Contact us

Modelence, Inc. is the controller of the personal information described in this policy.

Modelence, Inc.
1 Sansome St, Suite 1400 PMB 10088
San Francisco, CA 94104
United States

Privacy questions and requests: [email protected]