Modulify is operated by Azwedo L.L.C. ("Azwedo", "we", "us" or "our"). This Privacy Policy explains what personal data we collect when you use the Modulify website, web app, mobile app, API and MCP server (together, the "Service"), how we use it, who we share it with and the choices you have.
It sets out the main ways we handle data rather than every technical detail, and we update it as the Service changes. Your use of the Service is also governed by our Terms of Service.
Information we collect
We collect what you give us, what is created as you use the Service and what the services you connect share with us.
Account information. Your name, email address and avatar, and how you sign in: with an email link, Google, GitHub or, in the mobile app, Apple. When you sign in with a provider, we receive the profile details it shares, such as your name, email address and photo.
Your content. The workspaces, projects, pages, code, files, collections, database records, comments, prompts and chat messages you create or upload, the sites, stores and repositories you import with the records they hold, such as products, customers and orders, and the images, screenshots and voice input you send to AI features.
Billing information. Your plan, subscriptions, credit purchases and payment history. Payments are handled by Stripe, so your card details go to Stripe and are never stored by us. We keep only the fingerprint Stripe gives each card, which tells cards apart without revealing their number, to prevent fraud and abuse.
Domain registration details. When you buy a domain, the registrant details the registry requires: name, company, postal address, email address and phone number.
Support conversations. The messages and files you send us through the support chat or the contact form. If you send the contact form or the Webflow transfer form while signed in, we also link the message to your account, so our team can see which account it came from.
Survey answers. If you answer a feedback survey in the Service, your answers, kept with your account so our team can read them and pay the reward they earn. If we invite you to a survey by email, we also record whether the invitation is opened and its links clicked. You can stop these invitations by turning off product tips in your email settings.
Affiliate details. If you take part in the affiliate program, the PayPal email address we pay you at, and the visits, signups and payments that come through your link.
Usage and device information. Your IP address with the approximate location and network we derive from it, your browser, device and operating system, a random identifier your browser or the app stores to recognize the device you sign in from, how you found Modulify (such as the referring site, campaign tags and ad click identifiers), the pages you open, what you search for and the actions you take in the Service, which notifications in the Service you have read, and your sign-in history.
Mobile app. A push notification token for each device you sign in on. The app asks for your camera, photos or microphone only when you choose to take a photo, attach one or dictate a prompt.
Connected services. When you connect GitHub, a store or another tool, the account identifiers, access keys and permissions needed to work with it on your behalf.
Businesses we contact. If we reach out to a business about Modulify, we use its business contact details, such as an email address or phone number, public information about its website, and whether our emails are opened and their links clicked. You can ask us to stop at any time, and those emails include an unsubscribe link. Once you unsubscribe, we keep your email address on a list of addresses we never email again.
How we use information
We use personal data to:
- Provide the Service: build, store, host and publish your projects, run AI features, process payments, show prices in the currency of the country your IP address points to, register domains and send the notifications you ask for.
- Keep your account details in sync across the platforms we use to run the Service, such as our email and contact management tools.
- Keep accounts and the Service secure, and prevent fraud, spam and abuse, for example by noticing accounts that share a device, an email inbox, a card or a network, and by counting the links, shortened links and pressure wording in the emails your sites send, and how many of their recipients are on disposable email domains.
- Answer support requests, and send you messages about your account, billing and security.
- Send you product news, tips and offers, which you can ask us to stop at any time.
- Understand how people find and use Modulify, measure our marketing and improve the Service.
- Meet our legal obligations and enforce our Terms.
We do not sell your personal data.
AI features
When you use an AI feature, or when we use AI to help answer your support messages, we send the content it needs, such as your prompt, code, files and screenshots, to the AI model providers we work with, which process it to return a result to us.
In a site's chat, the AI also receives the workspace's plan, its credit balance and what your role lets you do there, and, when you ask it about your workspace or your account, the details it needs to answer or act, such as the members with their names, email addresses and roles, and your own name, phone number, settings, referrals and payout address. It never receives more than your role lets you see.
When you set up an agent, it runs on its own on the schedule you choose. Each run reads the data of that one site, which can include what its visitors left there, such as comments, database rows and analytics, and sends what it needs to an AI model provider to write a report. We keep each report, with the list of the tools the run used, for a limited time, and email the report to the person who set the agent up.
To protect the Service, we also use AI to help our team review groups of accounts that look linked. We send it the details the review needs, such as the accounts' email addresses, names, plans, credit use and activity, and the network and country of a shared IP address, but never the IP address, device identifier or card fingerprint itself. Our team reads each review and makes every decision about an account.
Your project chat, with its messages and attachments, is saved with the project so you and your team can pick up where you left off.
We use what you send to AI features only to provide and improve the Service, and never for advertising.
Visitors to your sites
The sites and web apps you publish can collect data from their own visitors, through their databases, file uploads, the emails they send and receive, their built-in AI features, built-in analytics and any code or trackers you add.
You are the controller of that data: you decide what your site collects and why, and we process it on your behalf to run your site. You are responsible for telling your visitors how their data is used, for example in your own privacy policy, and for getting any consent the law requires.
The same applies to personal data you import into a site, such as the customers, orders and comments of a store you bring in from another platform: you are its controller, it is stored in your site's database, and we process it on your behalf.
Built-in analytics is cookieless. It records page views, sources, country, browser, operating system and device, and Modulify adds no cookies of its own to your sites. Emails your site sends track opens and clicks unless you turn tracking off.
When your site sends one email to a list, we store the list with that email: each person's address and name, and the details your site adds for them, so we can send every copy and show you how it went. We delete those details once that person's email is handled. The addresses stay in your site's email history until you clear it, after which they are erased after a limited time, or until the site is deleted.
A marketing email from your site carries an unsubscribe link to a page on Modulify that shows the person's address and the name of your site. We keep each unsubscribe on your site's blocked list, so your later marketing emails skip that person, until you remove it or the site is deleted. Your site's own code can read that list too.
When your site sends texts, we give the text message provider that delivers them each person's phone number and the details the template fills in, and we keep each text with its delivery status in your site's history for a limited time. A verification code is never stored. When someone replies STOP, we keep their number on your site's blocked list, so your site never texts them again, until they reply START or the site is deleted.
When your site uses the built-in AI, what its visitors type or send to an AI feature goes to OpenRouter, which passes it to an AI model provider such as Anthropic, OpenAI or Google, or, when OpenRouter cannot be reached, straight to one of those providers. They process it to return the answer to your site. Through OpenRouter we only use providers that do not train on that content and do not routinely store it, although a provider or OpenRouter may keep a message its safety checks flag, for a limited time. We keep a record of each request, such as its time, the model, the tokens and the credits it took, but never the prompts or the answers, and we delete that record after a limited time.
If you visited a site built with Modulify and have a question about your data, contact the owner of that site first.
How long we keep data
We keep your account information and content for as long as your account is open.
A deleted project can be restored from Recently deleted for 30 days. Files and database rows you delete are removed right away, though copies can remain in backups for a limited time. A chat you clear stays stored with its project until the project is permanently deleted.
When you close your account, we delete your account, the workspaces you own and everything in them, your sign-in history and your customer record at Stripe. Domains you bought stay registered until they expire.
We keep some information after that where we need it: payment records, support conversations, records of the emails we sent you, your contact details in our email platforms, and what we need to prevent fraud and abuse or resolve disputes. System logs are deleted automatically after a limited time.
So that free credits cannot be collected again by closing an account and signing up anew, we keep a one-way hashed form of a closed account's email address and device identifiers, with its plan, its credit use and when it was created and closed, for a limited time. We use it only to recognize a new account on the same email address or device.
Your choices and rights
In your account settings you can update your name, email address and avatar, connect or disconnect sign-in methods, choose which emails and notifications you get, and close your account. Billing and security emails are always sent while your account is open.
You can export your work from each project, such as its code, database tables and analytics. Some exports depend on your plan.
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict how we use it, and to withdraw consent you gave. To use these rights, or to stop marketing emails, contact us through our contact form. We may need to confirm your identity first. You can also complain to your local data protection authority.
Security
We protect data with industry-standard measures, such as encryption and restricted access.
No method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security. Keep your sign-in methods and access tokens safe, and contact us if you think your account has been compromised.
Where data is processed
Our main systems are in the United States, and our providers process data in the United States and other countries, whose data protection laws may differ from those where you live.
On paid plans you can choose where a published site runs. Choosing a location in the European Union keeps that site's server, database, uploaded files and their backups in the EU. The rest of your project and account stays in our main systems.
Children
Modulify is not meant for children. You must be at least 16 to use it, and we do not knowingly collect personal data from anyone younger. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We update this policy as the Service changes, and the date at the top shows when it last changed. If a change significantly affects how we use your personal data, we will let you know in the app or by email.
Contact us
If you have questions about this policy or your personal data, reach us through our contact form or the support chat in the app.
