Privacy Policy

1. Definitions

• Data Protection Legislation: Refers to the EU General Data Protection Regulation (GDPR/DSGVO) and the Austrian Data Protection Act (DSG), and any successor legislation thereof.
• Data Subject: A natural person who can be identified directly or indirectly through personal data (e.g., you as a user).
• Personal Data: Any data relating to an identifiable person, including (but not limited to) name, email address, IP address, online identifiers, or behavioral data.

2. Who processes your personal data?

The Data Controller:

David Rozsa (Einzelunternehmen, Austria)
Wirtsfeldweg 4/6, 5522 Sankt Martin am Tennengebirge, Austria
UID (VAT ID): ATU80686134
GISA: 37168582
Contact email: support@modulyo.com

Data Processors:

To provide our services, we use trusted third parties who process data under our instructions:

• Hosting and Infrastructure: Lovable Cloud / Supabase (USA/EU) - secure database and backend service.
• Payment Service: Stripe Payments Europe Ltd (Ireland/USA).
• Email Communication: Loops (USA) - handling newsletters and transactional emails.
• AI and Language Processing: Google Cloud EMEA Ltd (Google Gemini / Vertex AI) - The primary technological backbone for interactive chat features and content generation.
• AI Search and Fallback Text Generation: OpenAI Ireland Ltd (Ireland) / OpenAI, L.L.C. (USA) - We use this service for two distinct purposes. First, every single chat query you submit is processed by OpenAI to generate a vector representation (embedding), which allows us to retrieve matching passages from our knowledge base. Second, an OpenAI model generates the answer text only if the Google service is temporarily unavailable. Pursuant to OpenAI's contractual API terms, data submitted via the API is not utilized to train their models.
• Analytics and Session Recording: Google Analytics and Lucky Orange (USA).

3. What personal data do we collect and how?

We collect personal data through the following methods:

• Account Creation (Registration):
  • Direct registration: Name, email address, encrypted password.
  • Google OAuth (Social Login): If you register or sign in with Google, we receive your name, email address, profile picture URL, and language preference from Google.
• Chat interactions and AI: Content of conversations with the AI mentor is processed by Google Gemini technology. Important: Under the applicable business terms (Enterprise API), Google does not use data sent through the system to train its models, and does not store it permanently after processing. Nevertheless, please do not share sensitive personal data (e.g., health data, bank card PIN) in the chat window.
• User Content: Notes you create, business ideas (UVP), projects, generated posts, and your learning progress state.
• Website Visits and Analytics: IP address, browser type, device data, and usage statistics. To improve user experience, we use the Lucky Orange service, which may record mouse movements, clicks, and scrolling activity. Passwords and other sensitive fields are automatically masked (hidden) by the system.
• Transaction Data: Purchase history, billing address, Stripe customer identifier (bank card data is handled directly by Stripe, we do not store it).
• Communication: Name, email address, and content of your messages if you contact us directly (e.g., customer support).

We do not knowingly collect data from minors under 16 years of age.

4. Why do we process your personal data? (Legal basis)

We only collect your data on lawful bases defined by GDPR:

• Contract Performance: Providing the Modulyo service, account management, generating requested content, processing payments.
• Consent: Newsletter subscription, or acceptance of optional (analytics) cookies.
• Legitimate Interest:
  • Ensuring website security and fraud prevention.
  • Improving user experience and bug fixing (analytics).
  • Conducting business analysis to improve the service.
• Legal Obligation: Fulfilling accounting and tax obligations (e.g., retaining invoices).

5. Where do we store your data?

• Database: We store data in Supabase (Lovable Cloud) systems. Where possible, we strive to use servers in the EEA (European Economic Area) or with equivalent security levels.
• Payments: In Stripe systems, which comply with the strictest banking security standards (PCI-DSS).
• Email marketing: In Loops systems.

6. Unsubscribe and communication

You can unsubscribe from our marketing communications at any time by clicking the 'Unsubscribe' link at the bottom of emails, or in your account settings. Transactional messages essential to the service (e.g., password reminders, invoice notifications, Terms changes) cannot be unsubscribed from due to the nature of the service, as long as you have an active account.

7. Sharing data with third parties

We do not sell, rent, or trade your personal data. We only share your data with Service Providers (Data Processors) listed in Section 2 for the purpose of operating the service, or due to legal obligation in case of official requests. We require all our partners to comply with data protection legislation.

8. Your rights

Under the GDPR (DSGVO), you have the following rights:

• Right of Access: You can request a copy of your stored data.
• Right of Rectification: You can request correction of inaccurate data.
• Right to Erasure ("Right to be forgotten"): You can request deletion of your data, except where data retention is required by law (e.g., accounting law).
• Data Portability: You can request your data in a structured, machine-readable format.
• Right to Object: You can object to data processing (e.g., for direct marketing).

Please send your request to support@modulyo.com. We will respond as soon as possible, but no later than within 30 days.

9. International data transfers

Since servers of certain service providers (e.g., Stripe, Loops, Google, OpenAI, Lucky Orange) may be located in the USA, data may be transferred outside the EEA. We ensure that our partners comply with the EU-US Data Privacy Framework (DPF), or implement European Commission-approved Standard Contractual Clauses (SCCs) to safeguard your data.

10. Data security

We apply industry-standard technical and organizational measures (SSL/TLS encryption, password hashing, secure API calls, access restrictions) to protect your data. However, please note that internet data transmission is never 100% risk-free, so please keep your password secure.

11. Cookie Management and Tracking

Our website uses cookies and similar technologies. You can manage detailed settings on the Cookie Settings panel at the bottom of the website.

• Essential cookies: Always active, necessary for the website's basic functionality and secure login. These cannot be disabled.
• Analytics cookies (Optional): Help us understand visitor behavior (Google Analytics, Lucky Orange). Lucky Orange's session recorder uses \"Sensitive Data Masking\" technology, so it does not record passwords or bank card data.
• Preference cookies: Remember your settings (e.g., chosen language).

12. Complaints

If you believe we have violated your data protection rights, you have the right to lodge a complaint with the competent supervisory authority. Lead authority (operator's seat): Austrian Data Protection Authority — Datenschutzbehörde (DSB), https://www.dsb.gv.at. If you reside in another EU/EEA country you may also contact your local authority (e.g. in Hungary: NAIH, https://naih.hu).