Privacy Policy
Effective Date: 2026-10-26
At ModifAI, we value your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal data in connection with our Services.
1. Data Controller
The entity responsible for data processing is:
MEDIAMODIFIER OÜ
Harjumaa, Tallinn, Tatari tn 6, 10116, Estonia
2. Information We Collect
- Account Information: When you sign up, we collect your name, email address, password, and billing data.
- Usage Data: Including log files, IP addresses, browser types, time zone, pages visited, session duration, and interactions.
- Cookies and Tracking Technologies: We use cookies to operate and personalize the Services, track usage, and for analytics purposes.
- Third-party sign-in data: if you sign in with Google, Apple or Microsoft, we receive the identifier and email address returned by that provider, used only to link the sign-in method to your existing ModifAI account.
3. Purpose of Processing
We use personal data to:
- Operate and maintain the Services;
- Manage subscriptions and billing;
- Provide customer support;
- Communicate service updates and offers (with your consent);
- Comply with legal obligations.
- Authenticate you and match your provider identity to your existing ModifAI account;
- Detect and prevent unauthorized access to accounts.
4. Legal Basis for Processing (EU/EEA Users)
Under the General Data Protection Regulation (GDPR), we rely on the following legal bases:
- Contractual necessity (e.g., account management and authentication, including third-party sign-in where you choose to use it);
- Legitimate interests (e.g., to improve our Services);
- Consent (e.g., for marketing communications);
- Legal obligations.
5. Sharing and Transfers
We share your information with the following categories of service providers, acting on our behalf and under contractual data protection obligations:
- payment and subscription management (Recurly);
- hosting and infrastructure (Vercel);
- product analytics (PostHog, EU hosting);
- error monitoring (Sentry);
- customer support tools;
- the AI model providers that process the content you submit in order to generate your results.
AI model providers receive only the content necessary to perform the requested generation and process it under their own terms and data policies.
Data received from Google APIs is used solely to authenticate you and to match your provider identity to your existing ModifAI account. It is not used for advertising purposes, is not sold, and is not transferred to third parties except as necessary to operate the Services or to comply with the law.
Data may be transferred to and processed in countries outside of your own. We implement appropriate safeguards in such cases, including Standard Contractual Clauses.
6. Use of ModifAI Through AI Assistants
When you connect your ModifAI account to a third-party AI assistant that supports the Model Context Protocol (MCP), such as Claude (provided by Anthropic) or ChatGPT (provided by OpenAI), the assistant can use ModifAI tools on your behalf. This section describes the additional data we process in that context. The rest of this Privacy Policy continues to apply.
Data we process
- Connection data: the name of the assistant application, the permissions you granted on the consent screen, the access and refresh tokens issued to it, and the date it was last used.
- Requests: the prompts, parameters and settings the assistant sends to our tools on your behalf.
- Files: files you upload through the ModifAI widget displayed in the assistant, and files the assistant sends us by link (URL).
- Results: the images, videos, audio and other content generated for you, and the account information returned to the assistant (credit balance, subscription status, creation history, cost estimates).
- Language preference: the preferred language of your account, recorded when you give consent and when you change the language of the website, used to localize the messages returned to the assistant.
Purposes
We use this data to authenticate the assistant, run the tools you request, debit and refund credits, return results to the assistant, save your creations in your history, prevent abuse (rate limits and enforcement of our content policy) and keep the connection secure.
Recipients
The results of the tools, including generated files and the account information the assistant requests, are sent to the assistant you chose, and therefore to its provider (Anthropic or OpenAI). Their processing of that data is governed by their own terms and privacy policies, not by this Privacy Policy. We never share your password or payment details with the assistant.
Retention
- Access tokens expire 1 hour after they are issued.
- A connection remains active while it is used. It expires after 30 days without use, or immediately when you revoke it.
- Assistant registrations that no longer hold an active connection are deleted after 30 days.
- Files uploaded through the widget are stored in your library, like any upload from your dashboard, and follow the same retention.
- Files sent by link are stored for 1 day, then deleted.
- Your creations are kept in your history, like any creation made on the website.
Your controls
You can view and revoke your connected assistants at any time from your account page. Revocation takes effect immediately. Deleting your account deletes all tokens and consents linked to it. The rights described in Section 8 apply to this data.
7. Data Retention
We retain personal data only as long as necessary to fulfill the purposes described or as required by law. Account data and the content you generate or store in your Library are retained while your Account is active. If you have no ongoing Subscription and do not log in for 24 consecutive months, your Account and all associated data are permanently deleted, after an email notice sent 7 days and 1 day before deletion. Files you upload as inputs for a processing are deleted within 48 hours. Files of visitors without an Account are deleted 7 days after their first visit. Transactional records are retained longer for compliance. Deleted content may persist temporarily in encrypted backups before being purged. Where you have linked a third-party identity provider to your account, that link is retained for as long as your account exists. Temporary tokens issued during the account linking process are single use and expire shortly after being issued. Credit balances and transaction records linked to your account, including Extra Credits and their 180-day validity, are retained for the duration of your account and for the period required by applicable accounting and tax law thereafter.
8. Your Rights
You have the right to:
- Access and obtain a copy of your data;
- Rectify inaccurate data;
- Erase data where no longer necessary;
- Object to processing or restrict it;
- Withdraw consent at any time;
- Lodge a complaint with a supervisory authority.
To exercise your rights, contact us at contact@modif.ai
9. Data Security
We use encryption, firewalls, access controls, and other technical and organizational measures to secure your data against unauthorized access, disclosure, alteration, or destruction.
10. Third-Party Links and Services
Our Services may contain links to external sites or integrate with third-party applications. We are not responsible for the privacy practices of such third parties.
11. Children's Privacy
Our Services are not intended for individuals under 18 years old. We do not knowingly collect personal information from children.
12. Changes to this Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes through the Services or by email. Continued use of the Services constitutes acceptance.
13. Contact
For privacy-related inquiries, please contact: