Privacy Policy

1. Who is responsible

Moderniser Tech Consulting S.L. operates Moderniser. This policy covers our marketing website, hosted platform, and connected CLI and desktop services where we process personal data.

We act as controller for account administration, billing, security and our business communications. When an organisation provides personal data in its projects or workspaces, it generally determines the purposes of that processing. Our role as processor and the applicable instructions must be set out in the customer's data processing agreement. A self-hosted deployment may have different responsibilities and providers.

2. Information we process

• Account information: name, email, organisation, membership, role and authentication information supplied by you or your administrator.
• Work content: projects, tasks, wiki pages, comments, attachments, time entries and content made available through authorised connectors.
• AI and workspace information: messages, model responses, tool inputs and outputs, session identifiers, usage and repository or file content accessed during an authorised session.
• Billing information: purchases, credits, usage charges, invoice details and payment processor references. Card payments are handled by the payment provider; the application does not store full card numbers.
• Technical and support information: IP addresses and request metadata in infrastructure logs, authentication events, errors and information you include in a support request.

Information may come from you, your organisation's administrator, connected services or your use of Moderniser. Avoid including sensitive personal data or secrets in prompts unless the deployment and contractual arrangements permit it.

3. Purposes and legal bases

• Provide the service and respond to requests: performance of a contract or steps requested before entering into one. For organisation-managed users, legitimate interests in administering the customer relationship may apply.
• Protect accounts and investigate abuse: legitimate interests in securing the service, preventing fraud and resolving operational problems, balanced against users' rights.
• Maintain invoices and statutory records: compliance with applicable legal obligations.
• Optional marketing or non-essential tracking: consent where required. Consent can be withdrawn without affecting earlier lawful processing.

Account and billing information necessary for the service must be provided to create or administer an account or complete a purchase. Optional information is voluntary. Customer workspace data is processed under the customer's instructions and agreement.

4. AI processing and connected services

AI features send selected prompts and context to the inference provider configured for the service. Context can include task descriptions, wiki content, code excerpts, repository files and tool results. Running the CLI or desktop app locally does not, by itself, prevent this transmission.

Hosted workspaces can store and process repository content on the configured container host. Connectors access data within their configured permissions. Your organisation should approve the data, providers and tools used in each deployment.

Provider processing, retention and any model-training permissions depend on the applicable provider terms and customer agreement. This draft makes no promise that all processing stays in the EU or that every provider has zero retention. Those arrangements must be verified before publication.

AI suggestions should be reviewed by a person. Moderniser is designed for software delivery, not for decisions about people with legal or similarly significant effects.

5. Recipients and international transfers

Information may be available to authorised members of your organisation and service providers needed for hosting, storage, inference, payments and transactional email. Depending on the deployment, these can include Fireworks AI, Stripe, Resend and providers of S3-compatible storage. Connected services you enable have their own privacy terms.

We may also disclose information when required by law or necessary to establish, exercise or defend legal claims. Data access must be limited to the purpose of the disclosure.

The final policy and data processing agreement must identify applicable provider locations and transfer arrangements. Transfers outside the EEA require an applicable legal mechanism, such as an adequacy decision or standard contractual clauses, with additional safeguards where required. Details and copies of relevant safeguards can be requested at jaf@moderniser.ai.

6. Retention and security

Account and workspace data is retained while needed to provide the service and meet the customer's instructions. After account closure, deletion and export are subject to the agreed arrangements, backup lifecycle, legal recordkeeping and any unresolved disputes. Billing records may be kept for statutory accounting and tax periods; security records only as long as needed for investigation and protection.

The operational retention schedule, including backup and provider retention, must be confirmed before this policy becomes effective. We do not state an unverified fixed deletion deadline.

Safeguards include access controls, organisation-scoped authorisation and protections for stored credentials. No system can eliminate all security risk. Customers should limit access, review integrations and keep account credentials secure.

7. Cookies and browser storage

The current marketing site serves static pages with self-hosted fonts and does not include advertising or analytics trackers. The application uses browser storage for authentication and preferences. Infrastructure still receives the technical information needed to deliver a request.

If non-essential cookies or tracking are introduced, their purposes and providers must be disclosed and consent obtained where required. You can clear browser storage using your browser settings; doing so may sign you out or reset preferences.

8. Your privacy rights

Subject to applicable conditions, you may request access, correction, erasure, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent. We may need proportionate information to verify your identity.

For organisation-controlled workspace data, contact your organisation first; we will assist it under the relevant agreement. For information controlled by Moderniser, send privacy requests to jaf@moderniser.ai.

You can complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority. See the AEPD's guidance on privacy information.

9. Scope and updates

Moderniser is intended for professional use and is not directed at children. Third-party websites linked from our site are governed by their own policies.

When this draft is finalised, the effective date will be published here. Material changes should be communicated through the service or the customer contact as appropriate. Read our Terms of Service for the proposed rules governing service use.