NLEN
Sign in Get a quote
Legal

Privacy Policy

Last updated: 4 October 2026

1. Introduction

Modou ("we", "us") operates the modou.io website and the Modou AI automation platform. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our services.

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Data We Collect

Account information:

  • Name, email address, and password (hashed) when you create an account
  • Company name and website (optional, during onboarding)
  • Billing information processed securely through Stripe (we never store your full card number)

Project documents:

  • The tender documents you upload (specifications, drawings, schedules and models) and the prices, decisions and notes you add to a project
  • These files can contain names and contact details of people working on the project, for example in a drawing's title block

Tool connection data:

  • When you connect a third-party tool (e.g. HubSpot, Slack, Stripe), we receive OAuth access tokens that allow our AI agents to read and write data in those tools on your behalf
  • We access your tool data only to perform the automations you request (scanning, analysing, executing)
  • We do not store copies of your tool data beyond what is needed for agent memory (scan results, health scores) to provide context in future runs

Usage data:

  • Agent run logs (which tools were used, actions taken, duration)
  • Feature usage analytics to improve the platform
  • Browser type, IP address, and page views for security and performance

2a. Free Tools on Our Website

modou.io offers free tools: a cladding calculator, an IFC checker, a specification text checker and a cost calculator for your own prices. Before you see the result of one of these tools, we ask you once to leave your details.

  • What we collect. Your first name, last name, email address and phone number, which tool you used, a short summary of the result (for example counts, never the content), the time you sent the form and the version of the text you saw. When you use a tool again, we record which tool, on which page and with which short summary. We also keep the IP address and browser type for security and to prevent abuse, and the utm tags from the link you came from, if there are any.
  • What stays in your browser. Your file (for example an IFC model), your pasted specification text and the prices you type stay in your browser. We do not send them to Modou, and we do not send the file name either.
  • Purpose. To email and phone you about your result and about Modou, and to see which tools are used.
  • Legal basis. Our legitimate interest (Article 6(1)(f) GDPR): business contact with people in construction who use one of our tools. We say so next to the form. You give it by ticking the box, which is off by default, and the tools cannot be used without it.
  • Objecting. You can do so at any time, without giving a reason. Email hi@modou.io and we will stop emailing and phoning you and delete your details on request. Withdrawing does not affect what was done before.
  • Retention. If you become a Modou customer, we keep these details for as long as your account exists and for up to 24 months after it. If you do not, we keep them until 24 months after you last used a tool. Email hi@modou.io to have them removed sooner.
  • Who can access them. Only Modou staff and the processors listed in section 5 that we need to store the details and send email (Supabase and Resend). We report a new lead internally by email and in a Modou chat channel.

3. How We Use Your Data

  • To provide and operate the Modou platform and its AI agent features
  • To read and check the project documents you upload, and to answer your questions about them
  • To authenticate you and manage your account
  • To execute the automations you request across your connected tools
  • To generate reports and analysis from your connected tools
  • To send transactional emails (account verification, password resets)
  • To process payments through Stripe
  • To improve our product based on aggregated, anonymised usage patterns

4. AI and Your Data

Modou uses third-party AI models (Google Gemini, accessed through Google Vertex AI on Google Cloud) to power its agent features. When our agents read data from your connected tools, that data is sent to the AI model as part of the prompt to generate analysis, recommendations, or execute actions. When Modou reads a specification or a scanned page, or answers a question about a project, the text and pages needed for that step are sent to the model.

  • We do not use external AI models that can train on your data. We do not use your project documents, drawings, prices or calculations to train AI models. The only exception is a project you have given us written permission for. We are an API customer of our AI provider, not a data partner. Your documents and business data are used to give answers within your own account.
  • AI-generated outputs (reports, analysis, email drafts) are stored in your account and are not shared with other users.
  • Email open tracking. Emails Modou composes on your behalf may include an invisible open-tracking image so your reports can show open rates. We record only the open time and a counter, never the message content or the reader's identity. You can turn this off any time in Settings, and it applies only to emails Modou writes, not mail you write yourself.
  • Agent memory (health scores, past findings) is stored per user to provide context in future checks. You can delete this at any time.
  • Where AI processing happens. Your account data and agent results are stored in the EU (see section 6). AI model processing currently runs in Google's global region and is not guaranteed to stay within the EU, so we do not claim EU-only AI processing.

You decide which tools Modou connects to and which actions it runs, and you are responsible for reviewing and approving those actions. See our Terms & Conditions for how responsibility for agent actions works.

5. Third-Party Services

We use the following third-party services to operate the platform:

  • Supabase: authentication and database hosting (EU region, Ireland)
  • Google Vertex AI (Google Cloud): the AI models that power agent automations
  • Composio: tool connections and access management
  • Stripe: payment processing
  • Resend: transactional email delivery
  • Slack: internal alert to our team when someone requests a quote or uses a free tool (name, email address, phone number)
  • PostHog: product analytics (EU region)
  • Google Analytics: website usage analytics
  • Vercel: website and application hosting

Each service processes data in accordance with their own privacy policies. We ensure our providers meet GDPR requirements where applicable.

6. Data Storage and Security

  • All data is encrypted in transit (TLS/HTTPS)
  • Database hosted on Supabase with row-level security: users can only access their own data
  • OAuth tokens are managed by Composio and not stored in our database
  • Passwords are hashed using bcrypt via Supabase Auth, so we never store plaintext passwords
  • We conduct regular security reviews and apply patches promptly

7. Your Rights (GDPR)

Under the GDPR, you have the right to:

  • Access: request a copy of the personal data we hold about you
  • Rectification: correct any inaccurate personal data
  • Erasure: request deletion of your account and all associated data
  • Portability: receive your data in a structured, machine-readable format
  • Restriction: restrict the processing of your data in certain circumstances
  • Objection: object to the processing of your data for certain purposes

You can delete your account at any time from your dashboard settings. Your login and your profile are then removed straight away, together with files that belong to no project (for example files attached in chat). Your project documents are kept for up to 24 months after that and are then deleted, files included. If you are in a team, the team keeps the projects you created. If you own a team that still has other members, remove them from the team first, or email us. Section 8 sets this out in full. To have your project documents removed sooner, or to exercise any other right, contact us at hi@modou.io.

8. Data Retention

  • Your account details, your projects and your files are kept for as long as your account exists
  • Agent run logs and memory are retained until you delete them or delete your account
  • When you delete your account, your login and your profile are removed straight away, together with files that belong to no project (for example files attached in chat)
  • Your project documents (drawings, specifications, models, price files, calculations and exports) are kept for up to 24 months after your account is deleted, and are then deleted, files included. Email hi@modou.io to have them removed sooner.
  • If you are in a team and delete your account, the team keeps the projects you created: they pass to the team owner
  • If you own a team that still has other members, you cannot delete your account until those members have been removed from the team. Remove them from the team first, or email hi@modou.io.
  • We may retain anonymised, aggregated data for product analytics

9. Cookies

We split cookies into three buckets and ask you which ones we can use the first time you visit:

  • Essential: keep you logged in and protect your account. Always on; the platform won't work without them.
  • Functional: remember small preferences (e.g. last-viewed dashboard). Off until you accept “Functional only” or “Accept all”.
  • Analytics: Google Analytics and PostHog (EU-hosted product analytics) tell us which pages and features matter so we know what to fix. Off until you accept “Accept all”.

We do not use advertising or cross-site tracking cookies. You can change your choice any time: .

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. Continued use of the platform after changes constitutes acceptance of the updated policy.

11. Contact

If you have any questions about this Privacy Policy or how we handle your data, contact us at:

Modou
Email: hi@modou.io
Website: modou.io/contact