Privacy Policy

1. Introduction

Modou ("we", "us") operates the modou.io website and the Modou AI automation platform. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our services.

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Data We Collect

Account information:

• Name, email address, and password (hashed) when you create an account
• Company name and website (optional, during onboarding)
• Billing information processed securely through Stripe (we never store your full card number)

Tool connection data:

• When you connect a third-party tool (e.g. HubSpot, Slack, Stripe), we receive OAuth access tokens that allow our AI agents to read and write data in those tools on your behalf
• We access your tool data only to perform the automations you request (scanning, analysing, executing)
• We do not store copies of your tool data beyond what is needed for agent memory (scan results, health scores) to provide context in future runs

Usage data:

• Agent run logs (which tools were used, actions taken, duration)
• Feature usage analytics to improve the platform
• Browser type, IP address, and page views for security and performance

3. How We Use Your Data

• To provide and operate the Modou platform and its AI agent features
• To authenticate you and manage your account
• To execute the automations you request across your connected tools
• To generate reports and analysis from your connected tools
• To send transactional emails (account verification, password resets)
• To process payments through Stripe
• To improve our product based on aggregated, anonymised usage patterns

4. AI and Your Data

Modou uses third-party AI models (Google Gemini, accessed through Google Vertex AI on Google Cloud) to power its agent features. When our agents read data from your connected tools, that data is sent to the AI model as part of the prompt to generate analysis, recommendations, or execute actions.

• We do not use your data to train AI models. We are an API customer of our AI provider, not a data partner. Your business data is used solely for generating responses within your own sessions.
• AI-generated outputs (reports, analysis, email drafts) are stored in your account and are not shared with other users.
• Email open tracking. Emails Modou composes on your behalf may include an invisible open-tracking image so your reports can show open rates. We record only the open time and a counter, never the message content or the reader's identity. You can turn this off any time in Settings, and it applies only to emails Modou writes, not mail you write yourself.
• Agent memory (health scores, past findings) is stored per user to provide context in future checks. You can delete this at any time.
• Where AI processing happens. Your account data and agent results are stored in the EU (see section 6). AI model processing currently runs in Google's global region and is not guaranteed to stay within the EU, so we do not claim EU-only AI processing.

You decide which tools Modou connects to and which actions it runs, and you are responsible for reviewing and approving those actions. See our Terms & Conditions for how responsibility for agent actions works.

5. Third-Party Services

We use the following third-party services to operate the platform:

• Supabase: authentication and database hosting (EU region, Ireland)
• Google Vertex AI (Google Cloud): the AI models that power agent automations
• Composio: tool connections and access management
• Stripe: payment processing
• Resend: transactional email delivery
• PostHog: product analytics (EU region)
• Google Analytics: website usage analytics
• Vercel: website and application hosting

Each service processes data in accordance with their own privacy policies. We ensure our providers meet GDPR requirements where applicable.

6. Data Storage and Security

• All data is encrypted in transit (TLS/HTTPS)
• Database hosted on Supabase with row-level security: users can only access their own data
• OAuth tokens are managed by Composio and not stored in our database
• Passwords are hashed using bcrypt via Supabase Auth, so we never store plaintext passwords
• We conduct regular security reviews and apply patches promptly

7. Your Rights (GDPR)

Under the GDPR, you have the right to:

• Access: request a copy of the personal data we hold about you
• Rectification: correct any inaccurate personal data
• Erasure: request deletion of your account and all associated data
• Portability: receive your data in a structured, machine-readable format
• Restriction: restrict the processing of your data in certain circumstances
• Objection: object to the processing of your data for certain purposes

You can delete your account and all associated data at any time from your dashboard settings. To exercise any other rights, contact us at hi@modou.io.

8. Data Retention

• Account data is retained for as long as your account is active
• Agent run logs and memory are retained until you delete them or delete your account
• When you delete your account, all personal data is permanently removed within 30 days
• We may retain anonymised, aggregated data for product analytics

9. Cookies

We split cookies into three buckets and ask you which ones we can use the first time you visit:

• Essential: keep you logged in and protect your account. Always on; the platform won't work without them.
• Functional: remember small preferences (e.g. last-viewed dashboard). Off until you accept “Functional only” or “Accept all”.
• Analytics: Google Analytics and PostHog (EU-hosted product analytics) tell us which pages and features matter so we know what to fix. Off until you accept “Accept all”.

We do not use advertising or cross-site tracking cookies. You can change your choice any time: Reset cookie preferences.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. Continued use of the platform after changes constitutes acceptance of the updated policy.

11. Contact

If you have any questions about this Privacy Policy or how we handle your data, contact us at:

Modou
Email: hi@modou.io
Website: modou.io/contact