Privacy Policy

Last updated: 7 October 2026

1. Who is responsible for your data?

Modilo's marketing website at hello.modilo.app and its public demonstration are operated by Karamelkov, s.r.o., Company ID (IČO) 08576211, VAT ID CZ08576211, registered office Mickiewiczova 548/1a, Město, 736 01 Havířov, Czech Republic, registered at the Regional Court in Ostrava, file C 79986. Karamelkov, s.r.o. is the controller for the processing described here.

For privacy questions, deletion requests or exercising your rights, contact [email protected] or write to our registered office. Company details can be checked in ARES.

This notice covers the marketing website and public demo. Data processed for a merchant's actual store, customer orders or paid Modilo account is subject to the applicable service arrangements and the merchant's privacy information.

2. Browsing and site security

Our hosting and delivery infrastructure receives technical information such as IP address, request URL and time, browser information and security events. We use it to deliver pages, diagnose failures and protect the website against abuse. Our legal basis is our legitimate interest in operating a reliable and secure website (Article 6(1)(f) GDPR).

Technical records are retained as needed to investigate operational or security issues, subject to the infrastructure providers' retention settings. Information relevant to a specific incident may be kept until it is resolved or a related legal claim ends. We do not use these records for advertising profiles.

3. Contact and early access

If you email us, we receive your email address, name if provided, message and any store details or attachments you choose to send. We use them to respond, arrange early access and support your request. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b)) or our legitimate interest in responding to general inquiries (Article 6(1)(f)).

Providing these details is voluntary; without a reply address and relevant information we may be unable to handle your request. We retain correspondence while the inquiry, early-access arrangements or support case remains relevant. Records necessary for an ongoing service, legal obligation or dispute may be retained for that purpose. An early-access email does not by itself subscribe you to unrelated marketing.

4. The public live demo: photos, text and AI

The demo loads directly so you can try the editor. We use technical connection data to deliver and secure it, based on our legitimate interest in offering a functional product demonstration (Article 6(1)(f)). Uploading a photo or running an AI action is optional: data you deliberately submit is processed to perform the demonstration you request. We do not use these demo inputs for advertising profiles. You can avoid this processing by using fictional details and sample images or by not using upload and AI actions.

The editor can process text, names, dates, locations, links, photographs and design choices you enter. Many preview operations run in your browser. Upload and AI actions also send data to Modilo's customer service at customer.modilo.app. Uploaded photographs and generated results can be stored and delivered through Bunny.net. Closing a tab does not automatically delete them.

To prevent abuse of paid AI actions in this public demo, we use a randomly generated browser identifier in the necessary hello_demo_visitor cookie on customer.modilo.app. The cookie lasts up to 24 hours, is Secure and HttpOnly, and is limited to the public AI API path. Short-lived request counters in Redis use a digest of that identifier, not your IP address. Counters expire at the end of the current UTC hour or day, within 24 hours. Visitors on the same network have separate browser allowances. Clearing or blocking the cookie does not reset the shared server-side allowance for the demo. This processing is based on our legitimate interest in securing the demo and controlling misuse (Article 6(1)(f)); it is separate from any merchant's own store limits and is not used for advertising.

When you explicitly run an AI action, the required image and prompt may be sent to an external provider. The application supports OpenAI or xAI for AI photo/character transformations, depending on the selected configuration, and AILab for face cutout and background removal. Provider-side processing and retention are governed by the applicable API arrangements and provider policies; the website's cookie settings do not control them.

Use sample images and fictional details. Do not submit sensitive personal information, confidential documents or images of people whose permission you do not have. This demonstration is not intended for biometric identification. AI output can be inaccurate; review results before using them.

Retention and deletion

Temporary uploads, AI previews and unfinished personalization records are subject to the application's scheduled cleanup. Its default threshold is 30 days, with cleanup normally scheduled daily; it is not an instant deletion at the end of a browsing session. Files linked to an actual order are excluded from temporary-file cleanup and follow the applicable order retention and deletion process. Provider copies, backups and security records can follow separate retention requirements.

You can stop using the demo or close the page at any time. This stops your further interaction but does not erase data already submitted. For deletion of data or to object to processing based on legitimate interests, email [email protected]. Include the approximate time, tool used and any generated file link available to you so we can locate the data; do not send another copy of a sensitive photograph merely to identify it.

5. Tutorial links and browser storage

Tutorial links open YouTube in a separate tab. There is no embedded YouTube player on this website. If you follow a tutorial link, Google/YouTube processes technical information under its own Privacy Policy.

Fonts are hosted on this website. We do not add advertising or analytics trackers or store optional cookie-consent preferences. Necessary delivery, security or demo-session technology may be used where needed to provide a feature. See our Cookies notice.

6. Recipients and international processing

Depending on the features you use, recipients include our authorized team and service providers: Railway (hosting), Cloudflare (delivery and security), Bunny.net (demo media storage and delivery), our email service provider for messages you send, OpenAI, xAI or AILab for the AI actions described above, and Google/YouTube if you follow external tutorial links. Each receives the information associated with its part of the service.

Some providers operate outside the European Economic Area or use international infrastructure. A transfer outside the EEA requires an applicable GDPR transfer mechanism, such as an adequacy decision or appropriate contractual safeguards. For information about the arrangement applying to a particular request or provider, contact [email protected]. Not using upload or AI actions avoids the additional transfers associated with those tools. Google describes its video processing, retention and international transfers in its privacy notice.

Provider information: Railway, Cloudflare, Bunny.net, OpenAI, xAI and AILab.

7. Your rights

Under the GDPR, you may request access, correction, erasure or restriction of your personal data, object to processing based on legitimate interests, and request portability where applicable. You may withdraw consent at any time. These rights depend on the circumstances and applicable legal requirements.

Write to [email protected]. We may request proportionate information to verify your identity or locate your data. We normally respond within one month; where permitted, a complex request can require an extension and we will inform you. You may complain to the Czech Office for Personal Data Protection (ÚOOÚ) or another competent supervisory authority.

The marketing website and demo do not make solely automated decisions that produce legal or similarly significant effects for you. The demonstration's AI image generation is not a decision about your eligibility, rights or access to a service.

8. Updates

We update this notice when features or processing change. A material change to optional processing may require a new consent choice.