Privacy Policy

1. Who We Are and How to Contact Us

ModVC Humanizer is operated by ModVC. We are committed to protecting your privacy and handling your data with honesty, care, and transparency.

If you have any questions or requests regarding your data, you can reach our privacy team at support@modvc.org.

2. Information We Collect

We collect only the minimum information necessary to provide, secure, and bill for the service:

• Account details: Your email address and account creation/update timestamps.
• Authentication records: One-time login codes stored exclusively as cryptographically salted hashes with a 10-minute expiry, and active sign-in sessions with device identifiers and a hashed IP address.
• Subscription & billing metadata: Your active plan status, renewal timestamps, and Whop customer and subscription identifiers.
• Usage statistics: Word counts processed during your active billing period to enforce plan limits.
• Security & anti-abuse counters: Temporary rate-limiting buckets based on anonymized, hashed IP hashes to protect the service from automated attacks.

3. What We Do NOT Store

We operate on a strict privacy-first architecture:

• Ephemeral Text Processing: Text you submit for rewriting is held in memory only for the duration of the HTTP request, processed securely via our dedicated AI inference infrastructure, and immediately discarded. It is never logged to disk or cached on our servers.
• History Storage: For registered account holders, your rewrite history is securely saved to your account in our encrypted cloud database up to your active plan's limit (100 entries for Weekly, 500 entries for Monthly/Yearly) so you can restore past work across sessions. For visitors who are not signed in, history is stored locally in your browser's localStorage. You can clear all history or delete your account at any time.
• Payment details: We never collect, process, or store your credit card, debit card, or bank account numbers. All payment collection and checkout transactions are handled directly by Whop.

4. Service Providers and Third Parties

To deliver the service, we share data with trusted third-party providers under strict data-protection agreements:

• AI Inference Infrastructure: Used to generate text rewrites under enterprise zero-retention agreements. API inputs and outputs are processed securely, retained only transiently as required to provide the response, and are never used to train foundation models.
• Whop: Merchant of record and payment platform handling billing, subscription lifecycle, and checkout.
• Transactional Email Infrastructure: Secure delivery service used exclusively for delivering your 6-digit login verification codes.
• Cloud Database Infrastructure: Cloud-native encrypted database hosting account records, active sessions, and usage counters.

5. Legal Bases for Processing (EU / UK GDPR)

Under the General Data Protection Regulation (GDPR) and UK GDPR, we process personal data under the following legal bases:

• Performance of a Contract: Providing you with the rewriting service, account access, and managing your subscription.
• Legitimate Interests: Protecting the service from abuse, rate-limiting malicious automated traffic, and securing user accounts.
• Legal Obligation: Maintaining accounting and tax compliance records for commercial transactions.

6. Data Retention

• One-time verification codes: Deleted immediately upon verification, or expired and purged after 10 minutes.
• Expired sessions: Cleaned up automatically within 24 hours of expiry.
• Account details: Retained until you request account deletion.
• Billing records: Retained for the statutory period required by tax and financial laws.

7. Your Rights

You have the right to access, rectify, port, or erase your personal data, or object to its processing. You can delete your account and all associated server records at any time directly through the app under Settings > Account > Delete account.

For any additional data subject requests, email support@modvc.org. We respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.

8. Security and Age Requirements

We implement industry-standard security measures including HTTPS/TLS encryption in transit, cryptographically hashed tokens, httpOnly secure cookies, and strict rate limiting. While we take every reasonable measure to protect your data, no internet transmission can be guaranteed completely immune from unauthorized interception.

The service is not intended for or directed at children under 16 years of age.