Privacy Policy
1. Scope and acceptance
This Policy describes how we collect, use, disclose and retain information in connection with the Service. By accessing or using the Service you acknowledge that you have read and understood it. If you do not agree, you must not access or use the Service. Access is restricted to users to whom we have issued credentials; the Service is not offered to the general public.
Where you access the Service on behalf of an organisation, you represent that you are authorised to do so, and references to “you” include that organisation.
2. Definitions
Personal Data means information relating to an identified or identifiable natural person. Workspace Content means the configuration and operational records you or your agents create in the Service, including workspaces, agent definitions, threads, runs, steps, proposed actions, approvals and audit records. Processing has the meaning given in applicable data protection law.
3. Information we collect
We collect only the following categories.
- Account information. Your name and email address, and the workspaces in which you hold a role of owner, approver or viewer. These records are created by an administrator; the Service has no self-registration.
- Authentication data. Cryptographic hashes of sign-in links and session identifiers, together with their creation, expiry, use and last-seen timestamps. We do not store passwords, and we do not store sign-in tokens or session tokens in any recoverable form.
- Workspace Content. The records described in Section 2, including any Personal Data you choose to place in them. You determine what Workspace Content contains.
- Audit records. A record of each change, the acting user and the time it occurred. Audit records are append-only by design and cannot be altered or deleted through the Service.
- Technical and log data. Information generated automatically by our hosting provider in the ordinary course of serving requests, which may include IP address, request metadata, user-agent string and timestamps.
We do not knowingly collect government identifiers, payment card data, precise geolocation, biometric data or special categories of Personal Data, and you must not submit them to the Service.
4. Cookies and similar technologies
The Service sets a single strictly necessary cookie to maintain your authenticated session. It is marked HttpOnly, Secure and SameSite=Lax, and expires no later than thirty days after issue. We do not use advertising, analytics, profiling or cross-site tracking cookies, and we embed no third-party trackers. Because this cookie is essential to a service you have requested, it does not require consent under applicable law; disabling it prevents the Service from functioning.
Because we do not track users across third-party websites, we take no action in response to “Do Not Track” browser signals.
5. Purposes and legal bases
We process information only for the purposes below, on the legal bases indicated.
- To provide the Service — performance of a contract with you, or our legitimate interest in providing the Service to the organisation that engaged us.
- To authenticate you and secure the Service, including detecting and preventing unauthorised access and abuse — legitimate interests and, where applicable, compliance with legal obligations.
- To maintain audit records establishing who authorised each action — legitimate interests in accountability, and compliance with legal obligations.
- To communicate with you about access, security and operational matters — performance of a contract and legitimate interests.
- To comply with law and to establish, exercise or defend legal claims — legal obligation and legitimate interests.
We do not use your information for advertising. We do not sell Personal Data and we do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act as amended.
6. Service providers and disclosure
We disclose information only as follows: (a) to service providers processing information on our behalf under contract, limited to what each requires; (b) where you direct a disclosure, including by configuring an agent or connection to transmit information to a third party; (c) to professional advisers; (d) in connection with a merger, acquisition, financing or sale of assets, subject to this Policy or a successor policy offering comparable protection; and (e) where required by law, legal process or a lawful governmental request, or where we reasonably believe disclosure is necessary to protect our rights or the safety of any person.
Our service providers as at the date above are:
- Render Services, Inc. — application hosting and managed database, United States.
- Google LLC — outbound delivery of sign-in emails, through Google Workspace.
Where you enable features that transmit Workspace Content to third-party model providers or connected systems, that transmission occurs at your instruction and is governed by the receiving party’s terms. We will update the list above as our providers change.
7. International transfers
The Service is hosted in the United States. If you access it from elsewhere, your information will be transferred to, stored in and processed in the United States, which may not provide an equivalent level of data protection. Where required, transfers from the European Economic Area, the United Kingdom or Switzerland are made under the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism.
8. Retention
We retain Account information and Workspace Content for as long as your account remains active, and thereafter for such period as is necessary for the purposes in Section 5. Authentication data is retained only until the relevant link or session expires, and for a short period thereafter for security investigation. Audit records are retained for the longer of the life of the workspace and any period necessary to establish, exercise or defend legal claims. Backups are held on our hosting provider’s cycle and are overwritten in the ordinary course.
9. Security
We implement technical and organisational measures appropriate to the risk, including encryption in transit, storage of authentication tokens only as cryptographic hashes, single-use and time-limited sign-in links, role-based access control, database-level isolation between workspaces and append-only audit logging. Sign-in links are valid for fifteen minutes and may be used once.
No method of transmission or storage is completely secure. We do not warrant that the Service will be uninterrupted, error-free or immune from unauthorised access, and to the fullest extent permitted by law we disclaim any such warranty. You are responsible for safeguarding access to the mailbox associated with your account, since any person with access to it can request a sign-in link.
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required by applicable law, affected individuals, within the periods prescribed by that law.
10. Your rights
Subject to applicable law and to verification of your identity, you may request access to the Personal Data we hold about you, correction of inaccurate data, deletion, restriction of or objection to certain processing, portability, and withdrawal of consent where processing rests on consent. Withdrawal does not affect the lawfulness of processing carried out beforehand.
Residents of California may request disclosure of the categories and specific pieces of Personal Data collected, the categories of sources, the business purposes for collection and the categories of recipients; may request deletion or correction; and may not be discriminated against for exercising these rights. As stated in Section 5, we neither sell nor share Personal Data.
Requests may be sent to hello@moderis.app. We will respond within the period required by applicable law. Certain requests may be refused or limited where an exemption applies, including where retention is necessary to preserve audit integrity or to comply with a legal obligation, and we will explain the basis for any refusal. You may lodge a complaint with your supervisory authority, though we ask that you contact us first.
11. Automated processing
The Service does not presently execute autonomous agent actions; its current function is to record and display workspace configuration. It is designed so that, where such execution is enabled, actions carrying material consequence are proposed for human approval rather than performed automatically, and a record of the approving person is retained.
We do not carry out automated decision-making producing legal or similarly significant effects concerning you within the meaning of Article 22 of the GDPR. Should that change, we will amend this Policy under Section 13 before the change takes effect.
12. Children
The Service is not directed to, and may not be used by, persons under eighteen years of age. We do not knowingly collect Personal Data from such persons, and will delete it if we learn that we have.
13. Changes to this Policy
We may amend this Policy from time to time. The date above indicates when the current version took effect. Where an amendment materially reduces your rights, we will give notice by email or through the Service before it takes effect. Continued use after the effective date constitutes acceptance of the amended Policy.
14. Governing law
This Policy is governed by the laws of the State of Illinois, United States of America, without regard to conflict-of-law principles, except where mandatory provisions of the law of your place of residence apply. Nothing in this Policy limits rights that cannot lawfully be limited, including statutory rights under applicable data protection and consumer protection law.
15. Severability
If any provision of this Policy is held invalid or unenforceable, that provision shall be modified to the minimum extent necessary to render it enforceable, and the remaining provisions shall continue in full force.
16. Contact
Moderis, LLC, an Illinois limited liability company
hello@moderis.app
A postal address for formal notices is available on request to the address above.