Privacy Policy

1. Overview & Data Controller

At ModStudio AI ("we", "us", or "our"), safeguarding your personal data and ensuring full transparency regarding computational workflows is our highest priority. This Privacy Policy explains how ModStudio AI collects, uses, protects, and discloses personal information when you use our website, cloud APIs, and desktop applications.

For the purposes of the General Data Protection Regulation (GDPR - Regulation (EU) 2016/679), the Turkish Personal Data Protection Law (KVKK - Law No. 6698), and the California Consumer Privacy Act (CCPA/CPRA), the Data Controller is:

ModStudio AI
Email: [email protected]
Email: [email protected]

2. Information We Collect

We collect information in three categories to deliver and protect our generative AI platform:

A. Information You Provide Directly

• Account Credentials: When creating an account via Clerk, we receive your email address, primary name or username, and encrypted authentication identifier.
• Prompt & Project Data: Text prompts, mod specifications, crafting recipes, custom item parameters, and workspace schemas you input into our editor or chat interface.
• Customer Support Correspondence: Content of communications sent to our support or legal email addresses.

B. Automatically Collected Technical & Telemetry Data

• Network & Device Identifiers: IP address, operating system, browser user-agent, language preferences, and hardware architecture (Windows/macOS/Linux).
• API Access Logs: Timestamps, HTTP route paths, request payload sizes, response latency, and outcome statuses.
• Token Consumption & Billing Ledger: Number of input/output tokens processed by our inference models, credit deductions, and remaining credit balance.

C. Transactional Data from Payment Processors

• Purchase Records: Transaction IDs, billing country, currency, payment timestamp, and credit package identifiers provided to us by our Merchant of Record, Paddle.com.
• Note: ModStudio AI never collects, processes, or stores your raw credit card numbers or banking credentials.

3. Third-Party Data Processors

To deliver real-time AI code generation, secure authentication, and global CDN delivery, we engage trusted third-party service providers ("Processors"). All processors are bound by strict Data Processing Agreements (DPAs) in compliance with GDPR Article 28:

4. Legal Bases for Processing (GDPR & KVKK)

We process your personal data under the following legal bases pursuant to Article 6 of the GDPR and Article 5 of Turkish KVKK:

• Performance of Contract (Art. 6(1)(b) GDPR): To authenticate users, generate mod blueprints, maintain credit balances, and fulfill digital orders.
• Legal Obligation (Art. 6(1)(c) GDPR): To retain server access and transaction logs in accordance with cybercrime legislation (e.g., Turkish Law 5651) and financial recordkeeping requirements.
• Legitimate Interests (Art. 6(1)(f) GDPR): To detect and prevent malicious exploits, prevent malware creation, protect infrastructure from DDoS attacks, and enforce our Acceptable Use Policy.

5. Data Retention Overview

We retain personal information only for as long as necessary to fulfill the purposes outlined in this policy or to comply with statutory legal mandates. Complete information on log retention periods, audit trails, and automatic deletion schedules is detailed in our dedicated Log & Retention Policy.

6. Your Data Rights (GDPR & KVKK Compliance)

If you are a resident of the European Economic Area (EEA), the United Kingdom, or the Republic of Turkey, you enjoy comprehensive legal rights regarding your personal data:

• Right of Access (GDPR Art. 15 / KVKK Art. 11): Request confirmation and an export copy of all personal data we hold about you.
• Right to Rectification (GDPR Art. 16): Request correction of inaccurate or incomplete personal details.
• Right to Erasure ("Right to be Forgotten", GDPR Art. 17): Request permanent deletion of your account, prompts, and personal data, subject to statutory logging obligations.
• Right to Restriction of Processing (GDPR Art. 18): Request limits on how your data is processed during disputes.
• Right to Data Portability (GDPR Art. 20): Receive your mod workspace blueprints and transaction receipts in a machine-readable JSON format.
• Right to Object (GDPR Art. 21): Object to processing carried out under our legitimate interests.

7. California Consumer Privacy Rights (CCPA / CPRA)

California residents have the right to know what personal information is collected, to delete personal information, and to opt out of the "sale" or "sharing" of personal information. ModStudio AI does not sell, rent, or trade your personal information or prompt histories to data brokers or advertisers.

8. Data Security & Encryption

We implement defense-in-depth security measures to protect user data from unauthorized access, alteration, disclosure, or destruction:

• Transport Security: All client-server and inter-service communications are strictly encrypted using TLS 1.3 with modern cipher suites.
• Database Protection: User credits and operational state are stored in Cloudflare D1 encrypted databases with strict per-user authorization boundaries.
• Authentication Defense: Access tokens utilize PKCE (Proof Key for Code Exchange) with short-lived access lifetimes (15 minutes) and revocable refresh tokens.

9. Cookies & Local Storage

We employ only essential functional storage mechanisms necessary to maintain user sessions and authenticate API requests:

• Session Storage / Local Storage: Used by Clerk and our desktop shell to store ephemeral authentication tokens and UI theme preferences.
• Analytics / Advertising Trackers: We do NOT embed third-party tracking pixels, marketing cookies, or invasive behavioral profiling tools.

10. Contacting Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact our Data Protection Officer:

ModStudio AI — Data Protection Office
Email: [email protected]
Postal Email: [email protected], USA