Privacy Policy
Last updated: 2026-08-06
1. Data controller
The controller of your personal data is ADMAVEN LTD (trading as ModDrip), a company registered in England and Wales (No. 17382767), registered office: Suite 11082, 5 Brayford Square, London, E1 0SG, United Kingdom. Contact: support@moddrip.com.
This policy is drafted in accordance with the UK GDPR and the Data Protection Act 2018.
2. What data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | email address, hashed password, preferred language, plan | you |
| Content | photos you upload, generated images, prompts you type | you |
| Transaction data | plan purchased, credit movements, payment status (we never store full card numbers — payments are processed by Stripe) | you / Stripe |
| Usage data | generations requested, feature usage, timestamps | automatic |
| Technical data | IP address, device/browser type, cookies (see Cookie Policy) | automatic |
| Support data | messages you send via the contact form | you |
3. Purposes and lawful bases
| Purpose | Lawful basis (Art. 6 UK GDPR) |
|---|---|
| Providing the Service (accounts, generations, storage) | Contract |
| Processing payments and subscriptions | Contract; legal obligation (accounting) |
| Fraud prevention, rate limiting, abuse detection | Legitimate interests |
| Service communications (confirmation, receipts, important notices) | Contract |
| Product analytics (only after you consent to analytics cookies) | Consent |
| Responding to support requests | Legitimate interests / contract |
We do not sell your personal data and we do not use your photos or generated images to train AI models.
4. Processors and sub-processors
We share data with processors only as needed to run the Service:
- Supabase (hosting, authentication, database, file storage)
- fal.ai (AI image processing — your uploaded photo is transmitted to generate the preview you request)
- Stripe (payment processing)
- Vercel (web hosting/CDN, once deployed)
- Resend (transactional email, if enabled)
5. International transfers
Some providers process data outside the UK (including the United States). Where that happens we rely on safeguards recognised by UK law, such as the UK International Data Transfer Agreement/Addendum or adequacy regulations, together with the providers' own certifications and contractual commitments.
6. Retention
- Account data: for the life of your account and up to 30 days after deletion.
- Photos and generated images: until you delete them or your account is deleted.
- Transaction records: up to 6 years (UK accounting and tax obligations).
- Contact messages: up to 24 months.
- Server logs: up to 12 months.
7. Your rights
Under UK GDPR you have the right to: access your data; rectify inaccurate data; erase your data; restrict or object to processing; data portability; and withdraw consent at any time (where processing is based on consent). To exercise any right, email support@moddrip.com. We respond within one month.
You also have the right to complain to the UK supervisory authority: the Information Commissioner's Office (ICO) — ico.org.uk.
8. Security
Data is encrypted in transit (TLS) and at rest by our hosting providers. Access to production data is limited and authenticated. Photos and generated images are stored in private buckets accessible only to your account.
9. Children
The Service is not directed at children under 16 and we do not knowingly process their data.
10. Changes
We will post any changes here with an updated date and, for material changes, notify you in the app or by email.
Referral & share measurement
When you share a public build link, we count unique visitors to reward you with credits. To do this in a privacy-preserving way, we store only an irreversible, daily-rotating salted hash of a visitor signal (never your raw IP address or a device fingerprint). These hashes cannot be reversed to identify anyone and are automatically deleted after 30 days.
Analytics retention
We record privacy-safe first-party product events (page views and key actions) to improve the service. These events do not store your raw IP address, and are automatically deleted after 90 days.