Privacy Policy

Last updated: October 5, 2026

MoDeck is operated by Steve Lewis, trading as MoDeck, at Sint Geertruidensteeg 10, 1012 PX Amsterdam, the Netherlands. Contact us at hello@modeck.io. This policy explains how we handle personal data through modeck.io, the browser editor at app.modeck.io, the MoDeck desktop application, our API and related support services (the "Service").

This policy provides information; using the Service does not, by itself, give consent to optional analytics, marketing or international data transfers. Where consent is required, it must be given separately.

Your Content: Ownership, No AI Training and No Harvesting

Your content remains yours. You and your licensors retain all ownership and intellectual property rights in your templates, projects, text, images, audio, video, fonts, source data, edits and resulting output. Using MoDeck transfers no ownership to us. We process customer content only to deliver, secure and support your requested workflows, follow your instructions and meet legal obligations.

Under no circumstances will MoDeck use customer content to train, fine-tune, test, evaluate, develop or improve any artificial intelligence or machine-learning model. We will not harvest, mine, sell or otherwise exploit it to build datasets, advertising profiles, market intelligence or other products for ourselves or anyone else. This also covers anonymised or aggregated versions, extracts and other data derived from customer content, and content supplied in support requests.

We will not authorise service providers to use customer content for these purposes. Providers processing it on our behalf must be bound by the same restrictions, with any necessary data-use opt-outs in place. Optional speech and transcription features use existing models to fulfil your request; they do not give permission to train on your content. These protections apply to every plan, require no customer opt-out and continue for any retained copies after account closure.

The account, security, billing and usage information described below is separate from reusing customer content. Analytics consent, feedback or general service-improvement purposes do not override these protections.

Our Role and Your Template Owner's Role

We act as a data controller for account administration, billing, security, support and our own service analytics. This means we determine why and how those personal data are used.

When a customer uses MoDeck to process personal data in templates, media, spreadsheets, edits or rendered output on their behalf, that customer normally determines the purposes of the processing and we act as their processor. A customer may itself act for another organisation. Processing on a customer's behalf requires a separate data-processing agreement; this Privacy Policy is not that agreement. Contact us about the arrangements needed for your organisation.

If you were invited to a template or opened a Magic Link, the template owner controls its sharing settings, render machines and use of your submissions. Their privacy notice may also apply. You can contact that owner about their use of your content, or contact us and we will help identify the appropriate party.

Personal Data We Collect

We receive information from you, from template owners who invite you or provide data, from connected render machines, and from the authentication, billing and other services you use with MoDeck. The information depends on the features you use.

Account and contact details: name, email address, password verification data, account status, permissions, notification and privacy preferences, and optional team-profile answers. Google sign-in supplies account identification, name and email details; it does not give MoDeck access to your Google contacts or general account activity. Organisation sign-in can supply your identity and organisation through its identity provider.
Subscription and transaction details: plan, subscription and customer identifiers, licence details, payment status and transaction records. Stripe handles payment details entered in its checkout; MoDeck's application does not receive or store your full payment-card number. If you use an aescripts licence, we send its licence code for validation and receive its entitlement status.
Template and editing data: template names, editable controls and their default values, thumbnails, preview images or clips, edit values, media, spreadsheet and other source data, transcripts, generated speech, rendered output, sharing settings and render history. These can contain personal data about you or other people. Data-source addresses and credentials you configure for a workflow can also be stored and passed to the render machine.
Guest and collaboration details: invitations, assigned email addresses, template access, a visitor identifier for Magic Link sessions, and an email address if the template owner requests one. Guest use does not necessarily require a MoDeck account.
Technical and operational information: IP addresses and connection information, browser and operating-system information, application versions, render-machine identifiers, job status, timestamps and error logs. Infrastructure providers also process connection information to deliver and protect the Service.
Support communications: messages and files you provide and desktop logs submitted using "Submit error logs" or retrieved through an authorised MoDeck support request to a connected app. Those logs can include local file paths, template or edit names, errors and information involved in a failed operation.

Account identification and authentication data are needed to create and secure an account; billing data are needed for a paid subscription. Requested content and connection data are needed to run the relevant workflow. If you do not provide required data, we may be unable to provide that feature. Optional profile answers, Google Analytics and marketing are not required to use the core Service.

Local Files and Cloud Processing

The desktop app reads templates from your configured sync folder and sends template metadata, including editable values and thumbnails, to MoDeck. The normal template sync does not upload the source MOGRT or After Effects project files. It does not mean that all information in a template stays on your computer: editable text, thumbnails and previews can reveal content from those files.

Fresh previews and renders run on a connected render machine operated by the template owner. Edit data and replacement media are made available to that machine. Uploaded media and enabled render uploads use cloud storage; saved edits, source datasets and job records are held by the Service. Turning off completed-render uploads does not turn off these other data flows.

Font collection reads font information and matching local files, and copies collected fonts locally. Normal font sync sends font names, file identifiers and inventory metadata, not font files or their absolute source paths. Local caches, batch recovery files and optional preview diagnostic reports may contain customer data. Preview diagnostic reports remain local unless you separately share them; "Submit error logs" does not attach those reports.

How We Use Personal Data

For processing where we are the controller, the purposes and GDPR legal bases are:

Providing the Service: account access, subscriptions, sharing, job coordination and support are necessary to perform our contract with you. Where you act for a customer organisation, we rely on our legitimate interest in administering that relationship and providing the requested service.
Security and reliability: preventing abuse, investigating errors, maintaining the Service and handling disputes serve our legitimate interests in a secure, reliable business and protecting users. We must balance those interests against your rights.
Legal compliance: retaining required financial records and responding to binding legal requests are based on our legal obligations.
Optional analytics: Google Analytics uses your consent. Basic usage totals are described separately below; any associated personal-data processing must be limited to our legitimate interest in understanding service use.
Marketing: consent where required, or the limited existing-customer exception where the law permits messages about our own similar services with an opportunity to opt out.

For customer content processed on behalf of a template owner, we follow the customer's lawful instructions. The customer is responsible for establishing the legal basis for their use of that content and informing the people concerned.

Cookies, Browser Storage and Analytics

Necessary Storage and Security Services

The MoDeck login cookie keeps you signed in and is configured to last up to 30 days, subject to renewal or earlier invalidation. Browser session storage keeps Magic Link access details and a visitor identifier for the relevant browsing session. The desktop app stores local settings, caches and protected sign-in credentials. Blocking necessary storage may prevent sign-in or shared-template access.

The browser app loads Google reCAPTCHA to help protect authentication against abuse. Google receives device, network and interaction information and may use cookies for this security service. This is separate from Google Analytics. See Google's Privacy Policy and Terms of Service.

Google Analytics

With your permission, we use Google Analytics to understand how people find and use MoDeck, including our public website and browser editor. We associate activity with an internal account identifier to measure account creation, desktop setup, template and render milestones, and confirmed subscriptions. Optional team-profile answers help us understand which workflows MoDeck serves.

This includes pseudonymous browser and account identifiers, broad feature-use events, transaction or render correlation identifiers, and consented acquisition information. We do not send names, email addresses, licence keys, template content or access tokens as analytics fields. Advertising signals and ad personalisation are disabled in our implementation. Pseudonymous analytics are not the same as anonymous information.

Google Analytics remains off until you choose "Allow analytics". Magic Link editor visits keep Google Analytics off. You can change your account choice in Account settings under Privacy. Signed-in choices are saved to your account and apply on later signed-in visits. Otherwise, the choice is saved in this browser for up to six months. A separate acquisition cookie, used only after consent, can also last up to six months. Google Analytics uses its own identifier cookies, such as cookies whose names begin with "_ga".

Declining stops future Google Analytics collection and removes our Google Analytics and acquisition cookies; it does not erase information already collected. If you are not signed in, you can reset your browser choice by clearing MoDeck site cookies and choosing "Decline analytics" when you next visit. Clearing cookies does not change an existing account preference. You can also contact us about withdrawing consent or deleting analytics data. Necessary account, billing and rendering records are maintained separately.

For more information about Google's processing, see the Google Privacy Policy.

Basic Usage Totals

Separately from Google Analytics, MoDeck counts page views and selected actions, such as downloads, pricing interactions and editor use. These totals include visitors who decline Google Analytics. We keep counts by day and broad category for up to 90 days to understand and improve the Service. The counter does not keep individual activity records, identify visitors, follow their journeys, personalise advertising or link counts to account and billing records.

Counting requests do not send cookies, account details, page addresses, referral addresses or project content. Our counter does not store IP addresses or browser details. Network providers necessarily process connection information to deliver requests; infrastructure logs are separate from these totals. The totals are kept by MoDeck and are not sent to Google.

Who Receives Personal Data

Template owners and authorised participants: owners can administer their templates and access associated edits and submissions. Content is made available according to the relevant sharing settings and to the owner's render machines. Treat Magic Links and download links as confidential: someone who receives a usable link may be able to access the material it permits.
Hosting and storage providers: Amazon Web Services and the providers delivering our websites, application infrastructure and databases process the information needed to host, store and deliver the Service.
Billing providers: Stripe processes checkout and subscription payments. aescripts processes purchases made through its store and licence validation. Those providers also have their own responsibilities for payment, fraud prevention and legal compliance. See Stripe's Privacy Policy and aescripts' Privacy Policy.
Google and organisation identity providers: sign-in providers receive authentication requests. Google also provides reCAPTCHA, consented analytics, email delivery and relevant data or speech integrations.
Email and support providers: Google email services carry transactional and support messages. Mailchimp receives contact details and subscription preferences to manage the mailing list. Its processing is described in the Intuit Privacy Statement. If you contact us on Discord or social media, that platform also processes your messages under its own notice.
Speech providers, when used: text-to-speech sends the selected text and voice settings to Amazon Polly or Google Cloud Text-to-Speech. Transcription sends the relevant audio to Amazon Transcribe. Resulting audio or transcripts are returned to the workflow and may be stored with its content.
Integrations you configure: Google Sheets, remote data and media sources, webhook destinations and notification recipients receive the requests or information needed for the configured workflow. Your chosen services and recipients control their own copies and processing.
Legal and business recipients: we may disclose necessary information to professional advisers, authorities or other parties when legally required or necessary to protect rights, investigate abuse or handle a business transfer. Any transfer of the business remains subject to applicable data-protection requirements.

Our disclosures are for the purposes described in this policy, not a general permission for business partners to market to you. Where a provider processes personal data on our behalf, data-protection law requires appropriate contractual restrictions, including the customer-content restrictions above. Independent providers' privacy notices explain their own processing; they do not replace our responsibilities or permit providers acting on our behalf to train on or harvest customer content.

Email Marketing and Social Media

You can unsubscribe from marketing using the link in an email, change your mailing-list preference in Account settings, or contact us. This does not stop necessary security, account, billing or requested job notifications. Creating an account or accepting our Terms does not itself constitute marketing consent.

If you visit our Facebook page, Meta processes information about your visit and may provide us with page statistics. For Page Insights processing covered by Meta's joint-controller arrangement, MoDeck and Meta Platforms Ireland share the responsibilities described in the Page Insights Controller Addendum. See Meta's Privacy Policy for its data practices and rights channels. You may also direct questions about our page to us.

International Processing

MoDeck is operated from the Netherlands and uses providers that process personal data outside the European Economic Area, including in the United States. Our storage and Amazon speech integrations are configured for the US East region. The location of a template owner's render machine and their chosen integrations also affects where customer content is processed. We do not promise storage exclusively in the EU.

Transfers subject to GDPR must have a valid legal mechanism, such as an applicable adequacy decision or the European Commission's Standard Contractual Clauses with any necessary supplementary safeguards. Agreement to this policy is not a substitute for those safeguards. Contact hello@modeck.io to request details of the locations and safeguards applicable to your processing, including a copy of relevant safeguards with unrelated confidential information removed.

Retention and Deletion

Account, template and edit information is generally kept while needed to provide the Service and the workflows you or the template owner maintain. Subscription cancellation, uninstalling the desktop app or ceasing to use MoDeck does not itself delete an account or its content. You can use available content-deletion controls or contact us to request account closure or erasure.

We assess retention according to the purpose and type of data, whether an account or job is active, the need to investigate a specific fault or dispute, and legal record-keeping requirements. Dutch basic accounting records generally must be retained for seven years; particular tax records may require longer retention. Support and security records may need to remain while a related issue or legal claim is being handled.

Basic usage totals expire after 90 days. Browser privacy-choice and acquisition cookies last up to six months; account privacy preferences remain until changed or the account is removed. Operational and analytics delivery records have separate purposes and retention requirements; declining analytics stops sending new Google events but does not delete existing records automatically.

Deletion must also address retained object versions and any applicable backups, subject to lawful retention requirements. Copies downloaded by recipients, local render output, caches and recovery files on a render machine do not disappear when cloud content is deleted. The person operating that machine or holding those copies controls their removal. Ask us if you need help coordinating a deletion request.

Security

MoDeck uses access controls, protected connections, password hashing and time-limited storage links as part of protecting data. No service can guarantee absolute security. Protect your account credentials, API keys, Magic Links and render machines, and contact us promptly if you suspect unauthorised access.

Your Privacy Rights

Under GDPR, subject to its conditions and exceptions, you can request access to and a copy of your personal data, correction, erasure, restriction of processing and portability. You can object to processing based on legitimate interests and always object to direct marketing. You can withdraw consent at any time without affecting processing that was lawful before withdrawal. Declining optional analytics or marketing does not remove access to the core Service.

Email hello@modeck.io to exercise these rights. We may request proportionate identity or authority verification. We normally respond within one month; where permitted for complex or numerous requests, we may take up to two additional months and will explain the extension within the first month. Requests are normally free. We will explain any lawful refusal and your options to challenge it.

You can complain to the Dutch Autoriteit Persoonsgegevens or the supervisory authority where you live, work or believe an infringement occurred. You do not have to contact us first. For data we process on a customer's behalf, we assist that customer with rights requests.

MoDeck's render rules automate content production. We do not use that feature to make decisions about people with legal or similarly significant effects. If a customer uses its own data or rules to make such decisions, it is responsible for the applicable safeguards and explanation.

California and Other US State Rights

Where applicable state privacy law covers our processing, you may have rights to know and access the personal information we hold, correct it, delete it, obtain a portable copy and opt out of sale, sharing for cross-context behavioural advertising or certain profiling. Additional rights concerning sensitive information or appeals apply where the relevant law provides them. We will not unlawfully discriminate against you for exercising these rights. You or an authorised agent can contact us at the email address above.

The categories, sources, purposes, recipients and retention criteria are described in this policy. They include identifiers, commercial records, network activity and customer-supplied text, images, audio and video; they are not limited to contact details. We do not operate an advertising data-sales programme, and MoDeck's Google Analytics implementation disables advertising signals and personalisation.

California access, correction and deletion requests are generally answered within 45 days, with an extension and notice where permitted. Sale or sharing opt-outs do not require identity verification. Global Privacy Control communicates a sale or sharing opt-out where the law requires it; it is different from the older "Do Not Track" signal, which does not automatically change MoDeck's analytics preference. Contact us about an opt-out or use the analytics choices described above.

Children's Privacy

MoDeck accounts and use of the Service are intended for people aged 18 or over, consistent with our Terms and Conditions. We do not knowingly register children as users. If you believe a child has provided information directly to us, contact us so we can investigate and take appropriate action. A customer's inclusion of children's information in media or other content is a separate processing activity for which that customer must have a lawful basis and appropriate safeguards.

Changes to This Policy

We will update this page and its revision date when our practices change. For material changes, we will give a prominent notice or contact affected users before the changed processing begins. We will obtain fresh consent where required; publishing an updated policy does not replace that requirement.

Contact Us

Steve Lewis, trading as MoDeck
Sint Geertruidensteeg 10, 1012 PX Amsterdam, the Netherlands
hello@modeck.io