Privacy policy

Last updated: 4 October 2026

1. Controller

• Owner: Maria José Cantero
• Tax ID (NIF): 46779840W
• Address: Migdia 49 1 08788 BCN
• Privacy contact: hola@moduara.com

2. Data and purposes

• Account: name, email, password (stored using irreversible encryption), business name and workspace role. To create and manage your account, verify your email and send service notices (confirmation, trial expiry, billing). Legal basis: performance of the contract.
• Billing: name, address, tax ID if supplied and payment history. Stripe handles card details directly; we cannot see them. To charge for the service, issue invoices and meet tax and accounting obligations. Legal basis: contract and legal obligation.
• Content: text, images, logos and other material you upload or generate for your websites. To host, edit and publish them. Legal basis: performance of the contract.
• AI data: your business description, instructions and reference images, if uploaded. To generate websites, pages and sections when you use AI features. Legal basis: performance of the contract.
• Technical data: IP address, browser, access and error logs, and encrypted IP fingerprints for limiting attempts. For security, fraud and abuse prevention (including misuse of the free trial), and troubleshooting. Legal basis: legitimate interest.

We do not make automated decisions with legal effects on you or create profiles for commercial purposes. We send marketing communications only with your express consent.

3. Providers processing data on our behalf

• Cloudflare, Inc.: hosting the application, databases, files and published websites, delivering service emails and protecting against attacks.
• Stripe Payments Europe, Ltd.: payments, subscriptions, invoices and tax calculation.
• OpenAI, L.L.C.: AI content generation using data you provide. Under its business terms, it does not use this data to train its models.
• Pexels: stock-photo searches. It receives only generic search terms, not personal data.

Some providers may process data outside the European Economic Area, mainly in the United States, using appropriate safeguards: the EU–US Data Privacy Framework or standard contractual clauses approved by the European Commission.

We disclose data to authorities only when legally required.

4. Retention

• Account data and content: while your account is active. After closure, we delete them within a reasonable period, except where retention is legally required.
• Billing data: as required by tax and commercial law, generally up to 6 years.
• Technical and security logs: as needed for their purpose, normally no more than 12 months.

5. Your rights

Request access, rectification, erasure, objection, restriction of processing or portability by emailing hola@moduara.com from your account email. We reply within one month. If you believe your request was not properly handled, complain to the Spanish Data Protection Agency (www.aepd.es).

6. Cookies

Moduara uses only essential technical cookies, such as the session cookie keeping you signed in. We use no advertising or third-party analytics cookies, so these cookies require no consent.

7. Visitors to hosted websites

When a customer publishes a website, the customer is the controller of visitors’ personal data, such as contact-form submissions, and Moduara is their processor. In this role, Moduara:

• processes data only to provide the service (hosting, receiving, storing and forwarding form submissions), following the customer’s instructions;
• applies appropriate security measures and requires confidentiality from those with access;
• uses the providers in section 3 as subprocessors;
• if the customer enables third-party analytics or advertising (Google Analytics, Google Tag Manager or Meta Pixel), displays a consent banner, loads those tools only after acceptance and retains each choice for 24 months as evidence (random identifier, choices, date, browser and encrypted fingerprint of the IP network); the customer can download this record;
• helps customers fulfil data-subject rights and promptly notifies them of security breaches;
• deletes or returns data when the service ends, unless retention is legally required.

Website visit statistics use no cookies: they use an encrypted fingerprint of the IP and browser that changes daily, cannot identify the visitor and is deleted after 90 days.

Customers choose and configure third-party analytics and advertising tools. Google and Meta process data under their own terms; customers must inform visitors. Moduara generates a cookie policy at /cookies on each website listing cookies of enabled tools. Third-party videos and maps (YouTube, Vimeo, OpenStreetMap) load only when visitors click them.

If you visited a hosted website and wish to exercise your rights, contact its owner, identified on that website.

8. Changes

We notify you by email or in the dashboard before material changes to this policy take effect.

Moduara statistics

On moduara.com and in the dashboard we count page views, clicks and service actions using aggregate statistics. These include approximate IP-based location (country, region and city), device type, source and campaign parameters present on the page. We store no IP in these statistics, use no analytics cookies or persistent visitor identifiers and reconstruct no individual histories. We respect Do Not Track. Counters are retained for 13 months. Business sector is optional. Purchase records and operational notices are managed separately to provide and administer the service.