The short version
- Analytics only run if you accept the banner. Decline and nothing is stored.
- The mailing list is double opt-in, carries a one-click unsubscribe, and we never sell or share the address.
- We ask for as little as we can get away with: an email address, and nothing else.
- You can have any of it deleted by writing one email to privacy@modalabflow.com.
1. Who is responsible for your data
The controller of the personal data described in this policy is Moda Lab Group ("Moda Lab Flow", "we", "us"), the company that operates this website and publishes the Moda Lab Flow platform.
| Registered entity | Moda Lab Group LLC |
| Registered address | 66 West Flagler Street - Suite 900, #5202, Miami, FL 33130 |
| Company number / VAT | 82-4365360 |
| Privacy contact | privacy@modalabflow.com |
| General contact | info@modalabflow.com |
We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. Privacy questions go to the address above and reach a person, not a queue.
2. What this policy covers
This policy covers the public website at modalabflow.com — the marketing pages, the product-updates mailing list, and the demo booking link.
It does not cover the data held inside a customer's Moda Lab Flow workspace. When a brand runs its business on the platform, that brand is the controller of its own sales, customer and supplier records; we act as its processor, and what we may do with that data is set by the contract and data processing agreement signed with that customer, not by this page. If you are an employee or a customer of a brand that uses Moda Lab Flow, direct your request to that brand — and if you are not sure who that is, write to us and we will point you to them.
3. What we collect, why, and on what legal basis
Four things, and only four. Every one of them is listed here with the Article 6 basis we rely on.
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Usage analytics Pages viewed, time on page, approximate country and city, device and browser, referring site, a Google Analytics identifier |
To see which parts of the site people actually read and whether they go on to book a demo, so we write less of what nobody reads | Consent — Art. 6(1)(a). Only after you press Accept. Nothing is stored if you decline or ignore the banner. | 14 months from the last visit |
| Mailing list Your email address, the date and IP of your signup and of your confirmation, and whether you opened or clicked an email |
To send occasional product-update emails, and to be able to prove your consent if anyone ever asks | Consent — Art. 6(1)(a), confirmed by a double opt-in. Withdrawable at any time. | Until you unsubscribe, plus 24 months of consent evidence |
| Demo bookings Name, email, and anything you type into the booking form |
To hold the meeting you asked for and to follow up on it | Pre-contractual steps at your request — Art. 6(1)(b) | 24 months from the last contact |
| Server logs IP address, timestamp, URL requested, status code, user agent |
To keep the site up and to investigate abuse or attack — logged by our host on every request, before any consent decision exists | Legitimate interest in the security and availability of the service — Art. 6(1)(f) | Up to 12 months, per our host's retention |
We do not collect special category data. We do not build profiles, we do not run advertising pixels, and no decision affecting you is made automatically.
4. Cookies and consent
The site loads no analytics or advertising storage until you accept. We use Google
Consent Mode v2, which sets analytics_storage,
ad_storage, ad_user_data and
ad_personalization to denied before any Google tag loads,
and only flips analytics storage on if you press Accept.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
mlf_consent_v1 |
Local storage — strictly necessary | Remembers your answer to the consent banner so you are not asked on every page. Set whether you accept or decline. | Until you clear your browser storage |
_ga, _ga_<id> |
Cookie — analytics | Google Analytics 4: distinguishes one visitor from another and holds session state. Only set if you accept. | Up to 2 years |
Changing your mind is one click. Use the Cookie preferences link in the footer of any page to reopen the banner and choose again. Declining after having accepted stops further collection immediately; to remove what was already collected, ask us using the contact details in section 8. Clearing your browser's cookies and site data for this domain removes both entries above and returns you to the default denied state.
5. Who else sees your data
We do not sell personal data, and we do not share it for anyone else's marketing. We do use a small number of service providers to run the site, each bound by a data processing agreement:
| Provider | What they do for us | Where |
|---|---|---|
| Aruba S.p.A. | Hosting and server logs | European Union (Italy) |
| Google Ireland Ltd. Google Analytics 4 |
Usage analytics, only after consent | EU, with onward transfer to the United States |
| Intuit Mailchimp The Rocket Science Group LLC |
Mailing list storage and delivery | United States |
| CalendarBridge | Demo scheduling — the booking page is theirs, and opens in a new tab | United States |
We may also disclose data where the law requires it, or to establish or defend a legal claim. If the business is ever sold or reorganised, data may transfer to the acquirer under this same policy; you would be told before anything about it changed.
International transfers
Mailchimp, CalendarBridge and Google's US infrastructure mean some personal data leaves the EEA. We are straight about this because it is the real cost of the tools we chose. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses together with the provider's supplementary measures. You can ask us for a copy of the relevant safeguards at any time.
6. How long we keep things
The per-item periods are in the table in section 3. The principle behind them: we delete when the reason for holding the data has expired, and we would rather hold less than argue about why we still hold more. Analytics data ages out automatically at 14 months. Mailing list addresses go when you unsubscribe, save for the minimum record needed to show your consent was validly obtained and later withdrawn.
7. How we protect it
The site is served over HTTPS. Access to the mailing list and to analytics is limited to the people who need it and protected by multi-factor authentication. Credentials are never committed to source control. This is a small operation and we do not pretend to certifications we do not hold — but nothing on this site collects data we could not afford to lose, which is itself a security measure.
No transmission over the internet is ever completely secure. If a breach happens that is likely to put your rights at risk, we will notify the relevant supervisory authority within 72 hours and tell you directly where the law requires it.
8. Your rights
Under the GDPR you can ask us to do any of the following, free of charge:
- Access — get a copy of the personal data we hold about you.
- Rectification — have anything inaccurate corrected.
- Erasure — have it deleted, where we have no overriding reason to keep it.
- Restriction — have us hold it but stop using it while a dispute is resolved.
- Portability — receive the data you gave us in a machine-readable form.
- Objection — object to processing we base on legitimate interest, including any direct marketing, which we then stop.
- Withdraw consent — at any time, without affecting what was lawful before you withdrew it. Unsubscribe links and the cookie preferences link both do this without needing to write to us.
Write to privacy@modalabflow.com. We answer within 30 days, and usually much sooner. We may need to confirm who you are before acting on a request — not to obstruct it, but so we do not hand your data to someone else.
If you are not satisfied with how we handled it, you have the right to complain to the data protection authority in the EU or EEA country where you live, work, or where you believe the issue occurred. We would rather you raised it with us first, but that choice is yours and nothing here limits it.
9. Children
This site sells business software to companies. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, write to us and we will delete it.
10. Changes to this policy
When we change how we handle data, this page changes with it, and the version and date at the top move. If a change materially affects you — a new processor, a new purpose, a longer retention period — we will say so on the site, and by email to the mailing list where consent is involved. Continuing to use the site after a change means the current version applies.
11. Contact
Privacy requests and questions about this policy:
privacy@modalabflow.com
Anything else: info@modalabflow.com