Privacy Policy (Datenschutzerklärung)

Updated: 2026-09-02

Version: 2026. Information pursuant to Art. 13 and 14 GDPR on the processing of personal data when using modwall.

1. Controller

Adam Koch, Weißensteinstr. 44, 58093 Hagen, Germany
E-mail: kontakt@modwall.dev, phone: +49 2334 4937304. Further details: Impressum.

No data protection officer has been appointed, as the requirements of § 38 BDSG are not met. Please direct enquiries to the e-mail address above.

2. Roles: controller and processor

For account, contract and billing data we are the controller. For content that customers submit for assessment via the API or widget (images, text) we act as a processor on behalf of the customer; the Data Processing Agreement applies in that case.

3. Images and text submitted for moderation

Submitted images are processed in memory only for the duration of the assessment and are not stored on any medium. We store only technical metadata and the result (timestamp, scores, decision, file size, key used); the content cannot be reconstructed from this data. Text is retained beyond the assessment only where the customer uses the review queue and the content has been referred to it.

Legal basis: Art. 6 (1) (b) GDPR (performance of the contract with the customer) or the customer's instruction within the meaning of Art. 28 GDPR.

4. Customer account and registration

We process the e-mail address, password hash, display name, language setting, selected plan and usage counters. Purpose: providing the account, allocating quotas, communication. Legal basis: Art. 6 (1) (b) GDPR.

5. Sign-in with Google

Signing in via „Sign in with Google“ is optional. Google then transmits a signed token containing the e-mail address, name and whether the address is verified. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Transfer to the USA by Google is possible; Google relies on the EU-US Data Privacy Framework and standard contractual clauses. The legal basis for using this feature is Art. 6 (1) (b) GDPR (sign-in method chosen by the user). Anyone wishing to avoid this can register with e-mail and password.

6. Billing and payment processing

For invoices we process company name, address, VAT identification number and the invoice items. Legal basis: Art. 6 (1) (b) and (c) GDPR (tax and commercial law obligations, including § 147 AO, § 257 HGB).

Payments are handled by an external payment service provider (currently Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland), which processes the data required for the transaction as a separate controller. Data may be transferred to Stripe, Inc. (USA); Stripe relies on standard contractual clauses and the EU-US Data Privacy Framework. We neither collect nor store payment card data.

7. Server log files

When the website is accessed, the IP address, time, requested resource, status code, volume of data transferred, referrer and user agent are logged. Purpose: operational security, troubleshooting, prevention of misuse. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure operation).

8. Hosting and backups

The application runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in German data centres; a data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.

Encrypted database backups are additionally kept in Hetzner Object Storage (data centre within the EU). In regular operation no transfer to third countries takes place. In self-hosted operation, content never leaves the customer's infrastructure at all.

9. E-mail delivery

Transactional e-mails (registration, password reset, quota and plan expiry notices) are sent via Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, the Netherlands, acting as a processor. We use the provider's EU data centre; access by group companies in third countries for support purposes is possible and is based on standard contractual clauses. Legal basis: Art. 6 (1) (b) GDPR.

10. Cookies

We use strictly necessary cookies only: session cookie, CSRF protection and the selected language. These are essential for operating the service and therefore do not require consent pursuant to § 25 (2) no. 2 TDDDG. We do not use advertising or analytics tracking and do not embed external ad networks.

11. Retention periods

Moderation logs are retained for 365 days by default, webhook delivery logs for 90 days. Audit log entries (the DSA diligence trail) are not deleted automatically. Account and billing data are stored for the duration of the contractual relationship and thereafter until statutory retention periods expire. Otherwise we delete data once the purpose ceases to apply.

12. Automated decision-making

The service produces automated assessments of content. Whether and with what consequences an assessment leads to a decision is determined solely by the customer as controller; we do not take automated decisions producing legal effects concerning data subjects within the meaning of Art. 22 GDPR. For borderline cases we provide a review queue for human decisions.

13. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6 (1) (f) (Art. 21 GDPR). Any consent given may be withdrawn at any time.

If your request concerns content submitted by a modwall customer, please contact that customer as the controller; we forward requests where we are able to attribute them.

14. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de. You may also contact the authority at your place of residence.

15. Changes to this notice

We adapt this notice when the service or the legal situation changes. The version published on this page applies.

Courtesy translation. The binding version is the German text (Deutsch), as the contract is governed by German law.