Privacy Policy

This Privacy Policy (hereinafter: the "Policy") describes the processing of personal data in connection with:

• the Modri website at https://modri.io (hereinafter: the "Website");
• the Modri web application (hereinafter: the "Application");
• the Modri Chrome extension (hereinafter: the "Extension").

Capitalized terms not defined in this Policy have the meaning given in the Terms of Service.

Personal data controller

Your personal data controller is GC Ventures sp. z o.o. with its registered office in Kraków (Aleja Powstania Warszawskiego 15, 31-539 Kraków), KRS: 0001001861, NIP: 6751773409, REGON: 523642185, share capital PLN 5,000.00 paid in full (hereinafter: the "Controller").

Important — Workspace candidate data: when you store candidate / contact records in a Workspace (including via the Extension), your organization (the Service Recipient) is typically the controller of that content, and GC Ventures acts as processor under the Entrustment Regulations attached to the Terms. This Policy still describes that processing for transparency.

Important — payments: paid subscriptions purchased through Creem checkout are sold by Creem as Merchant of Record. Creem processes payment and billing data for that transaction as an independent controller under Creem’s own privacy notice. See Payments (Creem) below.

Contact with the Controller

In all matters related to the processing of personal data, you may contact the Controller by e-mail at: hello@modri.io.

Personal data protection measures

The Controller applies organizational and technical safeguards to protect personal data and processes it in accordance with Regulation (EU) 2016/679 (GDPR), the Polish Act of 10 May 2018 on the Protection of Personal Data, and other applicable data-protection law.

Chrome Web Store Limited Use {#chrome-web-store-limited-use}

Modri’s use and transfer of information received through the Chrome Extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

In particular, information received through the Extension (including profile identifiers / URLs and other user data described in this Policy) is used only to provide and improve Modri’s single purpose: collaborative sourcing memory for signed-in workspace members on supported LinkedIn and Google Search pages.

Modri does not:

• use or transfer Extension user data for personalized advertising, or to determine credit-worthiness or for lending;
• sell Extension user data, or transfer it to advertising platforms, data brokers, or information resellers;
• use Extension user data for advertising scoring or ad personalization.

Transfers of that data are limited to what is necessary to provide or improve that single purpose (including infrastructure processors listed below), to comply with law, to protect against abuse, or as part of a merger, acquisition, or sale of assets after obtaining any consent required by the Chrome Web Store User Data Policy.

Information on personal data processed

Use of the Website, Application, and Extension may involve processing of personal data. Below you will find purposes, legal bases, retention, and whether providing data is voluntary or required.

Account and Service Agreement (Application / Extension)

Providing the above data is voluntary, but necessary to conclude and perform the Service Agreement (including creating an Account). Failure to provide it prevents Account creation / paid Service use.

The Controller will process the above data until claims arising from the Service Agreement become time-barred (and longer where tax or accounting law requires).

Workspace candidate / contact content (processor role)

The Service Recipient decides what candidate data to store. Do not enter special-category data (Art. 9 GDPR) or criminal-conviction data (Art. 10 GDPR) into the Application.

Chrome Extension — profile identifier / URL (web browsing activity)

When a signed-in User opens a supported LinkedIn profile (linkedin.com/in/{slug} or a country-host equivalent) or a Google Search results page that lists such profiles, the Extension transmits the current supported profile identifier / canonical LinkedIn URL (and, where available, the LinkedIn profile id) to Modri servers solely to retrieve Workspace context for that profile (for example whether the person is already in the Workspace, and their status / position).

Google treats that URL / domain as web browsing activity. It is not used for advertising, scoring, or any purpose other than retrieving or updating Workspace context for the signed-in User’s Workspace.

Name, headline, and photo URL are transmitted when the User confirms a save or update. The Extension does not create a Workspace contact merely by opening a profile.

Chrome Extension — local visit timestamps

Clearing browser history, site data, or uninstalling the Extension removes this local functionality.

Chrome Extension — page reads

The Extension may read information from pages you open (LinkedIn profiles and Google Search results) to render the Modri UI and to save Workspace fields you choose to update. It does not bulk-scrape LinkedIn in the background or upload full page HTML as a product feature. Modri session tokens are stored in extension storage so you can stay signed in.

Handling complaints

Providing the data is voluntary but necessary to receive a response and exercise related rights.

Retention: for the duration of the complaint procedure and until related rights expire.

Service / product e-mail notifications

Voluntary but necessary to receive those notifications. Retention until effective objection or achievement of the purpose (whichever occurs first), subject to legal retention duties.

Handling enquiries

Voluntary but necessary to receive a response. Retention until effective objection or achievement of the purpose (whichever occurs first).

Tax and accounting obligations

Voluntary but necessary for the Controller to fulfill tax duties. Retention: typically 5 years from the end of the year in which the tax payment deadline for the previous year expired (or longer if required by law).

Fulfillment of data-protection obligations

Voluntary but necessary to properly exercise GDPR rights. Retention until time-barring of claims for breach of data-protection rules.

Establishment, assertion, or defence of claims

Retention until time-barring of claims that may arise in connection with Agreements concluded with the Controller.

Website / Application operation and security

This processing is inherent in using the service. Server logs are kept as needed for security and diagnostics. First-party product events are not used for advertising. Where you consent to analytics cookies, the same events may also be sent to Google Analytics 4 (see below).

Analytics (Google Analytics 4)

Google LLC acts as processor for this measurement. Analytics cookies and the gtag.js script are loaded only after you accept analytics.

Payments (Creem Merchant of Record) {#payments-creem}

Paid Team subscriptions are purchased through Creem (Armitage Labs OÜ), which acts as Merchant of Record. At checkout you buy from Creem. Creem:

• collects the payment;
• calculates, collects, and remits applicable VAT / sales tax / other indirect taxes;
• issues the invoice in its own name;
• provides the Customer Portal (payment method, invoices, cancellation);
• handles transaction refunds and chargebacks.

For that payment transaction, Creem processes personal data as an independent controller under Creem’s privacy notice and Buyer Terms. GC Ventures receives from Creem the subscription status, seat quantity, customer / subscription identifiers, and related events needed to provision and entitle the Workspace.

Recipients of personal data

The following categories of third parties working with the Controller may be recipients of personal data:

1. hosting / infrastructure providers (currently Vercel for application hosting);
2. database / authentication providers (currently Supabase);
3. Merchant of Record / billing provider (currently Creem — independent controller for the payment transaction; processor or recipient of subscription-status data needed to run the Application);
4. transactional e-mail providers (currently Resend, for invitations, billing, and security messages);
5. accounting service providers;
6. providers of intermediary login services (in particular Google);
7. website analytics providers (currently Google Analytics 4 / Google LLC, only after you consent to analytics cookies);
8. other processors needed to deliver the Services, engaged under the Entrustment Regulations where they process Workspace candidate data.

In addition, personal data may be transferred to public or private entities if required by generally applicable law, a final court judgment, or a final administrative decision.

A current list of material sub-processors for Workspace candidate data (processor role) is:

Intended changes to this list are handled as described in Appendix 1 to the Terms (prior notice and right to object). A copy is also available on request at hello@modri.io.

Transfer of personal data to a third country

In connection with the Controller’s use of services provided by Vercel, Supabase, Google LLC, Creem, and potentially other providers, personal data may be transferred to third countries, including in particular: the UK, Canada, USA, and other countries where those providers operate.

The basis for transfer may include:

• European Commission adequacy decisions (including for the UK, Canada, Israel, Japan, South Korea, and the EU–US Data Privacy Framework for certified US organizations, as applicable);
• Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914, with supplementary measures where required.

You may obtain information about safeguards for a specific transfer from the Controller.

Rights

In relation to the processing of personal data, you have the following rights:

1. the right to be informed which personal data pertaining to you are processed by the Controller and to receive a copy of such data (right of access). The first copy is free of charge; for subsequent copies the Controller may charge a fee;
2. the right to request rectification if data are outdated, incomplete, or otherwise incorrect;
3. in certain situations, the right to request erasure, e.g. when:
   • the Controller no longer needs the data for the purposes communicated;
   • you have effectively withdrawn consent — unless another legal basis applies;
   • the processing is unlawful;
   • deletion is required by a legal obligation on the Controller;
4. where processing is based on consent or on a contract with you, the right to data portability to another controller;
5. where processing is based on consent, the right to withdraw consent at any time (withdrawal does not affect prior lawful processing);
6. the right to restriction of processing in the cases provided for by GDPR;
7. the right to object to processing based on the Controller’s legitimate interests; if the objection is successful, the Controller will stop that processing;
8. the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) if you consider that processing violates the GDPR.

For Workspace candidate / contact data, contact your Workspace organization (controller) first; GC Ventures will assist as processor under the Terms.

For payment / invoice data processed by Creem as Merchant of Record, you may also exercise rights toward Creem under Creem’s privacy notice.

Cookies and similar technologies

1. The Website / Application uses cookies and similar technologies that are necessary to sign in, keep a session, store preferences (for example theme), and secure the service. These are first-party cookies / storage of the Controller.
2. The Extension stores the Modri session and Extension preferences in extension storage (not classic website cookies).
3. With your consent, the Controller also uses Google Analytics 4 (gtag.js) to measure page views, traffic sources, and product events. Analytics cookies are not set and the Google script is not loaded until you choose Accept in the cookie notice. The Controller does not use advertising cookies or a marketing pixel.
4. Where a cookie notice is displayed, you can accept analytics or continue with essential cookies only. Essential cookies cannot be disabled if the service is to work correctly.
5. Data collected through cookies alone may not always allow the Controller to identify you, but may be combined with Account data.

6. Through most browsers you can view, delete, or block cookies. Disabling or restricting cookies may limit Website / Application functionality (e.g. repeated login, slower loading, limited features).

Final provisions

1. To the extent not covered by this Policy, generally applicable data-protection regulations apply.
2. This Policy is related to the Terms of Service.
3. This Policy is effective as of 18.08.2026.