Privacy Policy

Data controller

Kai Helleweege Trading as Moderando Moorenplatz 6 40225 Düsseldorf Germany

Email: hello@moderando.com

See the Imprint for full legal details.

1. Data We Collect

We collect the following types of data:

• Account data: Your name, email address, and authentication information.
• Workspace and session content: Session briefs, generated facilitation plans, agendas, scripts, notes, and post-session reports that you create.
• Team invitations: Email addresses of invited team members and invitation status.
• Billing data: Payment information is handled by Stripe. We store your plan, subscription status, and usage counts, but not your credit card details.
• AI generation data: Your session inputs and generated outputs are sent to our AI provider (OpenAI) for processing to generate your facilitation plans and reports.
• Email and contact data: If you contact us, we receive the content of your message and your email address.

2. How We Use Your Data

Your data is used to provide the Moderando service: generating facilitation plans, managing your sessions, processing billing, and sending team invitations. We do not sell your data to third parties.

Legal bases for processing

We process personal data under the following GDPR legal bases:

• Performance of a contract: Account creation, session and workspace processing, AI generation of your requested outputs, billing and subscription administration, and team invitations — all necessary to deliver the service you requested.
• Consent: Analytics usage measurement and Google Ads advertising measurement — activated only after you explicitly consent through our cookie-consent system. You can withdraw consent at any time.
• Legitimate interests: Security measures, rate limiting, abuse prevention, and platform logging necessary to protect the service and our users.
• Legal obligation: Responding to privacy and data-protection requests, and retaining accounting or billing records where required by applicable law.

3. AI Processing

Moderando uses OpenAI’s API to generate session materials based on your session brief. Your session inputs — including goals, context, challenges, and notes — are processed by OpenAI to generate your plans and reports. AI requests are sent from a protected Base44 backend function to OpenAI, not directly from your browser. Please avoid entering unnecessary sensitive personal data. For details on AI processing and provider data-handling practices, see our Trust & Security page.

4. Data Storage

Moderando is built and operated using Base44 infrastructure for application hosting, database services, authentication, backend functions, email and platform analytics. Session content is private to your account or team workspace. Access is controlled through row-level security policies that prevent users from accessing data belonging to other accounts. Further details about data location and platform subprocessors are available from the infrastructure provider on request.

International data transfers

Some of our providers (Base44, Stripe, and OpenAI) may process personal data in countries outside the European Economic Area. Where this occurs, we rely on the safeguards provided by those providers under applicable data-protection law, which may include EU Standard Contractual Clauses or other lawful transfer mechanisms. For details on a specific provider’s transfer safeguards, please contact us.

5. Team Workspace Sharing

Team and workspace sharing features are only available on Team and Enterprise plans. Only members of your workspace can access shared sessions, reports, and exports. Team members cannot access data from other accounts or workspaces. When a team member is removed or the workspace plan is downgraded, shared access is revoked automatically.

6. Billing Data

Payments are processed by Stripe. We do not store your credit card information. We store your plan type, subscription status, billing period, and usage data for account management purposes.

7. Cookies and Analytics

Moderando uses necessary cookies and browser storage to operate the service. Optional analytics and marketing technologies are used only with your consent.

Cookie categories

• Necessary (always active): Authentication tokens stored in your browser’s local storage to keep you logged in. These are required for the service to function and cannot be disabled.
• Analytics (optional): If you consent, we collect limited usage information — such as which pages are viewed and which features are used — to understand and improve the product. Analytics only loads after you explicitly accept it.
• Marketing (optional): With your consent, we use marketing cookies for advertising measurement (Google Ads). This category is only activated after you explicitly accept it.

Third-party services

• Base44: Application hosting, database services, authentication, backend functions, email and platform analytics are provided by Base44 infrastructure.
• Stripe: Payment processing is handled securely by Stripe. When you subscribe or manage billing, you are redirected to Stripe’s domain, which may set its own strictly necessary cookies. We do not store your credit card details.
• OpenAI: Session inputs are sent to our AI provider to generate your facilitation plans. This is data processing, not tracking.

What analytics never tracks

Analytics events contain limited usage metadata, such as event names and basic contextual information. We never track session content, meeting notes, participant names, company details, generated plans, or any text you enter into the session wizard.

Managing your consent

You can change your cookie preferences at any time using the “Cookie settings” link in the footer. Your choice is stored with a timestamp and consent version, and you can withdraw consent at any time.

8. Security Measures

We implement security measures including authenticated private routes, row-level access controls, server-side authorisation, a centralised admin allowlist, rate limiting, and protected secrets. Despite these measures, no system is completely secure, and you should avoid entering highly sensitive personal data. For more detail, see our Trust & Security page.

9. Your Rights

Under the GDPR, where applicable, you have the following rights regarding your personal data:

• Access: Request a copy of your personal data.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your data, subject to legal retention obligations.
• Restriction: Request that we limit processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interests or for direct marketing.
• Data portability: Receive your data in a structured, machine-readable format.
• Withdrawal of consent: Withdraw consent for analytics and marketing at any time without affecting processing already carried out.
• Right to lodge a complaint: You have the right to lodge a complaint with your competent supervisory authority.

You can delete sessions and reports directly within the app. For access, rectification, deletion, export, or other rights requests, contact us.

10. Data Retention

• Live account and session data is retained for as long as your account is active, and removed when you delete it within Moderando.
• Account-deletion requests are processed on request; see the deletion and export section below.
• Infrastructure logs are generated by the Base44 platform during normal operation (for example, backend-function logs). Their retention is governed by the Base44 platform’s logging policies.
• Provider retention of data held by OpenAI, Stripe and Base44 is governed by each provider’s applicable contractual terms and account settings.
• Backups are managed by the infrastructure provider; backup retention is governed by the infrastructure provider’s policies.

11. Deletion and Export

Users may delete individual sessions within Moderando. Requests for account deletion or data export can be sent from the registered account email to hello@moderando.com.

12. Contact for Privacy Requests

Questions about privacy or data requests? Email hello@moderando.com or contact us. You can also read our Trust & Security overview and the Imprint.