Privacy policy

1. Controller

Felix Cozmolici, sole proprietorship, Brentanostraße 8, 30625 Hannover, Germany. Email: hello@imodelly.com. Phone: +49 172 4239611.

2. Website visits and technical data

The public website is hosted by Vercel. When you visit it, Vercel may process technical data necessary to deliver and protect the service, such as IP address, date and time, requested page, browser, device and security logs. The legal basis is our legitimate interest in providing a secure and stable service under Article 6(1)(f) GDPR.

Creator applications are submitted from the browser to Imodelly’s protected Supabase Edge Function over HTTPS. Supabase validates the submission and stores accepted application records and private portfolio photos. Vercel hosts the public interface but is not used as the persistent creator-application database or photo store.

3. Creator application data

When you submit a creator application we may process: creator name, contact method and contact details, country, languages, stated age and adult-age confirmation, social and creator profiles, platforms used, content level and style, face visibility, content language and frequency, optional phone/camera information, whether content is already prepared and its approximate amount/type, agency experience and contract status, availability, voluntary revenue information, requested services, goals, promotion preferences, voluntary boundaries, verification readiness, consent records, submission date and application reference.

We use these data to handle the application, contact you, assess suitable management options, prevent abuse, document decisions and prepare possible introductions. Handling your request and pre-contractual steps rely on Article 6(1)(b) GDPR; security, fraud prevention and documentation rely on Article 6(1)(f) GDPR; consent-based processing relies on Article 6(1)(a) GDPR where stated.

4. Agency application data

When an agency applies for review, we may process its trading and legal name, website or profile, country, contact person, business email and messaging handle, operating history, team size, approximate creator count, languages, services, commission and cost information, contract terms, account-access and recovery practices, creator-boundary handling, data-security practices, public references or proof, confirmations, application date, reference and internal review information.

We use those data to assess a prospective agency partner, verify claims, prevent abuse, contact its representatives and document review decisions under Articles 6(1)(b) and 6(1)(f) GDPR.

5. Private photos

The creator application allows two to five recent, non-explicit photos. Submitted photos are stored in a private Supabase bucket, are not published, indexed or sold, and a specific agency may receive them only after the creator approves that introduction. Do not upload nude or explicit media, identity documents, banking data, passwords or private third-party messages.

The legal basis for storing and reviewing these photos is your consent under Article 6(1)(a) GDPR. You may withdraw consent for future processing and request deletion.

6. Potentially sensitive information

Questions about content level and boundaries are used to avoid unsuitable opportunities. We do not need graphic details about sex life, sexual orientation, health or other private matters. If an answer voluntarily contains information qualifying as a special category of personal data, processing is limited to the requested review and matching and is based on explicit consent under Article 9(2)(a) GDPR.

7. Consent records

To demonstrate what was accepted, we store required consent states, the applicable consent-text version and consent timestamps together with the submitted application.

8. Temporary storage on your device

To reduce accidental form loss, unfinished text answers may be saved for the current browser tab/session in sessionStorage and mirrored into the current browser history state. Drafts expire after at most 12 hours and are cleared after a successful submission. This recovery draft is not placed in localStorage or IndexedDB.

Selected portfolio photos are not saved to sessionStorage, history state, localStorage or IndexedDB. They remain in browser memory only until submission, removal or page reload, so photos may need to be selected again after a reload.

9. Service providers and transfers

We use Supabase Inc. to validate, receive and store creator applications and private photos; the Imodelly project is deployed in eu-west-1 (Ireland). We use Vercel Inc. to host the public website. We use Resend (Plus Five Five, Inc.) for transactional email delivery and Google/Gmail to receive and manage business email. These providers may act as processors or, for certain account/service data, as independent controllers under their terms. Where an international transfer occurs, we rely on the safeguards required by GDPR Chapter V and applicable contractual transfer mechanisms.

For data minimisation, administrative creator-application notification emails contain only the application reference and a link to the private dashboard. Full answers and photos are not included in those emails.

10. Communication and agency introductions

We use the contact method you provide to respond. Telegram or WhatsApp may process data under their own terms if you choose those channels. Imodelly does not sell applications, contact lists or photos. Before identifying details, contact data or photos are sent to a specific agency, we show you the opportunity and obtain your approval. Rejecting an opportunity does not authorise a transfer.

For accountability, we may record the named agency, approval channel and time, approved data categories, a short evidence note and any later withdrawal. If the full application is deleted, minimum evidence of an earlier authorised disclosure may be retained where a continuing legal or accountability purpose exists.

11. Retention and deletion

Creator applications are initially assigned a review/deletion date after six months. Inactive data are deleted when the matching purpose ends; an active introduction or matching process may justify retaining the application only as long as necessary. Inactive or rejected agency applications are normally reviewed within twelve months. Data required by law, for accountability or for legal defence may be kept for the applicable period. You can request earlier deletion at any time.

12. Security and abuse prevention

Application records and files do not have public read access. Creator submissions use server-side validation, value and size limits, file-signature checks, origin restrictions, rate limiting and private storage. Administrative access is restricted to approved accounts. No security measure removes every risk, so do not send explicit media, passwords, financial documents or identity documents in the initial form.

13. Your rights

Where the legal requirements are met, you may request access, correction, deletion, restriction, portability or object to processing. Consent can be withdrawn for future processing. Contact support@imodelly.com and include your application reference where possible. You may also complain to a data-protection authority; for our location, the competent authority includes the State Commissioner for Data Protection of Lower Saxony (LfD Niedersachsen).

14. Analytics and Google Ads

Imodelly uses Vercel Web Analytics for aggregated website statistics. The private admin area is excluded and query parameters are removed before analytics events. We also offer optional Google Ads conversion measurement. The Google tag is loaded only after you allow measurement; application answers, photos, contact details and application references are not sent through the conversion event, and personalized advertising signals are disabled. You can change this choice through the privacy control on the site.

15. Contact

For privacy questions, corrections, consent withdrawals or deletion requests, contact support@imodelly.com.