Privacy policy

This page explains what data Imodelly uses, why we use it, where it is stored, who may receive it and how you can exercise your rights.

1. Controller

Felix Cozmolici
Sole proprietorship
Brentanostraße 8, 30625 Hannover, Germany
Email: imodelly.agency@gmail.com
Phone: +49 172 4239611

2. Website visits and technical data

The public website is hosted by Vercel. When you visit, Vercel may process technical data necessary to deliver and protect the service, such as IP address, date and time, requested page, browser, device and security logs. The legal basis is our legitimate interest in providing a secure and stable service under Article 6(1)(f) GDPR.

The creator form sends the application directly from the browser to Supabase infrastructure. We do not intentionally use Vercel to store private creator-application answers or portfolio photos.

3. Creator application data

When you submit a creator application we may process: first or creator name, contact method and contact details, country and region, languages, stated age and adult-age confirmation, social profiles, platforms used, content level and style, face visibility, content language and frequency, agency experience and contract status, availability, voluntary audience and revenue ranges, requested services, goals, voluntary boundaries, verification readiness, consent records, submission date and application reference.

We use this data to handle the application, contact you, assess suitable management options, prevent abuse, document decisions and prepare possible introductions. Handling your request and pre-contractual steps rely on Article 6(1)(b) GDPR; security, fraud prevention and documentation rely on Article 6(1)(f) GDPR; optional promotional messages rely on consent under Article 6(1)(a) GDPR.

4. Agency application data

When an agency applies for review, we may process its trading and legal name, website or profile, country, contact person, business email and Telegram, operating history, team size, approximate creator count, languages, services, commission and cost information, contract terms, account-access and recovery practices, creator-boundary handling, data-security practices, public references or proof, confirmations, application date, reference and internal review information.

We use this data to assess the identity, capacity, commercial terms, security and suitability of a prospective agency partner, contact its representatives, verify claims, prevent abuse and document decisions. The legal bases are pre-contractual steps under Article 6(1)(b) GDPR and our legitimate interest in protecting creators and maintaining a trustworthy partner network under Article 6(1)(f) GDPR.

5. Private photos

The application allows two to five recent, non-explicit photos. They are stored in a private Supabase bucket, are not published, indexed or sold, and a specific agency may receive photos only after the creator approves that introduction. Do not upload nude or explicit media, identity documents, banking data, passwords or private third-party messages.

The legal basis for storing and reviewing photos is your consent under Article 6(1)(a) GDPR. You may withdraw it for the future and request deletion.

6. Potentially sensitive information

Questions about content level and boundaries are used to avoid unsuitable opportunities. We do not need graphic details about sex life, sexual orientation, health or other private matters. If an answer voluntarily includes information qualifying as a special category of personal data, processing is limited to the requested review and matching and is based on your explicit consent under Article 9(2)(a) GDPR.

7. Consent records

To demonstrate what was accepted, we store with the application the required consent states, the applicable consent-text version and timestamps for the privacy, potentially sensitive-data and portfolio consents.

8. Storage on your device

Imodelly does not intentionally save creator-application answers or portfolio photos to localStorage or IndexedDB for later resumption. While you complete the form, the data remains temporarily in browser memory and is transmitted when you submit.

9. Service providers and transfers

We use Supabase Inc. to receive and store applications and photos; the Imodelly project is deployed in eu-west-1 (Ireland). We use Vercel Inc. to host the public website. We use Resend (Plus Five Five, Inc.) for transactional email delivery and Google/Gmail to receive and manage business email. These providers may process data as processors or, for certain account or service data, as independent controllers under their terms. Where an international transfer occurs, we rely on the safeguards required by GDPR Chapter V and the applicable contractual transfer mechanisms.

For data minimisation, the administrative email notification after an application contains only the application reference and a link to the private dashboard. If you choose email as your contact method, the confirmation email sent to you contains your first or creator name and reference, but does not copy full sensitive answers or photos.

10. Communication and agency introductions

We use the contact method you provide to respond. Telegram or WhatsApp may process data under their own terms if you choose those channels. Imodelly does not sell applications, contact lists or photos. Before sending identifying details, contact data or photos to a specific agency, we show you the opportunity and obtain your approval. Rejecting an opportunity does not authorise any transfer.

For accountability, we may record the named agency, approval channel and time, the approved data categories, a short evidence note and any later withdrawal. If the full application is deleted, we may retain only the minimum evidence necessary to document an earlier disclosure where a continuing legal or accountability purpose remains.

11. Retention and deletion

Creator applications receive an initial six-month review and deletion date. We delete inactive data when the matching purpose has ended; where an introduction or active matching remains ongoing, the review may be postponed only for as long as necessary. Rejected or inactive agency applications are normally reviewed within twelve months. Data required for legal obligations, accountability or defence of claims may be retained for the applicable periods. You may request earlier deletion at any time.

12. Security

Application tables and files have no public read access. Submissions pass through server-side validation, size and value limits, file-type checks and repeat-submission protection. Administrative access is limited to approved accounts and the photo bucket is private. No measure removes every risk, so do not submit explicit media, passwords, financial documents or identity documents in the initial form.

13. Your rights

Where legal requirements are met, you have rights of access, correction, deletion, restriction, portability and objection. You may withdraw consent for future processing. To exercise your rights, email imodelly.agency@gmail.com and include your reference if available. You may also lodge a complaint with a data protection authority. For our establishment, the State Commissioner for Data Protection of Lower Saxony, Prinzenstraße 5, 30159 Hannover, Germany is particularly relevant.

14. Analytics and Google Ads

Imodelly uses Vercel Web Analytics for aggregated statistics such as viewed pages, referrer, approximate country, browser, operating system and device type. Vercel Web Analytics does not use analytics cookies or create profiles that identify or follow a person across different days or websites. The private admin area is excluded and query parameters are removed before analytics events are sent. The legal basis is our legitimate interest in measuring and improving a secure and useful website under Article 6(1)(f) GDPR.

We also use optional Google Ads conversion measurement to understand whether an Imodelly ad click led to a completed creator application. The Google Ads tag is blocked and no data is sent to Google through that tag until you choose “Allow measurement”. After consent, Google may process technical advertising-attribution data connected with the ad interaction. The conversion event does not include application answers, photos, name, contact details, revenue or the application reference. Personalized advertising signals are disabled and this setup is not used for personalized remarketing. You can change or withdraw your choice through the privacy controls.

15. Contact

For privacy questions, corrections, consent withdrawal or deletion of an application, email imodelly.agency@gmail.com.

Last updated: 26 July 2026.