Privacy policy

Last updated: 7 November 2026

This policy explains what personal data MODYLight collects, why, how long it is kept and what your rights are. It covers this website, modylight.com, and the lamp generator at make.modylight.com.

1. Who is responsible

The controller of your personal data is David Follen, trading as CuratedLayer, Belgium. Contact: [email protected]. A postal address is available on request.

2. This website (modylight.com)

This website sets no cookies, uses no analytics and loads nothing from other websites. It is hosted by Cloudflare, which processes technical data such as your IP address and browser details to deliver and protect the site. We do not receive or store that data. If you email us, we keep your message and address in our mailbox for as long as needed to answer and follow up.

3. The lamp generator (make.modylight.com)

When you use the lamp generator, we process the following data.

• Account: your email address, a random account number, the date you signed up and whether you have used your free credit.
• Sign-in by email link: your email address, the IP address that asked for the link and the time. Links work once and expire after 15 minutes; these records are deleted after one day.
• Sign-in with Google: see section 4.
• Sessions: a sign-in session lasts 30 days. We store only a coded (hashed) form of the session key.
• Your lamps: the settings, colours and a small preview picture of lamps you save.
• Generated files: previews are deleted after 24 hours; lamp files you unlock with a credit are kept for 30 days so you can download them again, then deleted.
• Credits and purchases: your credit history and, for each purchase, the time and the wording you agreed to, including your consent to immediate delivery of a file.
• Contact form: the time you sent a message. The message itself is delivered to our mailbox.

We do not use passwords, analytics, advertising or tracking of any kind.

4. Google sign-in

If you choose to sign in with Google, we ask Google only for the basic sign-in permissions (openid and email). We receive and store your Google account identifier and your verified email address. We do not receive or store your name, profile picture, contacts, files or any other Google data.

We use this data only to sign you in and to recognise your account. We do not sell it, use it for advertising, share it with anyone or use it to train artificial intelligence models. MODYLight's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

To make sure the free welcome credit is given only once per Google account, we keep a one-way coded (hashed) form of your Google account identifier, even after you delete your account. It cannot be turned back into your identifier or linked to your email.

5. Why we process your data and on what legal basis

• To provide the service you ask for (accounts, sign-in, generating and delivering lamp files, credits): performance of a contract, Article 6(1)(b) GDPR.
• To keep purchase records required by tax and accounting law: legal obligation, Article 6(1)(c) GDPR.
• To keep the service secure and prevent abuse (limits on sign-in links, one free credit per Google account, error logs): our legitimate interest in a safe and fair service, Article 6(1)(f) GDPR.

6. Cookies and browser storage

The lamp generator uses only cookies that are strictly necessary for it to work, so no consent banner is needed.

• cube_session: keeps you signed in, 30 days.
• cube_google_state: protects the Google sign-in step against forgery, 10 minutes.
• A short-lived browser storage entry (after-pay) brings you back to your lamp after a payment and disappears when you close the tab.

7. Who processes data for us

We use these service providers. They process data only on our instructions.

• OVHcloud: servers of the lamp generator, in Warsaw, Poland (EU).
• Cloudflare: hosting of this website, domain name service, and storage of database backups in the EU.
• Lettermint: delivery of sign-in and service emails, processed in the EU.
• Google: only if you choose to sign in with Google.
• Payment provider: will be named here before the first paid credit is sold.

Cloudflare and Google are based in the United States. Where data leaves the EU, the transfer relies on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.

8. How long we keep data

• Account data, saved lamps and pictures: until you delete your account.
• Sign-in links: one day. Sessions: 30 days.
• Previews: 24 hours. Unlocked lamp files: 30 days.
• Records of lamps generated: kept without your email after you delete your account.
• Purchase and credit records: after you delete your account, kept without your email for as long as Belgian tax and accounting law requires (currently up to 10 years).
• Database backups: 30 days.
• During the beta, all data may be erased when the beta ends; testers will be told beforehand.

9. Your rights

You may ask for access to your data, correction, deletion, restriction of processing, a copy in a portable format, or object to processing based on our legitimate interest. You can delete your account yourself on the Account page of the lamp generator; this removes your email, sessions, saved lamps and pictures straight away. For anything else, write to [email protected]. We answer within one month.

You also have the right to complain to the Belgian Data Protection Authority (dataprotectionauthority.be) or to the authority of the EU country where you live.

10. Security

All connections use HTTPS. There are no passwords to steal; sign-in links and session keys are stored only in hashed form. Servers and backups are in the EU and access is limited to the operator.

11. Age

The lamp generator is for people aged 16 or older.

12. Changes

We will update this policy when the service changes, for example when paid credits open, and change the date at the top. Account holders are told about important changes by email.