Privacy policy
Last updated 4 November 2026. MDS is in an invitation-only testing period; this policy will be reviewed before MDS opens to the public, and we will tell you in MDS if anything important changes.
1. Who we are
This policy explains how MDS — Modern Design Studio ("MDS", "we") handles personal data when you use moderndesignstudio.app. MDS decides how and why your data is used (the "controller").
Questions or requests about your data: privacy@moderndesignstudio.app.
2. What we collect
- Account details: your name, email address and how you sign in (a password — stored only in scrambled "hashed" form, never readable — or Google sign-in). Staff accounts also use an authenticator app.
- Your work: projects, designs, settings, library items and files you create or add in MDS.
- Welcome answers: your occupation, main use of MDS, age range, company or organization, team size, country or region, state or province, city, ZIP or postal code, how you heard about MDS and which studios interest you. Only your name, occupation, main use, age range and country are required; the rest is optional.
- Service records: when you joined and last used MDS, the invitation or code you joined with, how many designs you have, and security records (for example sign-ins and staff actions on accounts).
- Problem reports and errors: when you use "Report a problem", your message, the MDS page you were on and — unless you remove it before sending — a picture of that MDS screen (it can show your design). When something breaks in MDS, a short technical error record (the error message, the MDS page and your app version), linked to your account so we can count how many people it affects.
- Technical data: your internet address and browser details, as part of normal web traffic and to protect MDS from abuse (for example, limiting repeated wrong invite codes).
We do not ask for payment details during the testing period, and we do not collect sensitive data such as health or religious information.
3. Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account, keeping your work safe and available on your devices, signing you in, sending emails you need (confirmations, invitations, password resets) | Providing the service you asked for (contract) |
| Keeping MDS secure, preventing abuse, fixing problems | Our legitimate interest in a safe, working service |
| Understanding who uses MDS (welcome answers, counts of use) to decide what to improve and build next | Our legitimate interest in improving MDS — you can object at any time |
| News and offers by email, and reaching people like you through advertising | Your consent — only if you ticked "Send me news and offers"; you can untick it any time in Your details |
| Meeting legal obligations | Legal obligation |
We do not make automated decisions about you that have legal or similarly significant effects.
4. Who processes it for us
We use trusted service providers who process data only on our instructions and under data-protection agreements:
- Supabase — database, file storage and sign-in (servers in the European Union, Ireland).
- Cloudflare — hosting and protecting the website.
- Our email delivery provider — sending account emails.
- Google — only if you choose "Continue with Google".
We do not sell your personal data. We share it with others only if the law requires it, to protect people's safety or rights, or as part of a business transfer (and then under this policy).
5. International transfers
Your account and work are stored in the European Union. Some providers may process data in other countries (for example to deliver emails or web pages quickly). Where that happens, they use recognised safeguards such as the European Commission's Standard Contractual Clauses.
6. How long we keep it
- Account, work and answers: while your account exists. When an account is deleted, its work, files and answers are removed; backups expire within a few weeks.
- Tester accounts whose access has ended: kept so your work comes back if access is renewed — ask us any time to delete it.
- Records of staff actions on accounts: kept so we can always show what was done and by whom (they contain the account email, not your work). Records of repeated wrong codes: 1 day.
- Problem-report pictures: up to 90 days. Problem reports and error records: until the problem is handled, at most 1 year.
7. Your rights
You can ask to see your data, correct it, delete it, receive a copy in a portable format, restrict or object to how we use it, and withdraw consent at any time (this does not affect what was done before). Many of these you can do yourself: Your details in MDS, and Settings › Download a backup. For anything else, write to privacy@moderndesignstudio.app; we reply within one month. You may also complain to the data-protection authority where you live.
8. Security
Data travels encrypted (HTTPS), each person can reach only their own work, staff access needs a password and an authenticator code, and every staff action on accounts is logged. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
9. Storage in your browser
MDS keeps your sign-in and a copy of your projects in your browser so it opens fast and works offline. We do not use advertising or tracking cookies. Signing out with "remove this computer's copy" deletes the copy from that browser.
10. Age
MDS is for people aged 16 or older. If we learn that someone younger has an account, we will delete it.
11. Changes
We will update this page when our practices change and tell you in MDS about important changes.