Privacy Policy

MODEL.AT ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform. Please read this policy carefully. By using MODEL.AT, you consent to the data practices described in this policy.

Information You Provide: Account information (name, username, email), profile data (bio, location, role), portfolio media, agency or brand profile details, payment information for transactions, and communications sent through the Platform.

Information From Third Parties: Social media profile data (Instagram, TikTok) including username, biography, profile picture, follower and following counts, media content and captions, engagement metrics, and account type when you authenticate via social login.

Automatically Collected Information: Device information (browser type, operating system, device identifiers), usage data (pages visited, features used, time spent), IP address and approximate geolocation, cookies and similar tracking technologies, and analytics data.

We use your information to: (a) provide, operate, and maintain the Platform; (b) process account registration and authentication; (c) display your profile and portfolio to other users; (d) power AI-driven features including content analysis, recommendations, and verification; (e) process payments and affiliate commissions; (f) communicate with you regarding updates, security alerts, and support; (g) analyze usage patterns to improve the Platform; (h) detect and prevent fraud, abuse, and security incidents; and (i) comply with legal obligations.

AI Image Analysis: Images and videos you upload or connect from Instagram/TikTok are processed by Google's enterprise AI (Google Cloud Vertex AI — Gemini — and Cloud Vision) to generate descriptive tags and attributes (such as perceived gender, skin tone, hair and eye color) and content-safety (NSFW) labels, used to power discovery, search, and verification. This processing occurs under Google Cloud's Data Processing Addendum, and your content is not used to train Google's or any other third party's AI models.

Public Profile Data: Your profile information, portfolio media, and public statistics are visible to other Platform users. You control which media items are public through privacy settings.

Service Providers: We share data with trusted third-party providers, each bound by a data-processing agreement, including Google Cloud (hosting; and Vertex AI + Cloud Vision for AI media analysis, under Google Cloud's Data Processing Addendum with no use of your content for model training), Firebase (authentication, database), Stripe (payments), and analytics services.

Legal Requirements: We may disclose your information if required by law, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We retain your information for as long as your account is active or as needed to provide services. When you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law or for legitimate business purposes.

When you delete your account, we permanently delete your account and associated data — including your connected Instagram/TikTok access tokens, portfolio media, AI-derived analysis, and stored media in Firebase Storage — typically within 30 days, except where retention is required by law. We do not use your content to train AI models.

Depending on your jurisdiction, you may have the following rights: (a) Access: Request a copy of your personal data; (b) Correction: Request correction of inaccurate data; (c) Deletion: Request deletion of your data; (d) Portability: Receive your data in a portable format; (e) Opt-out: Opt out of marketing communications; (f) Restriction: Request restriction of processing.

To exercise these rights, contact us at privacy@model.at. We will respond within 30 days.

We implement industry-standard security measures including encryption in transit (TLS/SSL), encrypted data storage, regular security audits, access controls and authentication, and automated threat detection. However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security of your data.

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for international transfers, including Standard Contractual Clauses where applicable.

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 18, we will promptly delete that information.

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA/CPRA): to know what personal information we collect, to access and delete it, to correct it, and to opt out of the “sale” or “sharing” of personal information. We do not sell your personal information and do not share it for cross-context behavioural advertising.

Residents of other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, and others as they take effect) have comparable rights to access, correct, delete, and opt out of targeted advertising, sale, and certain profiling. You will not be discriminated against for exercising these rights.

Global Privacy Control (GPC): we honour opt-out preference signals such as GPC where required by law; a recognised signal is treated as a valid opt-out of sale/share for that browser or device. To exercise any right, contact privacy@model.at.

If you are in the European Economic Area, you have additional rights under the General Data Protection Regulation. Our legal basis for processing your data includes: consent (for social-media data access and for AI analysis of your images), contractual necessity (for account services), legitimate interests (for platform improvement and security), and legal obligations (for compliance requirements).

Special-category data (Art 9): our AI image analysis may infer attributes such as perceived skin tone that can constitute special-category or adjacent data. Where it does, we rely on your explicit consent (Art 9(2)(a)), given through the AI-analysis consent step and withdrawable at any time in Settings.

Automated processing (Art 22): we use automated tagging, verification, and recommendation systems. These do not produce legal or similarly significant effects about you without human involvement; you may contact us to request human review of any automated outcome that materially affects you.

Right to complain: you may lodge a complaint with a supervisory authority. Our lead authority is the Austrian Data Protection Authority (Datenschutzbehörde, DSB), Barichgasse 40–42, 1030 Vienna — dsb.gv.at. You may also complain to the authority where you live.

The data controller is the operator of MODEL.AT; full operator details are available on request via privacy@model.at and are being finalized in our Impressum (/impressum). Whether a Data Protection Officer is appointed, our per-category retention schedule, and the full list of sub-processors and their regions are being finalized and will be published here — our principal processors are already named in Section 4 (Google Cloud, Firebase, Stripe). In the interim, contact privacy@model.at.

For privacy-related inquiries, contact us at: privacy@model.at