ModularMind

GDPR overview

GDPR is addressed, though unevenly. The security documentation carries a dedicated GDPR section for EU customers covering access, erasure, portability and consent management, and offers a Data Processing Agreement to enterprise accounts. The privacy policy, effective 19 December 2025, lists the matching rights: access and copy, correction, deletion, restriction and objection, portability in a machine-readable format, and marketing opt-out. Breach notification to affected customers is promised within 72 hours. The gaps are real, however. No Article 27 EU representative is designated, no data protection officer is named, no legal basis for processing is stated, and international transfers are covered only by a generic reference to safeguards, with no standard contractual clauses or adequacy framework cited, despite the company being established in the United States. Every privacy enquiry goes to a single address, contact@modularmind.app.

Who owns the data?

The terms are explicit: you keep ownership of your Customer Content, including anything that reaches the service from your connected third-party accounts. ModularMind grants itself a worldwide, non-exclusive, limited-term licence over that content, but the stated purposes are narrow, covering the operation, maintenance and support of the service, the resolution of security or technical incidents, and compliance with the law. Each account sits in its own encrypted environment, and the documentation states that ModularMind staff cannot reach customer data without explicit permission. In exchange, you carry full responsibility for the legality of what you transmit and for holding the rights to it.

Reuse rights

Because you retain ownership of your Customer Content, you may reuse what you put in and what Maia produces for you without asking ModularMind for permission; the licence you grant runs in the other direction. What you may not do is resell, sublicense or rent the service itself, reverse-engineer it, or use it to build a competing product, since no ownership of the platform is conveyed. On the vendor's side the picture is less settled. The privacy policy of 19 December 2025 states flatly that personal data and content are never used to train its AI models, and the security documentation repeats it, adding that the underlying model providers are contractually barred from training on data submitted through the service. The terms of service, unchanged since 4 June 2023, take a different line: they allow ModularMind to use de-identified Customer Content and usage information for model training, offer an opt-out on written request, and opt Company Plan subscribers out automatically. Data pulled from connected platforms during a run is not stored at all, being processed in memory and discarded, so only what Maia itself produced remains.

Data retention & training

Hosting summary

Hosting is spread across three providers, all named in the privacy policy: Amazon Web Services, Google Cloud Platform and Microsoft Azure. The regions are given precisely, covering AWS us-east-1 in Northern Virginia and us-west-1 in Northern California, Google Cloud us-central-1 in Iowa and europe-central2 in Warsaw, and Azure East US. The company summarises this as data centres in the United States and Europe. Network controls described in the documentation include private VPCs, firewalls restricting traffic to authorised sources, and provider-level DDoS protection, while stored browser sessions are encrypted with AES-256 at rest. Jurisdictionally, ModularMind is established in the United States and says its service providers sit in other countries, so personal data may be transferred outside a user's own jurisdiction; the policy refers only to applying safeguards, without naming standard contractual clauses or any adequacy framework. The site itself resolves to an IP address geolocated in the United States. Only the Warsaw region gives European data a European home, and nothing indicates that a customer can choose where their data lands.