Privacy Policy — ModaList

Last updated: 08/06/2026

1. Data Controller

The data controller responsible for processing your personal data is:

Ghadhab Neder (sole proprietor)
Registered address: Via Bernardino De' Rossi 8, 27100 Pavia (PV), Italy
VAT: 03026490189
Email (privacy and rights): info@nederghadhab.com

2. Data Collected

We collect: email, Firebase UID, Shopify credentials (token encrypted with AES-256-GCM), product images and voice/text descriptions provided by the user, in-app purchase data (handled by RevenueCat and the Apple/Google stores) and, if you enable notifications, a device notification token.

3. Purposes and Legal Bases

We process your data for the following purposes, each based on a specific legal basis under Article 6 of the GDPR:

• Authentication and provision of the service (AI processing and publishing to the user's Shopify store) — performance of the contract, Art. 6(1)(b) GDPR.
• Push notifications (if the user enables them) — consent, Art. 6(1)(a) GDPR, withdrawable at any time.
• Prevention of abuse and fraud (welcome offers and promotional credits) — legitimate interest, Art. 6(1)(f) GDPR.
• Legal obligations (e.g. tax receipts) — legal obligation, Art. 6(1)(c) GDPR.

4. Recipients and Processors

To provide the service we rely on the following providers, which process data on our behalf as data processors:

• Google — Firebase Authentication, Cloud Firestore and Cloud Run (authentication, data storage and backend hosting).
• Google Gemini — AI processing of images, audio and text to generate the product listing. The provider processes the data on our behalf and does not use it for its own purposes or to train its models.
• RevenueCat and Apple App Store / Google Play — handling of in-app purchases.
• OneSignal — delivery of push notifications (processes the device identifier and language).
• Resend — delivery of transactional email (address verification and password reset).

We do not sell or transfer personal data to third parties, and we do not use advertising networks or data brokers.

5. International Transfers

Some providers (Google and Google Gemini, RevenueCat, OneSignal, Resend) may process data outside the European Union / European Economic Area, for example in the United States. Such transfers are based on the Standard Contractual Clauses (SCC) approved by the European Commission and/or on adequacy decisions.

6. Retention

Account data is kept for as long as the account is active and is deleted upon account deletion (within 48 hours). Anti-abuse pseudonymized identifiers (a one-way HMAC of the email and device — not the email or device themselves, and no other personal data) are kept for a maximum of 24 months, solely for fraud and abuse prevention. Images sent for processing are not retained after the product is published.

7. Security

Authentication is handled by Google Firebase Authentication. User data is stored on Google Cloud Firestore and the backend is hosted on Google Cloud Run. Shopify access tokens are encrypted at rest (AES-256-GCM).

8. Data Subject Rights

You have the right to access your personal data and to obtain its rectification, erasure, restriction of processing, portability, as well as to object to processing. You can exercise these rights by writing to info@nederghadhab.com. You also have the right to lodge a complaint with the competent supervisory authority: in Italy, the Garante per la protezione dei dati personali (Italian Data Protection Authority — www.garanteprivacy.it).

9. Deletion

You can request the complete deletion of your data directly from the app (Settings > Delete account) or, without using the app, from the dedicated web page: Account deletion request. Data is removed within 48 hours. The anti-abuse exception described in point 6 still applies: pseudonymized identifiers may be retained for abuse prevention, a processing activity compatible with the right to erasure.

10. No Advertising Tracking

We do not use your data for advertising, profiling or tracking across third-party apps or sites, and we do not share it with advertising networks or data brokers.

11. Contact

For any privacy request: info@nederghadhab.com