Privacy Policy

Privacy requests: [Email for privacy requests, can be the same as the contact email]

• We collect only what we need to run the quiz, send what you request, run your account, deliver what you buy and keep our records.
• Your photos stay in a private storage folder tied to your account and are only used to produce your assessment. You can delete them at any time.
• We do not use advertising or tracking cookies and we do not sell your data.
• You can ask us for access, correction or deletion at any time.

When you open the site, our hosting infrastructure processes technical data such as your IP address, date and time, requested page and browser type to deliver the page and keep it secure. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in a secure, working website). Fonts are hosted on our own domain, so no data goes to a font provider.

You can take the quiz without giving us any data. Your answers are calculated in your browser. If you request your report or the guide, we process your name, email address and, for the report, your quiz answers and result. We first send a confirmation link to your address (double opt-in). Only after you open the link do we send your report or guide. Legal basis: Art. 6 (1)(a) GDPR (your consent) and Art. 6 (1)(b) GDPR for delivering what you requested.

When you confirm, you also agree that we may send you occasional emails about Model Method content and offers related to your interests. You can withdraw this consent at any time with effect for the future, by emailing [Email for privacy requests, can be the same as the contact email]. We keep this data until you withdraw your consent or ask us to delete it.

The free quiz and guide are for people aged 16 and over.

When you create an account, we process your email address, your password (stored only as a protected hash), and the profile details you choose to add, such as experience level, goal and modeling directions, plus the progress you make in your plan. Legal basis: Art. 6 (1)(b) GDPR. Accounts are for people aged 18 and over. We keep account data until you delete your account.

If you use Portfolio Check, you upload photos and answer a few questions. We store the photos in a private storage folder that only your account can open, and we store the assessment we produce. To create the assessment, your photos and answers are sent to an AI service provider, which analyses them and returns the result. We use your photos only to produce your assessment. We do not use them for advertising and we do not publish them.

The assessment is not a decision with legal or similarly significant effect on you. Please only upload photos of yourself, and no photos of people under 18. We do not analyse your photos to identify you or to derive special categories of data. Legal basis: Art. 6 (1)(b) GDPR. We keep photos and assessments until you delete them in your account or delete your account.

Payments are processed by Stripe. Stripe collects your payment details directly and is responsible for them under its own privacy policy. We receive and store the purchase record: product, amount, status, timestamps and references. We do not store your card number. We also record that you accepted our terms and the withdrawal information at checkout, so we can prove it. Legal basis: Art. 6 (1)(b) and (c) GDPR. Tax and accounting law requires us to keep purchase records for up to 10 years.

If you use our withdrawal form, we process the details you enter, to handle your withdrawal, send you a confirmation and keep proof. Legal basis: Art. 6 (1)(b), (c) and (f) GDPR. We keep this record for as long as needed to prove the process, generally up to three years after the end of the year of the request.

We send transactional emails (confirmations, your report, your guide, assessment ready, plan updates) through an email delivery provider. If you have consented, we also send occasional emails about Model Method. Every marketing email will tell you how to opt out.

We count anonymous steps in our funnel, for example that a quiz was completed. These events contain the step, the page and a random identifier that is not stored on your device, and they are not linked to your identity unless you are signed in. We do not use advertising or analytics cookies. Legal basis: Art. 6 (1)(f) GDPR (understanding and improving our service).

We use your browser's local storage only for things you asked for: keeping you signed in, and remembering your quiz result and plan progress on your device. This is technically necessary for these functions. You can clear it any time in your browser settings.

We share personal data only with service providers that work for us under data processing agreements, or that are independently responsible, such as Stripe:

• Hosting, database, authentication and file storage for the website (the Lovable platform and its infrastructure providers).
• Stripe (payments).
• An email delivery provider (transactional and confirmation emails).
• An AI model provider (analysis of the photos you submit in Portfolio Check).
• [Confirm the current provider names and data locations before publishing, and list them here.]

Some providers may process data outside the EU or EEA, for example in the USA. Where this happens, we rely on an EU adequacy decision, such as the EU-US Data Privacy Framework, or on the EU Standard Contractual Clauses.

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15),
• have inaccurate data corrected (Art. 16),
• have your data deleted (Art. 17), unless we must keep it by law,
• have processing restricted (Art. 18),
• receive your data in a portable format (Art. 20),
• object to processing based on legitimate interests (Art. 21),
• withdraw consent at any time, with effect for the future (Art. 7 (3)).

To use these rights, email [Email for privacy requests, can be the same as the contact email]. You can delete your assessments and photos yourself in your account. To have your whole account deleted, email us. We delete it within 30 days, except records we must keep by law, such as purchase records.

You have the right to complain to a data protection authority. The authority responsible for us is: [Competent data protection authority, e.g. LDI NRW if you are based in North Rhine-Westphalia].

Data is transmitted encrypted (TLS). Access to stored data is restricted, and uploaded photos are stored in private storage.

We update this policy when our service or the law changes. The current version is always on this page. See also our Terms and Impressum.