Privacy Policy
This Privacy Policy explains how Modalius, LLC ("Modalius", "we", "our", or "us") collects, uses, shares, and protects personal information. It covers three places you may interact with us:
- Our public website at modalius.com;
- The Modalius Partner Connect application at app.modalius.com, together with its APIs and file-transfer endpoints; and
- Our customer support portal at support.modalius.com.
Two different roles. For website visitors, for the account information of people who use the application, and for support requests, Modalius decides how and why information is used, and acts as a controller.
For the business data our customers send through the platform (EDI files and the personal information inside them, such as a shipping contact's name), the customer decides how it is used and Modalius acts as a processor on that customer's instructions. That relationship is governed by our Data Processing Agreement, not by this policy. If your information appears in a document processed through Modalius on behalf of a business, please direct your request to that business; see section 8.
- Information we collect
- How we use information
- Cookies, analytics, and your choices
- How we share information
- We do not sell or share personal information
- How long we keep information
- How we protect information
- Your privacy rights
- International transfers
- Children
- Changes to this policy
- Contact us
1. Information We Collect
1.1 When you visit our website
| Category | Examples | Source |
|---|---|---|
| Usage and device information | Pages visited, time on page, referring source, browser and device type, approximate location at city or country level, interaction events | Collected automatically through cookies and similar technologies (Google Analytics 4) |
| Contact information | Name, business email address, company, and anything else you choose to include when you email us or request a demo | Provided by you |
1.2 When you use the Partner Connect application
| Category | Examples | Source |
|---|---|---|
| Account information | Name, business email address, organization, permissions and group membership, notification preferences, the version of our Terms you accepted and when | Provided by you or by your organization's administrator |
| Authentication information | Password (stored hashed), multi-factor authentication secrets and recovery codes, one-time codes sent by email, session tokens, login timestamps | Generated by the Service and by you |
| Product usage telemetry | Pages and features used, clicks on tracked controls, session identifier, login and signup events, application errors and their technical detail, browser and operating system, screen and window size, language, and time zone. These events are associated with your name, email address, and organization. | Collected automatically while you use the application |
| Operational logs | Activity and audit records, connection and file-processing logs, IP address and request metadata | Generated by the Service |
| Customer business data | EDI and related files and their contents, trading-partner and routing configuration, connection credentials, order and shipment records. These may contain personal information such as contact names and addresses. | Submitted by you or your trading partners. We handle this as a processor; see the callout above. |
1.3 When you contact support
Creating an application account also creates an identity in our support portal, so you can raise and track requests with the same credentials. We collect your name and business email address, the content of your requests and any attachments, and records of our correspondence. Support requests are handled in a third-party support platform (see section 4).
2. How We Use Information
- To provide the Service: authenticate you, run and monitor file processing and delivery, apply your routing configuration, and maintain your account.
- To secure the Service: detect, investigate, and prevent fraud, abuse, unauthorized access, and security incidents, and maintain audit records.
- To support you: respond to requests, diagnose faults, and where necessary access your account as described in section 6 of our Terms of Service.
- To improve the Service: understand which features are used and where users encounter friction or errors, and prioritize development.
- To communicate: send service, security, and administrative messages, and product updates you can unsubscribe from.
- To bill: meter usage and produce invoices.
- To comply with law: meet legal obligations and respond to lawful requests.
We may create aggregated or de-identified information (such as transaction volumes, file types, and error rates) and use it to operate, secure, and improve the Service. We will not attempt to re-identify it. We do not use the contents of customer EDI files to train machine learning models.
Where the GDPR or UK GDPR applies to our role as a controller, we rely on these legal bases: performance of a contract (providing the Service and support), legitimate interests (securing and improving the Service, direct business communications with business contacts), consent (analytics cookies where consent is required, and marketing email), and legal obligation.
3. Cookies, Analytics, and Your Choices
We use cookies and similar technologies for two purposes: to keep you signed in and operate the application (strictly necessary), and to measure usage.
| Technology | Where | Purpose |
|---|---|---|
| Local and session storage | Application | Session token and expiry, multi-factor state, interface preferences such as dark mode and sidebar state, and a queue of pending analytics events. Strictly necessary or preference-based. |
| Google Analytics 4 | Website and application (separate measurement properties) | Measure page views, navigation, and interaction events so we can understand usage and improve the product. Sets cookies in your browser. |
| First-party usage analytics | Application | Our own telemetry pipeline, described in section 1.2. Data stays within infrastructure we control and is not shared with advertising networks. |
Your choices:
- Control cookies through your browser settings. Blocking strictly necessary storage will prevent the application from working.
- Opt out of Google Analytics with the Google Analytics Opt-out Browser Add-on. Google's own practices are described in Google's Privacy Policy.
- We honor the Global Privacy Control (GPC) browser signal as a valid opt-out request where applicable law requires it.
- Unsubscribe from non-essential email using the link in the message or by contacting us. We will still send service, security, and billing messages.
We do not use these technologies to build advertising profiles, and we do not run third-party advertising on our website or in the application.
4. How We Share Information
We share personal information only in these circumstances:
- With your trading partners and intermediaries. The application exists to move documents between organizations. Files are delivered to the trading partners, brokers, and value added networks that you or your organization configure. You control that configuration.
- With your organization. If you use the application through an organization, its administrators can see your account details and activity.
- With service providers that process information on our behalf under written obligations restricting their use of it. Our current providers are:
| Provider | What it handles | Location |
|---|---|---|
| Amazon Web Services | Hosting, storage, databases, queuing, secrets management, managed file transfer, and outbound email | United States |
| Microsoft | Mailboxes used to receive inbound documents by email, and internal operational alerting | United States |
| Zendesk | Support portal identities and the content of support requests | United States |
| Website and application usage analytics | United States |
A current, detailed list is maintained in Appendix C of our Data Processing Agreement and is available on request.
- For legal reasons. Where required by law, subpoena, or other legal process, or to protect the rights, property, or safety of Modalius, our customers, or the public. Where we are permitted to do so, we will notify the affected customer first.
- In a business transaction. If we are involved in a merger, acquisition, financing, or sale of assets, information may transfer as part of that transaction, subject to this policy.
5. We Do Not Sell or Share Personal Information
We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act as amended and comparable state laws. We have not done so in the preceding twelve months. We do not knowingly sell or share the personal information of anyone under 16.
Our service providers are engaged as service providers or processors and are contractually restricted from retaining, using, or disclosing personal information for any purpose other than performing services for us.
6. How Long We Keep Information
| Information | Retention |
|---|---|
| Website analytics | Per Google Analytics 4 settings, up to 14 months |
| Account records | For the life of the account, then a reasonable period for legal, accounting, and dispute-resolution purposes |
| Product usage telemetry | Up to 90 days |
| Operational and processing logs | Up to 90 days |
| External connection activity logs | At least 45 days |
| Customer business data (EDI files) | Default of 730 days, configurable by the customer, subject to their subscription |
| Soft-deleted records | Restorable for 7 days, then removed |
| Generated report files | 7 days |
| Support requests | For the life of the account and a reasonable period afterward |
Backups are overwritten on a rolling basis in the ordinary course. We may retain information longer where required by law or where it is subject to a legal hold.
7. How We Protect Information
We maintain technical and organizational measures appropriate to the risk, including encryption in transit and at rest, managed secrets storage for credentials, role-based access control with least privilege, multi-factor authentication for sensitive operations, network isolation between environments, continuous monitoring and activity logging, regular backups, and confidentiality obligations for personnel. A fuller description is in Appendix B of our Data Processing Agreement.
Authorized personnel may access a customer account to provide support or investigate a security issue; this is limited, logged, and described in section 6 of our Terms of Service. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. Your Privacy Rights
Depending on where you live, you may have the right to know what personal information we hold about you and how we use it, to access or receive a copy of it in a portable form, to correct inaccuracies, to request deletion, to opt out of sale, sharing, targeted advertising, or certain profiling (we do none of these), to limit the use of sensitive personal information (we do not collect it for these purposes), and to be free from discrimination for exercising a right. Residents of California, Colorado, Connecticut, Utah, Virginia, Texas, Oregon, Montana, and other states with comprehensive privacy laws have some or all of these rights, as do individuals in the European Economic Area and the United Kingdom, who additionally may object to processing, request restriction, and lodge a complaint with their supervisory authority.
How to exercise a right
Email contact@modalius.com with the subject "Privacy Request" and tell us what you are asking for. We will verify your identity before acting, usually by confirming control of the email address associated with your account or by asking for information that matches our records. An authorized agent may submit a request on your behalf with proof of authorization. We respond within the time required by applicable law (generally 45 days, extendable once where permitted), and we do not charge a fee for a reasonable request.
If we decline a request, we will tell you why, and you may appeal by replying to our response with the subject "Privacy Appeal". We will respond to an appeal within 45 days. If we deny the appeal, you may contact your state attorney general.
If your information is inside a customer's documents
Where personal information about you appears in files processed through Modalius on behalf of one of our business customers, that customer controls it and we act only on their instructions. Please contact that business directly. If you contact us instead, we will, where lawful, refer you to them and will assist them in responding.
9. International Transfers
Our infrastructure is located in the United States, and information you provide is processed there. If you access our website or the application from outside the United States, you understand that your information will be transferred to and processed in the United States, which may have different data protection laws than your jurisdiction. Where personal data is transferred from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum where required. Copies are available on request.
10. Children
Modalius Partner Connect is a business-to-business service that is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact us and we will delete it.
11. Changes to This Policy
We may update this Privacy Policy. When we make a material change, we will update the version number and effective date above and, where the change affects users of the application, give notice by email or within the application before it takes effect. We encourage you to review this page periodically. Prior versions are available on request.
12. Contact Us
Questions, requests, and complaints about this Privacy Policy or our handling of personal information can be sent to contact@modalius.com. For privacy requests, please use the subject "Privacy Request" so we can route it correctly.