Privacy notice

Optional AI assistant

Ask ModKaki is an invited-testers pilot powered by Google Gemini. When you acknowledge the AI notice and send a question, your question and up to four recent conversation exchanges are sent to Google. Do not include names, contact details, registration plates, VINs, identity documents or other personal or sensitive information. Google may use content sent through its unpaid service to improve its products, including human review, as described in Google’s Gemini API terms.

ModKaki does not store AI prompt or answer text in its database. The web conversation is kept in page memory and disappears when you leave or clear it. We retain an account-linked pilot-access flag, the latest usage date, request count and latest-request timestamp for access control and abuse prevention. Clearing the page does not delete data already processed by Google. AI answers may be incorrect; this version does not perform live web research and cannot certify diagnoses, fitment or road legality.

What we collect

• Account data: email address, confirmation status, display name, and authentication security state.
• Garage data: vehicle variant, model year, and an optional nickname.
• Workshop application data: business name, city, public description, specialties, public phone, website, and review messages.
• Operational security data: staff roles, MFA state, access attempts, review actions, timestamps, and correlation identifiers.
• Your modification shortlist remains in local browser storage in this beta and is not synced to the database.

We do not currently collect payment card data, precise location, contacts, advertising identifiers, or children’s data. Do not submit identity documents or sensitive personal information in free-text fields.

Why we use it

• Provide account, garage, workshop-directory, and support functions.
• Confirm identity and protect privileged staff access.
• Review workshop listings and preserve accountable decisions.
• Prevent abuse, diagnose faults, and meet legitimate legal obligations.

Processors and disclosure

Supabase provides authentication and database services; OpenAI Sites hosts the web application; Resend is configured for authentication email delivery. These providers process data only for the relevant service. ModKaki does not sell personal data and does not use advertising trackers in this beta. Stripe is not connected to a live checkout in the current product, so ModKaki does not collect payment data.

Retention and deletion

Account and garage records are kept while the account is active. A verified deletion request starts a review of account-linked data. Some narrowly scoped security, fraud-prevention, dispute, or legally required records may be retained and separated from active use. Backup expiry depends on the infrastructure retention window. A final documented retention schedule and automated deletion controls are required before commercial launch.

Your choices

You may request access, correction, or deletion through the data-rights page. We verify account control before disclosing or deleting data. You can remove locally saved modification ideas by clearing the ModKaki site data in your browser.

Security

Database row-level security separates private account records. Staff access is individually assigned, requires MFA, and is audited. No browser receives a service-role key. No system can be guaranteed perfectly secure; report unexpected access through the data-rights page.

Young users

The beta is for people aged 18 or older. We do not knowingly create accounts for children. If you believe a child supplied personal data, submit a deletion request.