Privacy policy
Short version: we collect what we need to run MISE and bill you. We do not sell data, we do not train AI models on your data, and analytics cookies only run if you say yes. For the content you put into MISE we work for you, under a data processing agreement. You can ask for access or deletion at any time.
This policy covers the MISE app, the approval links we send, and the MISE marketing website. The full name is MISE by MODUS; until November 2026 the platform was called Trendpost, and some sign-in screens of TikTok, Pinterest and Meta may still show that name.
1. Who we are
ZESTOLOGY BV, trading as MODUS, which runs MISE by MODUS
Enterprise and VAT number BE 1013.413.339
Veeartsenstraat 45, bus 116, 1070 Anderlecht (Brussels), Belgium
hello@modus-ops.be
We have two roles:
- Controller for data about our customers, users, website visitors and leads: accounts, billing, support, security, usage of the platform and marketing.
- Processor for the content our customers put into MISE and any personal data in it, such as photos of people, names in captions, the reviewers they invite and the results of their social accounts. Our customer is the controller of that data. Our data processing agreement (DPA) sets out how we handle it. If you are a person whose data is in a customer's content, please contact that customer first; we will help them answer you.
2. What data we collect
When you visit the website
- technical data your browser sends, such as IP address, browser type, pages visited and time; our hosting provider uses this for security and delivery;
- analytics data, only if you accept analytics cookies (section 6);
- what you fill in on a form, such as name, business email, company and message.
When you open an account and use MISE
- account data: name, business email, password (stored only as a secure hash by our authentication provider), company name, role, language and your workspace settings;
- billing data: company name, address, enterprise or VAT number, plan, invoices and payment status. Your card or bank details are handled by Mollie; we only receive a reference, the payment method type and, for cards, the last digits;
- usage data: which features you use, jobs you start, credits used, errors, and logs of logins and actions with time and IP address, for security and to fix problems;
- connection data: when you connect a social, shop or email account, the account name and an access token. Tokens are stored encrypted and only used for what you ask in MISE;
- support data: your emails and messages to us.
When you connect a social account
You can connect TikTok, Pinterest, Instagram and Facebook (Meta) and LinkedIn accounts to MISE. You choose which accounts to connect, and you can disconnect them at any time.
| Platform | Permissions we ask for | What we receive and keep | What we use it for |
|---|---|---|---|
| TikTok (Login Kit and Content Posting API) | user.info.basic, video.publish | Your TikTok open ID, display name and profile picture, and an access token | To show which account is connected, and to publish (Direct Post) videos that a person in your workspace approved and planned |
| user_accounts:read, boards:read, boards:write, pins:read, pins:write | Your account name, your boards, and an access token | To let you choose a board, to create Pins that were approved and planned, and to read the results of those Pins | |
| Meta (Facebook Pages and Instagram business accounts) | pages_show_list, pages_read_engagement, pages_manage_posts, instagram_basic, instagram_content_publish, business_management; when you switch on results also instagram_manage_insights and read_insights | The names, IDs and pictures of the Pages and Instagram accounts you choose, the name of the person who connected them, and an access token | To publish posts that were approved and planned, and to read the results of those posts |
| r_basicprofile, w_organization_social, r_organization_social, rw_organization_admin | Your name, the company pages you manage and choose, and access and refresh tokens | To publish posts that were approved and planned on the company page you chose, and to read the results of those posts |
How we handle this data:
- Access tokens are stored encrypted (AES-256-GCM). Only our server can read them, and no one in your workspace can see them.
- We only use a connection to publish content that a person in your workspace approved and planned, and to read the results of those posts (such as views, likes and comments counts). We never post anything you did not approve.
- We do not use this data for advertising, we do not sell it, and we do not share it with anyone except the platform itself.
- Disconnect on the Accounts page deletes the access token straight away. The account name stays in your workspace history, marked as disconnected, until your workspace is deleted.
- You can also remove MISE's access in the security or app settings of TikTok, Pinterest, Facebook, Instagram or LinkedIn. We then can no longer publish or read results.
- To have all data from a connected account deleted, email hello@modus-ops.be. We delete it within one month and confirm by email.
When you review a post through an approval link
- your name and, if the sender gave it, your email address, your decision and comments, and the time;
- a shortened, salted hash of your IP address, only to block abuse of the link. We cannot read your IP address back from it.
The approval link itself works for 14 days.
3. Why we use data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide the account, the platform and support | Contract, art. 6.1.b |
| Bill, collect payments, keep accounts | Legal obligation, art. 6.1.c, and contract, art. 6.1.b |
| Security, fraud prevention, abuse limits, logs | Legitimate interest in a safe service, art. 6.1.f |
| Improve MISE with aggregated usage data | Legitimate interest, art. 6.1.f |
| Answer contact forms and follow up on demos and quotes | Steps before a contract, art. 6.1.b, or legitimate interest, art. 6.1.f |
| Service emails (approval requests, renewals, changes to terms) | Contract, art. 6.1.b |
| Newsletter and marketing emails | Consent, art. 6.1.a, or for existing customers our legitimate interest under the soft opt-in rule, with an easy way to stop at any time |
| Website analytics with cookies | Consent, art. 6.1.a |
| Comply with requests from authorities and defend legal claims | Legal obligation, art. 6.1.c, and legitimate interest, art. 6.1.f |
We do not make decisions about you based only on automated processing that have legal or similarly significant effects (article 22 GDPR).
4. AI and your data
- We use AI models from carefully chosen providers to make ideas, texts, images, video and audio.
- We only use their business APIs. Under those terms they do not train their models on our customers' data, or we have switched training off.
- Providers may keep data for a short time to detect abuse, under their own terms (for example up to 30 days). The list shows where this applies.
- We do not use your content or personal data to train AI models of our own.
- Images and video made in MISE with Google's models carry Google's SynthID watermark. We are working on adding C2PA metadata to exported files, in line with article 50 of the AI Act.
5. How long we keep data
| Data | Retention |
|---|---|
| Account and workspace content | While your account is active. After the end, 30 days for export, then deleted. Backups roll over within 35 more days |
| Trial workspaces without a plan | 30 days after the trial ends |
| Invoices and accounting records | As long as Belgian accounting and VAT law requires (up to 10 years) |
| Contract and correspondence | 5 years after the end of the contract, the limitation period for contract claims (article 2262bis Civil Code) |
| Access tokens of connected social accounts | Until you disconnect the account or the platform revokes access; deleted straight away on Disconnect |
| Security and access logs | 90 days |
| Approval link data | As long as the post and workspace exist; IP hashes for abuse limits 30 days |
| Leads and contact forms without a contract | 12 months |
| Marketing consent and unsubscribe records | As long as we send emails, and proof of consent up to 3 years after |
| Website analytics | 14 months, aggregated |
6. Cookies and similar technology
In the app we only use cookies and local storage that are strictly necessary: the login session cookie of our authentication provider, security cookies, and your display choice (light or dark). These do not need consent.
On our public pages (such as this policy and the terms) we use no analytics or marketing cookies at the moment. If we add them, we will ask for your consent first and update this policy. On the MISE website we count visits anonymously with Cloudflare Web Analytics, which sets no cookies and does not follow you across sites.
Fonts. The app serves its own fonts. When a brand uses a Google font in its brand kit, previews of that brand's templates load the font from Google Fonts, which sends your IP address to Google.
7. Who we share data with
We only share data with providers that help us run MISE, and only as much as they need:
- hosting, database and file storage, in London, United Kingdom;
- providers of AI models for text, images, video and audio;
- research and data providers, for public data about brands and trends;
- automation and email providers, for service emails;
- our payment provider;
- our accountant and the Belgian tax authorities, when the law requires it.
Customers can see the named list of these providers, with purpose and location, in the app and in our data processing agreement. Others can ask for it at hello@modus-ops.be.
Social platforms, shops and email tools you connect yourself (such as Meta, LinkedIn, Pinterest, TikTok, Shopify and Klaviyo) are your own choice. We send data to them on your instruction. They use it under their own privacy policies.
We do not sell personal data and we do not share it with advertising networks.
8. Transfers outside the European Economic Area
- Our database, storage and app servers are in London. The European Commission considers the United Kingdom to offer an adequate level of protection (adequacy decision under article 45 GDPR).
- Some providers, such as AI providers, are based in or process data in the United States. We rely on the EU-US Data Privacy Framework for certified providers, and otherwise on the Standard Contractual Clauses (Decision (EU) 2021/914) with extra measures where needed.
- You can ask us for a copy of the safeguards that apply.
9. Security
- encrypted connections (TLS) everywhere and encryption at rest by our hosting providers;
- strict access rules in the database, so each workspace only sees its own data;
- private file storage with short-lived signed links;
- social and shop tokens encrypted with AES-256-GCM, with the key kept only on the server;
- multi-factor authentication on our admin accounts and least-privilege access for staff;
- passwords stored only as a secure hash by our authentication provider;
- logs and limits to detect and block abuse.
10. Your rights
You have the right to:
- access the data we hold about you (article 15 GDPR);
- correct it (article 16);
- have it deleted (article 17);
- restrict its use (article 18);
- receive it in a readable format and take it elsewhere (article 20);
- object to use based on our legitimate interest, and to direct marketing at any time (article 21);
- withdraw your consent at any time, without affecting what was done before (article 7).
Email hello@modus-ops.be. We answer within one month. We may ask you to prove who you are.
If you are not happy with our answer, you can complain to the Belgian Data Protection Authority:
Gegevensbeschermingsautoriteit / Autorité de protection des données
Drukpersstraat 35, 1000 Brussels
www.gegevensbeschermingsautoriteit.be · contact@apd-gba.be
11. Data breaches
If a breach puts your rights at risk, we report it to the Data Protection Authority within 72 hours after we become aware of it (article 33 GDPR). If the risk is high, we also tell you directly (article 34). For customer content, we inform the customer as set out in the DPA.
12. Children
MISE is for businesses. We do not knowingly collect data from children under 16. If it happens, we delete it as soon as we know.
13. Changes
We update this policy when MISE or the law changes. The version and date at the top show the latest change. We tell active customers by email about changes that affect their rights.
14. Contact
hello@modus-ops.be. A person answers within one month, usually much sooner.
ZESTOLOGY BV · BE 1013.413.339 · hello@modus-ops.be