Compliance & Legal
ModiFile's zero-data architecture inherently complies with global privacy regulations.
GDPR (General Data Protection Regulation)
Status: ✅ Fully Compliant
Under GDPR, we are not required to:
- Provide data access requests — we have no data
- Honor deletion requests — data auto-deletes in 90s
- Appoint a Data Protection Officer — no data processing
- Conduct impact assessments — no personal data involved
CCPA (California Consumer Privacy Act)
Status: ✅ Fully Compliant
Under CCPA:
- No personal information collected
- No data sold to third parties
- No consumer rights requests needed
- No opt-out mechanisms required
COPPA (Children's Online Privacy Protection)
Status: ✅ Compliant
We collect zero data from any users, including children. No age verification is needed because no data is collected.
ePrivacy Directive (EU Cookie Law)
Status: ✅ Compliant
We use zero cookies. No cookie consent banner is needed because there are no cookies to consent to.
Why Zero Data = Full Compliance
Privacy regulations exist to protect user data. When no data is collected, stored, or processed, compliance is inherent. Our architecture makes privacy the default, not an afterthought.
How zero-collection architecture keeps you compliant automatically
Most online converters promise to delete your files "after processing." ModiFile never receives them in the first place. Conversion happens in your browser using WebAssembly: your document is opened, transformed and saved on your own device. There is no upload step, so there is no file-retention policy to trust, no GDPR Article 17 request to make, and no breach notification scenario that can apply to your documents.
For businesses this distinction matters in procurement. Under GDPR, any vendor that processes personal data on your behalf is a data processor requiring a Data Processing Agreement (DPA). Because ModiFile processes nothing server-side, it generally falls outside processor status for your file contents — a fact our zero-knowledge design makes verifiable rather than merely promised. Teams converting HR documents, contracts, medical records or ID scans can do so without adding a new vendor to their Records of Processing Activities (Article 30 register).
COPPA and ePrivacy receive the same treatment: with no behavioural profiling, no third-party advertising cookies and no personal data captured at conversion time, the consent surface shrinks to the bare minimum that keeps the service free to use. Compliance here is not a department — it is the absence of data to comply about.