Skip to main content
Modular Reality

Privacy Policy

Last update: October 25, 2026

At Modular Reality, the protection of your personal data is a fundamental priority. This policy details how we collect, use, and protect your information in accordance with international data protection regulations.

1. Information Collection

We collect only the data necessary for the provision of our services and the management of your orders:

  • Contact info: Full name and email address. Email is pre-filled from your account registration and can be changed during checkout.
  • Shipping info: Physical address for hardware product delivery. Optionally, a phone number for courier use only (delivery notifications, access coordination). This field is voluntary and never used for marketing purposes.
  • Notification channels (optional): If you choose to receive Telegram notifications, we store your Telegram chat identifier (chat_id) obtained through a voluntary linking process with @ModularRealityBot. If you choose WhatsApp, we store the phone number you provide. Both are used exclusively to send order status notifications and are never shared with third parties or used for marketing.
  • Notification preferences: Your choices about which types of communications you wish to receive (order updates, newsletter, promotions).
  • Technical data: Minimum info about device and browser to ensure account security and session persistence.

2. Use of Information

Your information is used exclusively for the following purposes:

  • Processing and delivery of physical and digital orders.
  • Sending order status notifications via your chosen channel (email, Telegram, or WhatsApp), only if you have configured that preference.
  • Management and security of your user account.
  • Compliance with legal and tax obligations.
  • Improvement of service and technical customer support.

3. Data Storage and Security

We implement high-level security measures to protect your information against unauthorized access or data loss:

  • Encryption: We use military-grade encryption protocols (AES-256) for the storage of sensitive data.
  • Authentication: We offer two-factor authentication systems (2FA) to strengthen the security of your access.
  • Technical persistence: We use Local Storage and functional Cookies to keep your session active and remember your display preferences: language, visual theme, and preferred payment currency (mr_currency). These cookies have a maximum duration of 1 year and are not used for tracking purposes.

4. User Rights

You maintain full control over your personal information. You have the right to access, rectify, port, or request the deletion of your data at any time through your account settings panel or by contacting our support team.

5. Clarity in Terminology

While our platform may aesthetically use narrative terms to improve user experience, all technical and security processes described here are governed by the professional and legal standards mentioned above.

6. Sweepstakes Engagement Data (Instagram/Meta and YouTube/Google)

If you take part in our free engagement sweepstakes, we process additional data for the sole purpose of verifying your participation and, where applicable, delivering your prize. Account linking is voluntary and can be revoked at any time.

  • Instagram (Meta): via Instagram Login (OAuth) we access your Instagram user ID and username and the public mentions/comments that reference our account, for the sole purpose of verifying the actions that grant entries. We use Meta's Instagram Graph API.
  • YouTube (Google): via Google OAuth, using the read-only scope youtube.readonly, we access your YouTube channel ID and your subscription status to our channel, for the sole purpose of verifying the actions that grant entries. This feature uses YouTube API Services. By using it, you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy (https://policies.google.com/privacy). You can revoke this application's access to your Google data at any time via the Google security permissions page (https://myaccount.google.com/permissions).
  • Prize shipping data (winners only): full name and postal address, used exclusively to ship the prize via the courier (クリックポスト/ネコポス in Japan, 小形包装物 international).
  • Email address: for sweepstakes-related notices.
  • Legal basis: your consent, given when you link accounts and participate.
  • Retention: social media identifiers are kept while the account remains linked and are deleted upon unlinking. A winner's postal address is deleted 90 days after delivery is confirmed; only a minimal shipment accounting record (without the full address) is kept for the period required by Japanese tax law.
  • Your rights: you may unlink each network, withdraw consent, and request access, rectification, or deletion of your data at any time from your account panel or by writing to [email protected].

7. Google User Data: Use, Sharing, Transfer and Disclosure

This section applies to all data that Modular Reality obtains through Google APIs (YouTube Data API) after you grant access on Google's consent screen.

  • Data we access with youtube.readonly (any user who links YouTube): your YouTube channel ID, your channel handle and whether you are subscribed to our channel. To re-check the subscription when the draw takes place, we also store the OAuth refresh token that Google issues. We do not access your videos, comments, playlists or any other YouTube data.
  • Data we access with youtube.upload (Modular Reality staff only): this permission is used exclusively by authorized Modular Reality staff to upload videos produced by Modular Reality to Modular Reality's own YouTube channels (Modular Reality and Duality TCG). It is never requested from customers or visitors, and we never upload content to, or modify, any user's YouTube channel.
  • How we use it: only to provide the features described above. We do not use Google user data for advertising, profiling or marketing, we do not sell it, and we do not use it to develop, improve or train generalized or non-personalized AI/ML models.
  • Sharing, transfer and disclosure: we do not sell, rent, share, transfer or disclose Google user data to third parties. The only exceptions are: (a) Google/YouTube itself, as data is exchanged with Google's APIs to perform the action you requested (for example, an uploaded video is sent to YouTube); (b) our network provider, Cloudflare, Inc., through which the encrypted traffic of our website passes and which acts only on our behalf, without using the data for its own purposes; (c) when required by law or by a valid legal request from a competent authority; and (d) with your explicit prior consent. Google user data is stored on servers owned and operated by Modular Reality; no other company stores it.
  • Human access: Modular Reality staff do not read Google user data, except when you ask for it (for example, for support), when needed for security purposes, or to comply with applicable law.
  • Limited Use: Modular Reality's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
  • Retention and deletion: the channel ID, handle and refresh token are deleted as soon as you unlink YouTube from your account. You can revoke access at any time from https://myaccount.google.com/permissions, or ask us to delete your data by writing to [email protected], and we will delete it.

8. What you buy, on our social media

In our daily video and posts on social media we show, anonymously, items customers buy from us through «Te lo consigo»: only the item (its title, photo and price), never who bought it, their notes, photos or any personal data.

  • If you don't want your purchase to appear, tick «I don't want what I buy to appear on social media» on your purchase page or in «My purchases». It can be changed at any time and it is always respected.
  • Only if you expressly ask us, your purchase can appear with the name you choose (for example, «Bought by Carlos»). Ask us to remove it whenever you want.
  • Showing your purchase gives no discount or advantage, and not showing it takes nothing away.