1. Who We Are

Modus Technologies Inc. and Modus Artificial Intelligence Ltd. ("Modus," "we," "our," or "us") offer an agentic workforce for data teams, allowing you to create automations of any data work. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you use our website (https://www.getmodus.com) and the Modus web application (together, the "Services").

2. Scope

This Policy applies to any person who visits our website or uses the Modus web application. When we process personal data on your behalf (for the performance of a contract), the Data Processing Agreement (DPA) shall apply, not this Privacy Policy.

3. Information We Collect

Category	What We Collect	Purpose	Legal Basis (e.g. EU/UK)
Account Data	Name, email address, authentication identifier (OAuth or email-based)	Account creation, authentication	Contract performance with you
Usage Metrics, Cookies and similar technologies	IP address, time and date of access, type of device and browser used, language used, pages visited, feature interactions, error events, volumes of usage (via Datadog)	Facilitate a feature specifically requested, product analytics, debugging, service improvement, inform and serve personalized ads more relevant to user interests	If essential — Legitimate interest in providing you with the functionality of the Service If non-essential — consent
Contacting us with an inquiry through our email and our online contact form, booking a demo	Full name, work email, company, job title, company size, and text message	Reply, schedule demos and follow up	Legitimate interest in responding to your inquiry or demo request and our business development
AI Interaction Metadata	Structural metadata about prompts and responses (never raw content)	Model quality improvement, troubleshooting	Legitimate interest in developing and enhancing our business and the Service
User-Uploaded Content	Datasets, notebooks, dashboards, reports you choose to import or publish	Core functionality	Contract performance with you
Integration Data	Data imported through database integrations (e.g., BigQuery, Snowflake, PostgreSQL, MySQL, Clickhouse, Oracle, Databricks, SQLite, CSV files), including table schemas, query results, and metadata	Core functionality, data analysis	Contract performance with you
Technical Data	Device type, OS version, app version, IP-derived region	Security, fraud prevention, analytics	Legitimate interest in developing and enhancing our business and the Service, defending and enforcing against violations and breaches that are harmful to our business

4. How We Use Information

• Provide, operate, and maintain the Services
• Authenticate users and secure accounts
• Diagnose and fix bugs or performance issues
• Improve and develop new features (excluding the use of Google Workspace data or personal data to train or develop AI/ML models)
• Send service-related notices (e.g., critical updates)
• Comply with legal obligations

5. AI Processing Details

Question	Answer
Third-party providers	Anthropic, OpenAI, and Google; all via paid, no-data-retention endpoints
Data sent	Text you explicitly run through AI features, project structure, and relevant code or schema snippets
PII transmission	Sensitive data is detected and protected through built-in DSPM and DLP controls (redaction, masking, flagging, blocking) before reaching the AI context window.
Vendor training	Vendors are contractually opted-out of training on your content
Our own training	We do not use Google Workspace data (including Google Drive content) or personal data to train or develop AI/ML models. Any model training is limited to aggregated, de-identified, non-personal statistics, and never uses raw user content.
Opt-out	Core AI processing and AI metadata reporting cannot be disabled because they underpin Modus's functionality

6. How We Share Information

We share information only with the subprocessors necessary to run Modus:

Mandatory Subprocessors

Subprocessor	Purpose
AWS	Cloud hosting and storage infrastructure
Google Cloud Platform (GCP)	Cloud infrastructure and services
ClickHouse	Database and analytics processing
Clerk	Authentication and user management
Datadog	Product analytics and monitoring
Anthropic	AI model provider
OpenAI	AI model provider
Google	AI model provider

Optional Subprocessors (Add-ons)

The following subprocessors are only used if you enable specific add-on features:

Subprocessor	Purpose
Pipedream	Workflow automation and integrations
E2B	Code execution and sandboxing environment
Mem0	Memory and context management for AI
Tavily	AI-powered web search and research

Each subprocessor is bound by a Data Processing Agreement (DPA) and Standard Contractual Clauses (SCCs) or Data Privacy Framework participation where applicable. See our Data Processing Agreement for reference.

7. Data Location & International Transfers

Your data is hosted in the cloud on servers primarily located in the United States (AWS), though the specific region may vary. Data may be transferred internationally for AI processing and analytics. We rely on Standard Contractual Clauses (SCCs) or other recognized safeguards for such transfers. California residents should note that their data may be transferred outside of California and the United States for processing.

8. Security

Modus maintains a SOC 2 Type II report (covering Security, Availability, and Confidentiality, including HIPAA Security Rule mapping) audited by Kost Forer Gabbay & Kasierer (EY Israel). Modus is also certified to ISO/IEC 27001:2022 (Certificate No. 1127587, issued by SII-QCD, ANAB accredited and IQNET recognized; valid through May 2029). Reports and certificates are available to customers under NDA via security@getmodus.com.

• TLS encryption for all in-transit data leaving your device
• Encryption-at-rest for any cloud-stored secrets and published content
• Secrets (e.g., API keys, passwords) stored in OS-level secure keychains
• Access to production systems limited to a small, vetted Modus team on a least-privilege basis
• Continuous monitoring and automated alerts via Datadog

9. Retention

• Cloud-hosted data: retained until you request deletion
• Tenant deletion: completed within 30 days of your verified deletion request
• Account records and logs: retained until you request deletion, then erased as part of tenant deletion process
• Backup copies: may persist in encrypted backups for up to 7 days before permanent deletion

10. Your Rights (Including EU/UK Rights)

Modus is the data controller of the personal information collected in accordance with this Policy, and the data processor for the information collected in the performance of a contract, as further explained in the DPA.

Modus EU GDPR Representative

Modus UK GDPR Representative

You have the right to review the personal information we collect and use about you and the right to request correction of your personal information. To exercise these rights, please contact us at contact@getmodus.com.

If you are an EU or UK data subject, or under applicable jurisdiction with similar rights as granted under the GDPR, you have the:

How to exercise:

• Trust Center: We provide you with an easy way to submit to us privacy related request like a request to access or erase your personal data. If you want to make use of your data subject rights, please access the above privacy request links or visit our Trust Center: https://app.prighter.com/portal/modus.
• Account data: email contact@getmodus.com from your registered address.
• In-app data: use the data management tools within the application settings.

When you contact us, we reserve the right to ask for reasonable evidence to verify your identity before we provide you with information. Where we are not able to provide you with information that you have asked for, we will explain the reason.

We will respond to requests within 30 days (45 days for individuals in the United States). Deletion from cloud storage requires a manual tenant deletion process, which will be completed within 30 days.

Subject to applicable law, you have the right to lodge a complaint with your local data protection authority. If you are in the EU, then according to Article 77 of the GDPR, you can lodge a complaint to the supervisory authority, in the Member State of your residence, place of work or place of alleged infringement of the GDPR. For a list of supervisory authorities in the EU, click here.

If you are in the UK, you can lodge a complaint to the Information Commissioner's Office (ICO) pursuant to the instructions provided here. You can also lodge a complaint to Modus, as a Controller, for the personal information described in this Privacy Policy, by filling an electronic complain form at the following link https://app.prighter.com/dsrtool/new/dsr_uk/18019768846.

10A. Additional Information for Individuals in the United States

If you are an individual residing in the United States, we provide you with the following information pursuant to state privacy laws, such as the California Consumer Privacy Act of 2018, as amended (CCPA) and the Texas Data Privacy and Security Act (TDPSA).

Categories of Personal Information We Collect

We collect the following categories of personal information, as described in Section 3 above:

• Identifiers (name, email address, OAuth identifier). Source of Information: The consumers themselves.
• Internet or network activity (usage metrics, browsing history on our site). Source of Information: The consumers' device.
• Professional or employment-related information (if included in datasets you upload). Source of Information: The consumers themselves.
• Inferences drawn from the above to create user profiles. Source of Information: The consumers themselves.

How We Use Personal Information & Business Purposes

We use personal information for the business and commercial purposes described in Section 4 of this Privacy Policy, and for the following business purposes:

• Providing you with the functionality of our Service to you.
• Maintaining or servicing accounts, providing customer service.
• Detecting security incidents and protecting against malicious, deceptive, fraudulent, or illegal activity.
• Undertaking activities to verify or maintain the quality of the Service and to improve, upgrade or enhance the Service.
• Debugging to identify and repair errors.

Disclosures to third parties

We do not sell your personal information and have not done so in the past 12 months. We do not share your personal information for cross-context behavioral advertising.

The list below explains with whom we disclosed your personal information for a business purpose in the preceding 12 months. Other than this, we have not disclosed your personal information for a business purpose in the preceding 12 months:

• Our service providers, who will use it only as necessary to assist us in the internal operations of our business and the Service, and not for their own promotional purposes. In general, we share personal information with service providers (subprocessors listed in Section 6) who perform services on our behalf.
• Third party cookie providers, for the same purposes indicated in the chart above.
• Competent authorities, legal counsels, and advisors if you abused your rights to use the Service or violated any applicable law in the course of doing business with us.
• Judicial, governmental, or regulatory authority if they require us to disclose your information.
• Target entity of the merger or acquisition, legal counsels, and advisors if the operation of the Service or our business is organized within a different framework, or through another legal structure or entity.

Your rights if you reside in the United States

Data Retention

We retain personal information as described in Section 9 of this Privacy Policy. California residents can request deletion at any time, subject to legal exceptions.

How to Exercise Your US Rights

To exercise your US rights, you may:

• Email us at: contact@getmodus.com
• Registered Agent Address: Cogency Global Inc. at 850 New Burton Road, Suite 201, Dover DE 19904, 800-483-1140.
• Use the data management tools in your account settings

You will need to verify your identity before we can fulfill your request, by using a two or three points of data verification process, depending on the type of information you require and the nature of your request. We will respond within 45 days of receipt of your request. If we require more time, we will inform you of the reason and extension period in writing.

Authorized Agents

You may designate an authorized agent to make a request on your behalf. To do so, you need to provide the authorized agent with written permission to do so, and the agent will need to submit to us proof that they have been authorized by you. We will also require that you verify your own identity, as explained above.

Shine the Light Law

California Civil Code Section 1798.83 permits California residents to request certain information about disclosure of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

10B. Health Information (HIPAA)

Where Modus processes Protected Health Information (PHI) on behalf of customers under a Business Associate Agreement (BAA), such data is handled in accordance with the HIPAA Privacy and Security Rules. Modus does not collect PHI directly from individuals. PHI processing is governed by the terms of the applicable BAA.

For questions about how Modus handles PHI, contact privacy@getmodus.com.

11. "Do Not Track" Disclosures

We do not monitor or respond to Do Not Track browser requests. Please ensure to change any settings of your browser and/or our Service, whenever you wish cookies to cease.

12. Children

Modus is not directed to children under 16, and we do not knowingly collect data from minors. If you believe a minor has provided personal data, please contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced in-app or via email at least 14 days before they take effect. Continued use of the Services after the effective date constitutes acceptance of the revised Policy.

14. Contact Us

1. Definitions

Term	Definition
Applicable Data Protection Law	All laws and regulations regarding the protection of Personal Data that apply to the Processing under this Agreement, including the EU and UK GDPR.
Personal Data	Any information relating to an identified or identifiable natural person that is Processed by Modus on behalf of Customer.
Processing, Processor, and Controller	Have the meanings set out in Applicable Data Protection Law.
Standard Contractual Clauses	The clauses adopted by the European Commission Implementing Decision 2021/914 and, where relevant, the UK Addendum.
Services	The Modus web application and any related cloud features provided to Customer.

2. Subject Matter and Duration

• 2.1 This Agreement governs Modus's Processing of Personal Data on behalf of Customer in the course of providing the Services.
• 2.2 This Agreement remains in force for the term of the underlying Services agreement and until all Personal Data has been deleted or returned to Customer.

3. Purpose and Nature of Processing

Modus Processes Personal Data solely to provide, secure, and improve the Services, including:

• Web-based analytics platform functions
• Cloud storage and publication of notebooks, dashboards, and reports
• Error monitoring, usage analytics, and product development
• Automated AI-powered analysis using third-party model providers (see Annex III)

4. Categories of Data and Data Subjects

Item	Description
Data Subjects	Customer's employees, contractors, end users, and any individuals whose data appears in datasets Customer imports
Categories of Personal Data	Names, email addresses, authentication identifiers (OAuth or email-based), usage metrics (pseudonymous), technical device data, any Personal Data included by Customer in uploaded datasets or published reports
Special Categories	Not intended – Customer must not intentionally submit special-category data without a lawful basis

Full details appear in Annex I.

5. Obligations of Controller

Customer will:

6. Obligations of Processor

Modus shall:

• 6.1 Process only on documented instructions – including those set out in the Agreement, unless otherwise required by EU or Member State law.
• 6.2 Confidentiality – ensure all personnel authorised to Process Personal Data are subject to confidentiality obligations.
• 6.3 Security – implement the technical and organisational measures in Annex II and maintain them throughout the term.
• 6.4 Sub-processors – engage only the sub-processors listed in Annex III and notify Customer of any intended additions or replacements, giving Customer an opportunity to object on reasonable grounds.
• 6.5 Data Subject Rights – taking into account the nature of the Processing, assist Customer by appropriate technical and organisational measures to respond to requests for exercising data-subject rights.
• 6.6 Data Protection Impact Assessments – provide reasonable assistance to Customer with DPIAs and prior consultations with supervisory authorities where required.
• 6.7 Breach Notification – notify Customer without undue delay after becoming aware of a Personal Data Breach and provide information necessary for Customer to comply with its legal obligations.
• 6.8 Return or Deletion – at termination, delete or return Personal Data at Customer's choice, except to the extent EU or Member State law requires retention.

7. International Transfers

• 7.1 Where Modus or its sub-processors transfer Personal Data outside the EEA or UK to a country that has not received an adequacy decision, such transfer shall be governed by the Standard Contractual Clauses incorporated by reference.
• 7.2 For transfers to the United States, Modus or the relevant sub-processor will rely on either the Data Privacy Framework certification or the SCCs.

8. Audits

Modus will make available all information necessary to demonstrate compliance with this Agreement and allow, at Customer's reasonable request and expense, audits by an independent third party bound to confidentiality. Audits may occur once per year and after any material Personal Data Breach.

9. Liability and Indemnity

Each party is liable for the damages it causes by any Processing that infringes Applicable Data Protection Law. Liability limitations in the main Services agreement apply to this Agreement to the maximum extent permitted by law.

10. Precedence

In the event of conflict, the provisions of the Standard Contractual Clauses prevail, followed by this Agreement, followed by the main Services agreement.

11. Governing Law

This Agreement is governed by the same law and jurisdiction as the main Services agreement, unless the SCCs require otherwise.

Annex I – Details of Processing

Element	Description
Processor	Modus Technologies Inc., Delaware, and Modus Artificial Intelligence Ltd., Tel Aviv-Yafo, jointly "Modus".
Controller	The Customer entity that accepted the Modus Terms of Service
Purpose	Provide and improve the Modus Services, including AI-powered analytics, publishing features, account management, security, and support
Data Subjects	See Section 4
Personal Data	See Section 4
Duration	For the term of the Services plus deletion period
Frequency	Continuous and ad-hoc, depending on user interactions
Location of Processing	Cloud-based operations primarily in the United States (AWS, region may vary) and AI processing as listed in Annex III

Annex II – Technical and Organisational Security Measures

Encryption

• TLS 1.2+ for all data in transit leaving the user's device
• AES-256 or stronger encryption for secrets stored in the cloud

Access Control

• Role based access with least-privilege principle
• Multi-factor authentication for privileged accounts

Physical Security

• Cloud infrastructure hosted in ISO 27001 and SOC 2 certified data centres operated by AWS.

Certifications and Attestations

Modus maintains the following independent attestations and certifications, with reports available to customers under NDA via security@getmodus.com:

• SOC 2 Type II report covering Security, Availability, and Confidentiality, including HIPAA Security Rule mapping. Auditor: Kost Forer Gabbay & Kasierer (EY Israel).
• ISO/IEC 27001:2022 certification. Certificate No. 1127587. Issued by SII-QCD (ANAB accredited, IQNET recognized).

System Security

• Separation of production and development environments
• Automated dependency vulnerability scanning
• Regular penetration testing

Monitoring and Logging

• Centralised logging with tamper protection
• Real-time alerting via Datadog for anomalous events

Business Continuity

• Encrypted backups of published content
• Disaster recovery plan tested at least annually

Personnel Security

• Background checks for employees with production access
• Mandatory security awareness training

Incident Response

• Documented procedure defining roles, escalation paths, and customer communication timelines

Annex III – Approved Sub-processors

Mandatory Sub-processors

Sub-processor	Description
Amazon Web Services (AWS)	Cloud hosting and storage infrastructure
Google Cloud Platform (GCP)	Cloud infrastructure and services
ClickHouse	Database and analytics processing
Clerk	Authentication and user management
Datadog	Product analytics and monitoring
OpenRouter	AI model routing and inference platform

Optional Sub-processors (Add-ons)

The following sub-processors are only utilized if you enable specific add-on features:

Sub-processor	Description
Pipedream	Workflow automation and integrations
E2B	Code execution and sandboxing environment
Mem0	Memory and context management for AI
Tavily	AI-powered web search and research