Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that Modal Labs may collect personally identifiable information including name, phone number, and postal address, used for purposes of contact and identification.
This analysis describes what Modal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The provision uses an open-ended 'including but not limited to' formulation that does not limit collection to the listed categories, which means actual data collection could extend beyond name, phone number, and postal address without additional disclosure. Compliance teams should evaluate whether the categories disclosed align with actual data processing activities.
Interpretive note: The 'including but not limited to' formulation creates uncertainty about the full scope of personal information that may be collected under this provision.
Under this clause, users who engage with the service may be required to provide name, phone number, and postal address, and the open-ended language of the provision does not restrict collection to those specific identifiers.
Cross-platform context
See how other platforms handle Personal Information Collection and similar clauses.
Compare across platforms →Monitoring
Modal has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"For a better experience while using our Service, we may require you to provide us with certain personally identifiable information, including but not limited to your name, phone number, and postal address. The information that we collect will be used to contact or identify you.Excerpt from Modal's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision implicates GDPR requirements for specifying the categories of personal data collected and the purposes for which they are processed, as well as CCPA requirements for disclosing categories of personal information collected. The FTC Act's prohibition on deceptive practices is relevant if actual data collection extends materially beyond disclosed categories. (2) GOVERNANCE EXPOSURE: Medium. The 'including but not limited to' formulation creates an open category of collectible personal information that is not bounded by the policy language, which may be insufficient under GDPR's principle of data minimization and purpose limitation, or CCPA's category-specific disclosure requirements. (3) JURISDICTION FLAGS: EU and EEA users are subject to GDPR, which requires that personal data collection be grounded in a specified lawful basis and that categories of data collected be clearly disclosed. California residents are subject to CCPA, which requires disclosure of specific categories of personal information collected. (4) CONTRACT AND VENDOR IMPLICATIONS: Organizations that process personal data on behalf of their own users and transmit that data to Modal Labs as a cloud computing vendor should evaluate whether this disclosure is sufficient to satisfy their own downstream privacy policy obligations. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that the actual categories of personal data collected by Modal Labs match those disclosed in this provision, and should evaluate whether a GDPR-compliant lawful basis statement and a CCPA-compliant categories disclosure are required given the platform's user geography.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The provision uses an open-ended 'including but not limited to' formulation that does not limit collection to the listed categories, which means actual data collection could extend beyond name, phone number, and postal address without additional disclosure. Compliance teams should evaluate whether the categories disclosed align with actual data processing activities.
Under this clause, users who engage with the service may be required to provide name, phone number, and postal address, and the open-ended language of the provision does not restrict collection to those specific identifiers.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Modal.