Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that Modal Labs automatically collects log data on each visit, including IP address, browser version, pages visited, visit timestamps, time spent on pages, and unspecified 'other statistics.'
This analysis describes what Modal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
IP addresses are classified as personal data under GDPR in the EU, and the inclusion of 'other statistics' creates an open-ended category of automatically collected data that is not bounded by the provision's enumerated examples. The policy does not state a retention period for log data.
Interpretive note: The phrase 'other statistics' is undefined, leaving the full scope of log data collection indeterminate from the document text alone.
Under this clause, each visit to modal.com results in automatic collection of IP address, browser version, page visit history, timestamps, and additional unspecified statistics, without a stated retention period or user mechanism to access or delete this data.
Cross-platform context
See how other platforms handle Log Data Collection and similar clauses.
Compare across platforms →Monitoring
Modal has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We want to inform you that whenever you visit our Service, we collect information that your browser sends to us that is called Log Data. This Log Data may include information such as your computer's Internet Protocol ("IP") address, browser version, pages of our Service that you visit, the time and date of your visit, the time spent on those pages, and other statistics.Excerpt from Modal's Privacy Policy
(1) REGULATORY LANDSCAPE: Under GDPR, IP addresses are generally classified as personal data, which means log data collection implicates GDPR requirements for lawful basis, retention limitation, and data subject rights. The policy does not address any of these requirements. CCPA requires disclosure of categories of personal information collected, and log data including IP addresses and browsing history falls within defined CCPA categories. (2) GOVERNANCE EXPOSURE: Medium. The open-ended 'other statistics' language means the full scope of automatically collected data is not disclosed, which may be inconsistent with GDPR transparency requirements and CCPA category disclosure obligations. The absence of a retention period for log data is a notable gap. (3) JURISDICTION FLAGS: EU and EEA users have heightened exposure given that IP addresses are personal data under GDPR. California residents are subject to CCPA provisions covering browsing history and network activity as enumerated categories of personal information. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers and developers using Modal Labs as a cloud computing platform should evaluate whether automatic log data collection by Modal Labs affects their own data processing obligations under applicable laws. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should assess whether a lawful basis for log data collection is documented internally, whether log data retention schedules exist, and whether user rights requests can be fulfilled with respect to log data given the absence of a disclosed mechanism.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
IP addresses are classified as personal data under GDPR in the EU, and the inclusion of 'other statistics' creates an open-ended category of automatically collected data that is not bounded by the provision's enumerated examples. The policy does not state a retention period for log data.
Under this clause, each visit to modal.com results in automatic collection of IP address, browser version, page visit history, timestamps, and additional unspecified statistics, without a stated retention period or user mechanism to access or delete this data.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Modal.