Last updated: October 20, 2025
Endless Machine Corp. ("The Company", "Mod") uses the following third-party service providers (subprocessors) to provide and support our services. These subprocessors may process customer data on our behalf.
Authentication & User Management
Clerk
- Provider: Clerk, Inc.
- Purpose: User authentication, session management, and organization/team management
- Data Processing Location: United States
- Category: Essential service functionality
- Privacy Policy: https://clerk.com/legal/privacy
Database & Storage
Supabase
- Provider: Supabase, Inc.
- Purpose: PostgreSQL database
- Data Processing Location: United States
- Category: Essential service functionality
- Privacy Policy: https://supabase.com/privacy
Google Cloud Platform (Storage)
- Provider: Google LLC
- Purpose: Cloud storage for media files and user-uploaded content
- Data Processing Location: United States
- Category: Essential service functionality
- Privacy Policy: https://policies.google.com/privacy
Upstash
- Provider: Upstash, Inc.
- Purpose: Caching and rate limiting
- Data Processing Location: United States
- Category: Essential service functionality
- Privacy Policy: https://upstash.com/trust/privacy.pdf
AI & Language Models
OpenRouter
- Provider: OpenRouter
- Purpose: Model routing and gateway for accessing multiple AI providers
- Data Processing Location: United States
- Category: Core product functionality
- Privacy Policy: https://openrouter.ai/privacy
ElevenLabs
- Provider: ElevenLabs, Inc.
- Purpose: Speech-to-text transcription and audio processing
- Data Processing Location: United States
- Category: Core product functionality
- Privacy Policy: https://elevenlabs.io/privacy
Search & Research
Tavily
- Provider: Tavily Inc.
- Purpose: Web search for research and information retrieval
- Data Processing Location: United States
- Category: Core product functionality
- Privacy Policy: https://tavily.com/privacy
Analytics & Monitoring
PostHog
- Provider: PostHog Inc.
- Purpose: Product analytics, feature flags, and session replay
- Data Processing Location: United States
- Category: Analytics (requires user consent)
- Privacy Policy: https://posthog.com/privacy
Google Analytics
- Provider: Google LLC
- Purpose: Website traffic analysis and user behavior tracking
- Data Processing Location: United States
- Category: Analytics (requires user consent)
- Privacy Policy: https://policies.google.com/privacy
Microsoft Clarity
- Provider: Microsoft Corporation
- Purpose: Session recording and heatmaps (landing page only)
- Data Processing Location: United States
- Category: Analytics (requires user consent)
- Privacy Policy: https://privacy.microsoft.com/privacystatement
Communication Services
Intercom
- Provider: Intercom, Inc.
- Purpose: Customer support chat, messaging, and help center
- Data Processing Location: United States
- Category: Essential service functionality
- Privacy Policy: https://www.intercom.com/legal/privacy
SendGrid
- Provider: Twilio Inc. (SendGrid)
- Purpose: Transactional email delivery (notifications, reports, account updates)
- Data Processing Location: United States
- Category: Essential service functionality
- Privacy Policy: https://www.twilio.com/legal/privacy
Security & Fraud Prevention
Google reCAPTCHA Enterprise
- Provider: Google LLC
- Purpose: Bot detection and fraud prevention
- Data Processing Location: United States
- Category: Essential security functionality
- Privacy Policy: https://policies.google.com/privacy
Infrastructure & Hosting
Vercel
- Provider: Vercel Inc.
- Purpose: Application hosting, serverless functions, and content delivery network (CDN)
- Data Processing Location: United States (with global CDN)
- Category: Essential service infrastructure
- Privacy Policy: https://vercel.com/legal/privacy-policy
Google Cloud Platform
- Provider: Google LLC
- Purpose: Cloud infrastructure, authentication services, and workload identity federation
- Data Processing Location: United States
- Category: Essential service infrastructure
- Privacy Policy: https://policies.google.com/privacy
Data Processing Locations
Most of our subprocessors process data within the United States. For customers in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on:
- Standard Contractual Clauses (SCCs) where applicable
- Adequacy decisions by the European Commission
- Other appropriate data transfer mechanisms as required by GDPR
Updates to this List
The Company may update this list from time to time as we add or remove service providers. Material changes will be communicated to customers in accordance with our Privacy Policy.
For questions about our subprocessors or data processing practices, please contact us at legal@mod.app.