Subprocessors
Every third party that processes personal data on our behalf, what each one is for, and whether it applies to you.
Last updated: 26 August 2026
Current subprocessors
Each provider below processes personal data on our instructions, under a data-processing agreement, and only for the purpose named. Where a provider is outside the UK or EEA, transfers are covered by that provider's Standard Contractual Clauses or Data Privacy Framework certification. Our Data Processing Agreement sets out the terms this list sits under.
| Provider | What it does | Where | Applies to | Added |
|---|---|---|---|---|
| Neon | PostgreSQL database hosting. Holds bookings, guests, staff records, rotas and timesheets. | United States / European Union | All customers | September 2025 |
| Vercel | Application hosting, delivery and serverless compute. Personal data passes through in transit. | United States | All customers | September 2025 |
| Clerk | Authentication and account management. Holds account email addresses, names and credentials — we never see a password. | United States | All customers | September 2025 |
| Cloudflare | Object storage for uploaded documents (R2), and bot protection on sign-in (Turnstile). | United States / global edge | All customers | August 2026 |
| Resend | Transactional email delivery: booking confirmations, reminders, rotas, invitations. | United States | All customers | September 2025 |
| Stripe | Subscription billing, and guest deposit payments for venues that connect an account. Card details never reach our servers. | United States / European Union | All customers | August 2026 |
| Sentry | Error monitoring. Receives technical context — browser, page, account identifier — when something breaks. | United States | All customers | August 2026 |
| PostHog | Product analytics. Runs only for visitors who accept analytics cookies. | United States | Where enabled | August 2026 |
| Calendar synchronisation, address autocomplete, and sign-in with Google. | United States / European Union | Where connected | September 2025 | |
| Discord | Slash commands and rota direct messages, for venues that link a server. | United States | Where connected | September 2025 |
| OpenAI | The AI assistant behind the Discord /ask command. Sends the question and the booking context needed to answer it. | United States | Where connected | September 2025 |
| Expo | Push notification delivery to the staff mobile app. Receives a device token and the notification text. | United States | Where enabled | August 2026 |
Applies to matters: "Where connected" and "Where enabled" providers receive nothing at all unless your organisation turns that integration on. A venue that never links Discord is never a Discord customer's data.
Changes to this list
We will give 30 days' notice before a new subprocessor starts processing your data, by email to the account owner and by updating this page. The date at the top and the "Added" column are there so you can tell what has changed since you last looked, without reading the whole page again.
If you object to a new subprocessor on reasonable data-protection grounds, write to hello@modusreservations.com within those 30 days. We will work with you to find an alternative; where none exists, you may terminate the affected part of the Service without penalty and receive a refund of any prepaid fees covering the remaining term.
To be told about changes without checking, email us and we will add you to the notification list. We would rather you did that than found out from a diff.