Our providers

Version 2026-10-04, effective from 4 October 2026.

Who processes personal data for Molo, where, and on what legal footing. Updated 2026-10-04. Copies of the Standard Contractual Clauses we have signed are available from privacy@hellomolo.com.

| Provider | Entity | What it processes | Where | Transfer mechanism (GDPR) | POPIA s72 ground | |---|---|---|---|---|---| | Cloudflare | Cloudflare, Inc. (US) | Runs the app and API at the edge; stores audio and images (R2); queues; database connection pooling | Global network, including South Africa; US | EU–US Data Privacy Framework and Standard Contractual Clauses (Module 2) in the Cloudflare Customer DPA | Binding agreement (DPA with SCCs) | | PlanetScale | PlanetScale Inc. (US) | The database: accounts, learning data, subscription status | Stored in London, United Kingdom (AWS eu-west-2); support access from the US | UK: Commission adequacy decision (EU) 2025/2574; US access: Standard Contractual Clauses in the PlanetScale DPA | Adequate law (UK); binding agreement (US) | | Sentry | Functional Software, Inc. (US) | Error and crash reports | Event data in the EU (Frankfurt); account metadata in the US | EU–US Data Privacy Framework, with Standard Contractual Clauses as fallback | Binding agreement | | Resend | Plus Five Five, Inc. (US) | Sends our account, receipt and reminder emails | Sent from the EU region; sending records stored in the US | EU–US Data Privacy Framework and Standard Contractual Clauses | Binding agreement | | Expo (EAS) | 650 Industries, Inc. (US) | Delivers reminders (push tokens) to Apple and Google; serves the app's code updates (app version, platform, a random installation identifier) | US | EU–US Data Privacy Framework; processor terms in Expo's Terms of Service §3.2 | Contract necessity (delivering the notification you asked for) | | RevenueCat | RevenueCat, Inc. (US) | Subscription status and an anonymous subscriber identifier | US | Standard Contractual Clauses (Module 2) in the RevenueCat DPA | Binding agreement | | Slack | Slack Technologies Limited (Ireland); data held by Slack Technologies, LLC (US) | Messages to our team: when someone joins, their first name, whether they signed up with Apple, Google or email, the country they gave, whether they joined on iOS, Android or the web, and the language they take the course in; a reported league name as the reporter saw it; which exercise was reported and why; feedback you send, with the screen, app version, platform, language and, if you are signed in, your account id | US | EU–US Data Privacy Framework and Standard Contractual Clauses in Slack's Data Processing Addendum | Binding agreement (DPA with SCCs) | | PostHog | PostHog, Inc. (US) | Product analytics, only for learners who agree: usage events, screen recordings with typed text, other learners' names and the learner's e-mail hidden, device and app details, and the country (worked out from the IP address, which is then discarded); a random or account identifier, never a name or e-mail | Stored in the EU (Frankfurt); support access from the US | Standard Contractual Clauses (Module 2) in the PostHog DPA | Binding agreement (DPA with SCCs) | | Apple | Apple Distribution International Ltd (Ireland) | Sign in with Apple; App Store purchases | EU / worldwide | Independent controller under Apple's privacy policy | Apple's own terms | | Google | Google Ireland Ltd / Google Commerce Ltd | Sign in with Google; Google Play purchases | EU / worldwide | Independent controller under Google's privacy policy | Google's own terms | | Stripe | Stripe Payments Europe Ltd (Ireland) | Card payments for web subscriptions | EU / worldwide | Independent controller for payment processing; Stripe DPA for ancillary services | Stripe's own terms |

Other learners in your weekly league (up to 20 people) see your name and rank. No advertising provider receives your data, and the analytics provider above receives it only if you agree.