Data processing agreement

If you determine the purposes and means of the processing of usage metadata, you are the controller and Media Yard LLC is the processor.

If you process that metadata on behalf of another controller, you are the processor and we are the sub-processor. Module Three of the 2021 EU SCCs applies instead of Module Two.

For your work email, workspace membership, Continue with Google account email when that sign-in is used, and Stripe billing identifiers (Pro and Scale only; Stripe is not used on Starter), Media Yard LLC is the controller. That pile is described in Privacy, not here.

Prompt bodies, completion bodies, and your OpenAI API key are not processor data. We do not receive them as data we keep. Bodies are not written to disk. The OpenAI API key is forwarded and never stored. OpenAI is not a subprocessor. That call uses your OpenAI API key under your OpenAI agreement.

Fail-open ingest means a missing tag or a slow control plane does not drop the completion. Untagged traffic still returns. We still record the usage metadata we have. That is not a promise that nothing will fail.

Starter is a hard request cap on the CostSlice plan. When Starter hits included requests, new proxy calls stop. That cap is our product limit, not a processing of prompt content. We do not cap a tenant because a P&L row is red.

Running the CostSlice proxy and customer P&L. Duration: the life of the workspace plus the retention window. Nature: recording, storing, displaying, exporting CSV. Purpose: so you can see AI cost by customer and feature. Types of data: usage metadata and opaque tags you choose. Data subjects: whoever those tags refer to, which should not be a named person. You instruct us not to interpret tags as personal data. Do not put names, emails, or medical record numbers in them.

Annex 1 populates SCC Annex I.A, I.B and I.C.

You instruct us to process processor data only to proxy the call, attach the tags you send, keep the P&L for the plan window (7 days Starter, 90 days Pro, 365 days Scale), and export CSV when you ask. We will not process it for another purpose unless UK or EU law requires it. If an instruction would make us break the law, we will say so in writing to hello@costslice.com on the account.

Technical and organisational measures: TLS in transit; prompt and completion bodies are not written to disk; access to processor data is limited to people who run CostSlice, under confidentiality; backups age out. We review these measures at least annually. We do not claim SOC 2 or HIPAA. Fail-open means a missing tag or a slow control plane does not drop the completion. That is a product choice, not a promise that nothing will fail.

We will notify you without undue delay, and in any event within 48 hours of becoming aware, of a personal-data breach affecting processor data. That notice will say what happened as we know it, which categories of data are involved, what we are doing, and how to reach us.

We assist you, taking into account the nature of the processing and the information we have, with Articles 32 to 36 and with data-subject requests about processor data.

Annex 3 is the list. The public copy is in Privacy.

Before a new subprocessor begins processing processor data we will update Annex 3 and Privacy and email the account owner at least 30 days in advance. You may object by writing hello@costslice.com within that window. If we cannot accommodate the objection, you may stop sending traffic and close the workspace.

We impose data-protection obligations on each subprocessor that are no less protective than this DPA, and we remain responsible to you for their performance. On request we will provide a copy of each subprocessor agreement, with reasonable commercial redactions.

Plus Five Five (Resend), Stripe, and Google process account data for which we are the controller. They are not subprocessors of proxy usage metadata. Neon stores account records and, in Annex 3, usage metadata. OpenAI is not our subprocessor for prompt or completion content.

Processor data is hosted in the United States. The Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914 are incorporated:

• Module Two where you are the controller; Module Three where you are a processor
• Clause 7 docking: off
• Clause 9 Option 2, 30 days
• Clause 11 optional body: off
• Clauses 17 and 18: Ireland
• Annex I.A / I.B / I.C = Annex 1; Annex II = Annex 2; Annex III = Annex 3

We have documented the Clause 14 assessment of US law for this processing, including FISA 702 and the CLOUD Act, and will make it available to you or a competent supervisory authority on request.

United Kingdom

Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

Switzerland

References to the GDPR are read as references to the Swiss FADP, the FDPIC is the competent authority in Annex I.C for Swiss transfers, and “member state” is read so Swiss data subjects keep the right to sue in their place of habitual residence.

We are not certified under the UK–US Data Bridge or the EU–US Data Privacy Framework.

At the end of the service, at your choice we will delete processor data or return it (CSV export of usage metadata) and delete remaining copies, and we will certify deletion on request. Usage totals kept for tax contain no prompt content.

Close account in Settings stops processing. It cancels Stripe if you are on a paid plan, revokes CostSlice keys, and deletes the workspace and processor data. Cancel plan only moves you to Starter. Processing of usage metadata continues on Starter until you close. If you cannot sign in, email hello@costslice.com. We answer rights emails from the work email that owns the account within one month where UK or EU GDPR requires it. Backups age out. We will give you the security information we actually have. We do not run customer-directed penetration tests on shared infrastructure.

On written request no more than once in twelve months, we make available the information reasonably necessary to demonstrate Article 28. Where that is not enough, you may audit, or appoint an independent auditor who is not our competitor, on thirty days’ notice, during business hours, at your cost unless the audit finds material non-compliance.

Where the CCPA/CPRA applies to processor data, Media Yard LLC is a service provider / contractor. We will not sell it, share it for cross-context advertising, retain, use, or disclose it except for the business purposes in Annex 1, combine it with other personal information except as those laws allow, or use it outside the direct business relationship. We will tell you if we can no longer meet those obligations.

Liability follows the Terms, except where UK GDPR Article 82, EU GDPR Article 82, the Clauses, or a similar rule requires a different split. New Jersey law and New Jersey venue for the contract, without limiting those mandatory rules or the Ireland forum in the Clauses for claims the Clauses give to data subjects.

TLS in transit. Prompt and completion bodies are not written to disk. OpenAI API keys are forwarded, never stored. CostSlice keys stored as hashes. Access limited to people who run CostSlice, under confidentiality, with MFA. Backups age out. Fail-open does not write bodies to disk. We review these measures at least annually.

This table is the whole list for processor data from the proxy. The same rows are on Privacy and Subprocessors.