Privacy

The controller is Media Yard LLC, United States, trading as CostSlice. We have not appointed a UK Article 27 representative or an EU Article 27 representative. Until we do, write hello@costslice.com. We have not appointed a DPO; that address is the privacy contact.

• Work email and workspace membership, so we can send a magic link and run the account.
• Plan, Stripe billing identifiers, and invoice status on Pro and Scale. We do not store full card numbers. Starter: no credit card needed. Stripe is not used on Starter.
• A session cookie after sign-in. CostSlice is daylight only.
• Server logs (IP, user agent, timestamps) needed to keep the site and proxy up.
• What you write to support@costslice.com or hello@.

We do not collect names, phone numbers, location beyond IP, advertising identifiers, or special-category data as a controller. Do not put names, emails, or medical record numbers in tenant, feature, or env tags.

When you send a request through the proxy we record usage metadata: model, token counts, latency, status, timestamps, request counts, and the opaque tags you send. That pile is yours. We keep it for the retention window on the plan (7 days Starter, 90 days Pro, 365 days Scale). Prompt and completion bodies are not written to our disk. OpenAI fulfills the model call with the OpenAI API key you provide; that processing is under your OpenAI agreement.

For controller processing:

• Contract (UK GDPR Art. 6(1)(b)): email, magic link, workspace, providing the P&L, paid-plan billing.
• Legitimate interests (Art. 6(1)(f)): security logs, abuse detection, keeping fail-open working. Those interests are running a B2B proxy without dropping completions. They do not override a person’s rights.
• Legal obligation (Art. 6(1)(c)): tax and accounting records for paid invoices.

We do not rely on consent for the core product. We do not send marketing mail. We do not make solely automated decisions that produce legal or similarly significant effects (Art. 22).

We only use cookies that are strictly necessary: a session cookie after the magic link. CostSlice is daylight only. We do not set a theme cookie and we do not store a theme preference in localStorage. We do not use advertising, analytics, or remarketing cookies. UK PECR does not require a consent banner for strictly necessary cookies. There is no cookie wall.

• Vercel, Inc. — hosts the site and proxy (United States).
• Resend — sends transactional magic-link mail.
• Stripe, Inc. — paid-plan billing. Stripe is not used on Starter.

We may disclose data if the law requires it, or if Media Yard LLC is sold, to the buyer under this notice. We do not sell personal data and we do not share it for cross-context advertising.

We host in the United States. For UK GDPR restricted transfers we use the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, not the EU clauses alone. For EU GDPR we use the 2021 EU SCCs. We are not currently certified under the UK–US Data Bridge or the EU–US Data Privacy Framework. You can ask for a copy of the transfer terms at hello@.

Account email: for the life of the workspace, then deletion on request or when the account is closed. Usage metadata: the plan window, then deletion. Billing records: as tax law requires. Support mail: as long as the thread is open, then a short archive. Backups age out.

You can ask for access, correction, erasure, restriction, portability, or to object. Email hello@costslice.com from the work email that owns the account. We will answer within one month. You can complain to the UK Information Commissioner’s Office at ICO, to your EU supervisory authority, or to the Swiss FDPIC. Those rights do not make us store prompts we never kept.

We collect identifiers (work email) and commercial information (plan and invoice status). We do not sell or share personal information as those terms are used in the CCPA/CPRA. We do not use sensitive personal information to infer characteristics. To exercise access or deletion, use the same hello@ address. We do not honour a Do Not Track signal because we do not run advertising trackers.

CostSlice is a B2B product. It is not for anyone under 18. We do not knowingly collect children’s data.

Media Yard LLC is not SOC 2 certified. CostSlice is not HIPAA certified. The DPA and AI policy are public. For a signed DPA, email hello@.