Privacy

There are two keys. Your OpenAI API key stays in your product’s environment. We forward Authorization. We never store that key and we never log it. x-cs-key is a CostSlice credential. We store a hash of it so we can look up the workspace. We do not email the CostSlice secret again after you copy it.

The controller is Media Yard LLC, trading as CostSlice. We have not appointed a DPO; hello@costslice.com is the privacy contact. We have not appointed an Article 27 representative in the Union. If we do, this section will name them.

• Work email and workspace membership, so we can send a magic link and run the account.
• If you use Continue with Google, the Google account email. We do not receive a Google password.
• Plan, Stripe billing identifiers, and invoice status on Pro and Scale. We do not store full card numbers. Stripe is not used on Starter.
• A session cookie after sign-in so the workspace stays open. We do not run advertising, third-party analytics, or remarketing cookies.
• Server logs (IP, user agent, timestamps) needed to keep the site and proxy up.
• What you write to support@costslice.com or hello@costslice.com.

We collect a work email and a workspace label. We do not collect phone numbers, location beyond IP, advertising identifiers, or special-category data as a controller. Do not put names, emails, or medical record numbers in tenant, feature, or env tags.

When you send a request through the proxy we record usage metadata: model, token counts, latency, status, timestamps, request counts, and the opaque tags you send. That pile is yours. We keep it for the retention window on the plan (7 days Starter, 90 days Pro, 365 days Scale). Prompt and completion bodies are not written to our disk. OpenAI fulfills the model call with the OpenAI API key you provide; that processing is under your OpenAI agreement. Today this is OpenAI. Claude and other models come later.

Traffic to CostSlice uses TLS. Prompt and completion bodies are not written to disk. Access to account and usage data is limited to people who run CostSlice. Backups age out. We never store your OpenAI API key. The short page is Security.

For controller processing:

• Contract (Art. 6(1)(b)): email, magic link, workspace, providing the P&L, paid-plan billing.
• Legitimate interests (Art. 6(1)(f)): security logs, abuse detection, keeping fail-open working.
• Legal obligation (Art. 6(1)(c)): tax and accounting records for paid invoices.

We do not rely on consent for the core product. We do not send marketing mail. We do not make solely automated decisions that produce legal or similarly significant effects (Art. 22).

We use a session cookie after the magic link. We also store first-party signup source from the landing URL (utm_source, utm_medium, utm_campaign, optional utm_content / ref) so we can attach it to the workspace after the magic-link return. We do not use advertising, third-party analytics, or remarketing cookies. UK PECR does not require a consent banner for strictly necessary cookies.

Processor data from the proxy (DPA Annex 3)

OpenAI is not our subprocessor. The model call uses your OpenAI API key under your OpenAI agreement. The public copy of these tables is also on Subprocessors.

Account processors (we are controller)

Before a new party begins processing proxy usage metadata we will update this page and email account holders at least 30 days in advance.

We may disclose data if the law requires it, or if Media Yard LLC is sold, to the buyer under this notice. We do not sell personal data and we do not share it for cross-context advertising.

We host in the United States. For UK GDPR restricted transfers we use the UK Addendum to the EU SCCs (the EU clauses alone are not valid for a UK transfer). For EU GDPR we use the 2021 EU SCCs. Swiss transfers use the SCCs as adapted for Switzerland. The modules and annexes live in the DPA. We have documented the transfer impact assessment of US law and will make it available on request. We are not currently certified under the UK–US Data Bridge or the EU–US Data Privacy Framework.

Cancel plan in Settings moves you to Starter. Close account cancels Stripe if you are on a paid plan, revokes CostSlice keys, and erases the workspace and usage metadata. Prompts were never stored. Invoice and tax records stay as the law requires.

Account email: for the life of the workspace. Close the account and we delete the workspace, CostSlice keys, and usage metadata. Invoice and tax records stay as the law requires. Support mail: as long as the thread is open, then a short archive. Backups age out.

You can ask for access, correction, erasure, restriction, portability, or to object. Erasure is self-serve: Close account in Settings. We still answer rights emails within one month. You can complain to the ICO, your EU supervisory authority, or the Swiss FDPIC.

We collect identifiers (work email) and commercial information (plan and invoice status). We do not sell or share personal information as those terms are used in the CCPA/CPRA. Virginia, Colorado, Connecticut, Utah, and New Jersey: email hello@costslice.com from the work email on the account.

CostSlice is a B2B product. It is not for anyone under 18. We do not knowingly create accounts for children. Opaque tags must not be a child’s name.

We will email material changes to the work email on the account.

Media Yard LLC is not SOC 2 certified. CostSlice is not HIPAA certified. The DPA and AI policy are public. For a signed DPA, email hello@costslice.com.