Data processing addendum

Using Slipmill includes this addendum. No extra signature is required for it to apply. If you need a countersigned copy, email privacy@slipmill.com.

This addendum applies when you are a business and Slipmill processes personal data contained in render requests on your behalf.

If you determine the purposes and means of that processing, you are the controller and Media Yard LLC is the processor.

If you process that data on behalf of another controller (a 3PL or SaaS posting a shop’s orders), you are the processor and we are the sub-processor. Module Three of the 2021 EU SCCs applies instead of Module Two.

For GDPR that is Article 28. For the CCPA we are a service provider: we process that data only to provide Slipmill, not to sell it, share it for cross-context advertising, or use it for our own advertising.

Subject matter: packing-slip and invoice payloads, including names and addresses you submit. Duration: for the life of the account. Nature: transmission and rendering to PDF; we keep render metadata, not the JSON body or the PDF file. Types of data: contact and shipping details you choose to send. Data subjects: your customers and counterparties. Annex 1 holds the SCC annexes.

We will process that data only on your documented instructions (submitting JSON to /v1/render and using the dashboard) and keep it confidential. We implement the measures in Annex 2. We assist you with Articles 32 to 36 and with data-subject requests, taking into account that unstored JSON and PDF bytes are gone when the response is sent.

We will notify you of a personal-data breach affecting the service without undue delay and in any event within 48 hours after we become aware of it.

Subprocessors of document data

Annex 3 is the list. Privacy repeats it.

Stripe, Resend, and Neon for accounts/billing/mail are processors of account data for which we are the controller. They do not receive the JSON body or the PDF.

Before a new subprocessor begins processing document personal data we will update Annex 3 and Privacy and give 30 days’ notice on this page and by email to the account address. You have that window to object on reasonable data-protection grounds. If we cannot accommodate the objection, you may close the account. We remain responsible for their work. On request we will provide a copy of each subprocessor agreement, with reasonable commercial redactions.

International transfers

The product is hosted in the United States. The Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914 are incorporated:

• Module Two where you are the controller; Module Three where you are a processor
• Clause 7 docking: off
• Clause 9 Option 2, 30 days
• Clause 11 optional body: off
• Clauses 17 and 18: Ireland
• Annex I.A / I.B / I.C = Annex 1; Annex II = Annex 2; Annex III = Annex 3

We have documented the Clause 14 assessment of US law for this processing, including FISA 702 and the CLOUD Act, and will make it available to you or a competent supervisory authority on request.

United Kingdom

Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

Switzerland

References to the GDPR are read as FADP, the FDPIC is Annex I.C for Swiss transfers, and “member state” is read so Swiss data subjects keep habitual-residence claims.

We are not certified under the EU-US Data Privacy Framework.

Deletion, return, audits

At the end of the service, at your choice we will delete personal data we process on your behalf or return what we still hold (render metadata; JSON body and PDF were not stored) and delete remaining copies, and we will certify deletion on request. Usage totals kept for tax contain no order JSON.

Close the account from Settings to stop processing and revoke keys. Residual backups and render metadata may persist for a limited period. Do not run customer penetration tests against the shared infrastructure.

On written request no more than once in twelve months we make available the information reasonably necessary to demonstrate Article 28. Where that is not enough you may audit, or appoint an independent auditor who is not our competitor, on thirty days’ notice, at your cost unless the audit finds material non-compliance.

CCPA

We will not sell document personal data, share it for cross-context advertising, retain, use, or disclose it except to print the PDF and operate the account, combine it with other personal information except as those laws allow, or use it outside the direct business relationship. We will tell you if we can no longer meet those obligations.

Liability and law

Liability follows the Terms, except where UK or EU GDPR Article 82, the Clauses, or a similar rule requires a different split. New Jersey law and New Jersey courts govern the contract, without limiting the Ireland forum in the Clauses for claims the Clauses give to data subjects.

This DPA is not legal advice. Media Yard LLC does not have lawyers on staff.

Annex 1 — SCC Annex I.A, I.B, I.C

Annex 2 — TOMs

TLS in transit. JSON body used in memory to build the PDF and discarded after the response. PDF bytes returned in the response, not stored. Render metadata (id, template, byte size, time) kept for quota. Logo URL fetched over HTTPS at render time — an image download, not a vision API; file:// and internal hosts refused. Access limited to people who run Slipmill, under confidentiality. We review these measures at least annually. No generative model in the render path. See AI.

Annex 3 — Subprocessors of document data

This table is the whole list for personal data in render payloads.