Legal

Data Processing Addendum

The terms under which Meilynx processes personal data on behalf of its customers, including the Standard Contractual Clauses for international transfers. This DPA forms part of the Terms of Service and needs no separate signature.

Last updated: October 19, 2026Meilynx LLC

1. Scope and how this DPA applies

This Data Processing Addendum (“DPA”) forms part of the agreement between Meilynx LLC (“Meilynx”) and the customer (“Customer”) for the Meilynx Service: the Terms of Service or a signed agreement that refers to it (the “Agreement”). It applies automatically when Customer accepts the Agreement, and it governs Meilynx’s processing of Customer Personal Data.

Customers who need a countersigned copy for their records can request one at legal@meilynx.com. The countersigned copy has the same terms as this page.

2. Definitions

Terms not defined here have the meaning given in the Agreement or in Data Protection Laws.

Data Protection Laws: all laws that apply to the processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the GDPR as it forms part of UK law and the UK Data Protection Act 2018 (“UK GDPR”), the Swiss Federal Act on Data Protection (“FADP”), and US state privacy laws such as the California Consumer Privacy Act as amended (“CCPA”).
Customer Personal Data: personal data within Customer Data that Meilynx processes on behalf of Customer.
Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems that Meilynx or its Sub-processors manage.
Sub-processor: a third party that Meilynx engages to process Customer Personal Data.
SCCs: the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (version B1.0).

“Controller,” “processor,” “data subject,” “personal data,” “processing,” “business,” and “service provider” have the meanings given in Data Protection Laws.

3. Roles of the parties

Customer is the controller of Customer Personal Data, or a processor acting for its own customers, and Meilynx is Customer’s processor or sub-processor. Where Customer acts as a processor, Customer confirms that its controller has authorized its instructions, including the appointment of Meilynx.

Annex I describes the processing. Meilynx is an independent controller only of the account, billing, and relationship information described in its Privacy Policy.

4. Processing on Customer's instructions

Meilynx will process Customer Personal Data only on Customer’s documented instructions, unless the law requires otherwise. In that case Meilynx will inform Customer of the legal requirement before processing, unless the law prohibits it. Customer’s instructions are the Agreement, this DPA, and the configuration Customer sets in the Service, including its deployment mode, policies, audit capture setting (full content, redacted content, or hashes only), and retention settings.

Meilynx will tell Customer promptly if, in its opinion, an instruction infringes Data Protection Laws. Meilynx will not use Customer Personal Data to train or fine-tune any AI model.

Customer is responsible for the lawfulness of its instructions and of the Customer Personal Data it routes through the Service, including any notices and consents required.

5. Meilynx personnel

Meilynx limits access to Customer Personal Data to personnel who need it to provide, secure, or support the Service. Each of them is bound by a written obligation of confidentiality and receives security and privacy training.

6. Security

Meilynx will implement and maintain the technical and organizational measures in Annex II, which are designed to protect Customer Personal Data against Security Incidents and to give a level of security appropriate to the risk. Meilynx may update these measures over time, provided it does not materially reduce the overall security of the Service.

7. Sub-processors

Customer gives Meilynx general authorization to engage Sub-processors. The current list is available to Customer on request at legal@meilynx.com and through the Meilynx Trust Center.

Meilynx will notify Customer by email at least 30 days before a new Sub-processor begins processing Customer Personal Data. Customer can name the address that receives these notices by writing to legal@meilynx.com.
Customer may object to a new Sub-processor on reasonable data protection grounds within that notice period. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected part of the Service, and Meilynx will refund prepaid fees for the remaining term.
Meilynx will impose on each Sub-processor, by written contract, data protection obligations that are no less protective than this DPA, and remains responsible to Customer for each Sub-processor’s performance of them.

8. Data subject requests

If Meilynx receives a request from a data subject about Customer Personal Data, it will refer the data subject to Customer and will not respond to the request itself, unless the law requires it. Taking into account the nature of the processing, Meilynx will assist Customer with appropriate technical and organizational measures, so far as possible, to respond to data subject requests, including through the export and deletion functions of the Service.

9. Security Incidents

Meilynx will notify Customer without undue delay, and in any event within 48 hours, after confirming a Security Incident. The notice will describe, as far as the information is available, the nature of the incident, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed to address it. Meilynx will provide further information as it becomes available.

Meilynx will take reasonable steps to contain and remediate the Security Incident and will cooperate with Customer so that Customer can meet its own obligations to notify regulators and data subjects. A notice is not an admission of fault or liability.

10. Assessments and consultations

Taking into account the nature of the processing and the information available to it, Meilynx will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities that relate to the Service.

11. Return and deletion

When the Agreement ends, Customer may request an export of Customer Personal Data within 30 days. Meilynx will then delete Customer Personal Data from the Service, and will certify the deletion in writing on request, with these exceptions:

Audit records held under a write-once retention period remain until that period ends and are then deleted. Until then they stay subject to this DPA, and Meilynx will not process them except to store them and to respond to Customer’s instructions.
Data in encrypted backups is deleted as the backups expire on their regular schedule.
Data the law requires Meilynx to keep is retained only for that purpose.

In a Self-Hosted deployment, Customer controls the proxy and audit store and the data they hold.

12. Audits and regulator access

Meilynx will make available to Customer the information needed to demonstrate its compliance with this DPA. On request, and under confidentiality, Meilynx will provide its most recent SOC 2 report and reasonable responses to Customer’s security and privacy questionnaires.

If that information is not enough to demonstrate compliance, if a supervisory authority or regulator requires it, or after a Security Incident, Customer may audit Meilynx’s compliance with this DPA. An audit requires at least 30 days’ written notice, an agreed scope, reasonable timing during business hours, and confidentiality commitments, and takes place no more than once in any 12 months unless a regulator requires otherwise. Customer bears its own costs. An auditor that competes with Meilynx may not carry it out.

Meilynx will cooperate with a regulator that has authority over Customer, in connection with its supervision of Customer’s use of the Service, including by providing information about the Service and the processing.

13. International transfers

Meilynx stores and processes Customer Personal Data in the United States. To the extent that Customer Personal Data subject to the GDPR, the UK GDPR, or the FADP is transferred to Meilynx in a country without an adequacy decision, the parties incorporate the following into this DPA by reference.

European Economic Area

The SCCs, with Module Two (controller to processor) where Customer is a controller and Module Three (processor to processor) where Customer is a processor. For both Modules:

Clause 7 (the docking clause) applies.
Under Clause 9(a), Option 2 (general written authorization) applies, with the notice period set out in Section 7 of this DPA.
The optional wording in Clause 11(a) does not apply.
Under Clause 13, the competent supervisory authority is determined as Annex I.C sets out.
Under Clause 17, Option 1 applies, and the governing law is the law of Ireland.
Under Clause 18(b), disputes are resolved before the courts of Ireland.
Annexes I and II of this DPA complete Annexes I and II of the SCCs, and Annex III completes Annex III.

United Kingdom

The SCCs as amended by the UK Addendum. Table 1 is completed with the parties’ details in Annex I; Table 2 with the Modules and options selected above; Table 3 with Annexes I to III of this DPA; and in Table 4, either party may end the UK Addendum as its Section 19 allows.

Switzerland

The SCCs as set out above, with these changes: references to the GDPR are read as references to the FADP; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; and the term “member state” does not prevent data subjects in Switzerland from bringing claims in their place of habitual residence.

If the SCCs and this DPA conflict, the SCCs prevail. If a transfer mechanism is replaced or invalidated, the parties will cooperate in good faith to put an appropriate alternative in place.

14. US state privacy laws

Where the CCPA or a similar US state law applies, Meilynx acts as Customer’s service provider or processor, and the business purpose of the processing is providing the Service as described in Annex I. Meilynx will not:

sell or share Customer Personal Data, as those terms are defined in the CCPA;
retain, use, or disclose it for any purpose other than the business purposes set out in the Agreement, or outside the direct business relationship between the parties;
combine it with personal information Meilynx receives from or on behalf of others, except as those laws permit.

Meilynx will comply with the obligations those laws place on it, give Customer Personal Data the level of privacy protection they require, and tell Customer if it can no longer meet them. Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use. Meilynx certifies that it understands and will comply with these restrictions.

15. Liability and general terms

Each party’s liability under this DPA is subject to the limitations and exclusions in the Agreement, except where the SCCs or Data Protection Laws do not allow them.
If this DPA and the Agreement conflict on the processing of Customer Personal Data, this DPA prevails, except that the SCCs prevail over both.
This DPA lasts for as long as Meilynx processes Customer Personal Data. Meilynx may update this DPA to reflect changes in law or in the Service, provided the update does not reduce the protection of Customer Personal Data, and will post the new version on this page with a new date.
This DPA is governed by the law that governs the Agreement, except where the SCCs require otherwise.

Annex I. Description of the processing

A. Parties

Data exporter: Customer, as identified in the Agreement or its account. Contact: the account owner named in the Service. Role: controller, or processor on behalf of its own customers. Activities: use of the Service. Signature and date: by accepting the Agreement.

Data importer: Meilynx LLC, 800 Bellevue Way NE, Suite 500, Bellevue, WA 98004, United States. Contact: privacy@meilynx.com. Role: processor, or sub-processor. Activities: provision of the Service. Signature and date: by making the Service available under the Agreement.

B. Description of the transfer

Data subjects	Customer’s Users of the Service; and individuals whose personal data appears in the AI requests, responses, and tool calls that Customer routes through its proxy, such as Customer’s employees, contractors, customers, patients, applicants, and other individuals, as Customer determines.
Categories of personal data	User account data (name, email address, role, identifiers); identifiers and labels Customer attaches to its traffic, such as end-user and session identifiers; and the content of AI requests, responses, and tool calls, and the policy findings about them, as Customer’s audit capture setting keeps.
Sensitive data	Customer decides what its traffic contains, and it may include special categories of data, such as health data. Safeguards: a dedicated, single-tenant environment for each customer; encryption with a key specific to each customer; options to redact sensitive values or keep hashes only; write-once, hash-chained audit records; and access limited to authorized personnel.
Frequency	Continuous, for as long as Customer uses the Service.
Nature of the processing	Hosting, transmission, policy evaluation, redaction, recording in tamper-evident audit records, reporting, and support.
Purpose	Providing, securing, and supporting the Service under the Agreement.
Retention	As Customer configures it within the options of its plan, and as Section 11 describes. Audit records in production environments have a six-year write-once retention period by default.
Transfers to Sub-processors	For the same nature and purpose as above, for the duration of the Agreement, as Annex III describes.

C. Competent supervisory authority

The supervisory authority of the EU member state in which Customer is established; or, if Customer is not established in the EU, the supervisory authority of the member state in which its representative under Article 27(1) of the GDPR is established; or, if Customer has no representative, the supervisory authority of the member state in which the data subjects concerned are located. For the UK, the Information Commissioner’s Office. For Switzerland, the Federal Data Protection and Information Commissioner.

Annex II. Technical and organizational measures

Isolation. Every customer has a dedicated, single-tenant proxy and audit store. In the Fully Managed deployment they run in a separate cloud environment for each customer and environment tier, with no infrastructure shared with another customer.
Data minimization. The content of AI traffic stays in the customer’s dedicated environment. The shared control plane receives operational metadata only. Customers choose whether audit records keep full content, redacted content, or hashes only.
Encryption. Data is encrypted in transit with TLS and at rest. Each customer’s audit store is encrypted with a key specific to that customer, held in a managed key service and rotated every 90 days.
Integrity. Audit records are hash-chained, written to write-once storage with a retention lock, and anchored with independent timestamps. Anyone holding a record set can verify it with a public verification tool.
Access control. Role-based access in the Service, with single sign-on and automated user provisioning for customer organizations. Meilynx staff access to production follows least privilege, requires multi-factor authentication, is limited to named personnel, and is reviewed periodically.
Change management. Changes to the platform pass automated checks before merge, and every production deployment of the platform requires explicit human approval.
Logging and monitoring. Administrative actions are recorded in audit logs. Production systems are monitored, with alerts routed to the engineering team.
Vulnerability management. Dependencies and container images are scanned regularly, and vulnerabilities are remediated within defined timeframes based on severity. The Service undergoes independent penetration testing.
Resilience. The proxy fails closed: if it cannot apply its policy, it refuses traffic. During a control-plane outage, proxies keep enforcing their last applied policy. Control-plane databases have daily backups and point-in-time recovery.
Incident response. A documented incident response plan defines roles, escalation, and customer notification.
Personnel. Confidentiality agreements, security awareness training, and background checks where the law permits.
Independent assurance. Meilynx has completed its SOC 2 Type I audit, covering Security, Availability, and Confidentiality. The Type II observation period is underway.

Annex III. Sub-processors

The current list of Sub-processors, with the purpose of each, the data it processes, and its location, is available to Customer on request at legal@meilynx.com and through the Meilynx Trust Center. Changes follow Section 7.