When you send us data for an X-ray, a shadow period, or a guarantee, we process it for you. Our DPA puts that in writing. Here's what it says; write to us and we send it for signature, or send us yours.
You're the controller of the data you send us. We're your processor, and we act only on your instructions: the order form, the X-ray, and this agreement.
Usage exports, invoices, unit counts, call metadata, and, during a guarantee, model calls in transit to the provider. We never store prompt or completion text.
Only those on our subprocessors page. We tell you 30 days before adding one, and you can object.
Encryption in transit and at rest, access limited to the staff on your account, every read logged, zero data retention at the model providers, and an independent penetration test every year.
We tell you within 48 hours of finding a breach that touches your data, with what we know and what we're doing about it.
Data is processed in the United States. For personal data from the EU or the UK, the agreement includes the Standard Contractual Clauses.
We answer your security questionnaire, share our SOC 2 report once we have it, and allow one audit a year on reasonable notice.
On the schedule in our privacy policy, or sooner when you ask. When we're done, we delete your data and confirm it in writing.
Write to hello@merlinfield.com. We send ours for signature the same day, or review yours.