Data Processing Agreement (DPA)

Parties: This Data Processing Agreement (“Agreement”) is entered into between:

  • Msty, operated by CloudStack, LLC (“Processor”), and
  • You, the user of Msty's services (“Controller”).

This Agreement forms part of the overall Privacy Policy and Terms of Service between Msty and the Controller (the “Principal Agreement”).

1. Purpose and Scope

This Agreement governs the processing of personal data by Msty solely in the context of providing its modular AI orchestration services. Msty does not collect, store, or process any personal or customer data on its own infrastructure.

All customer-related data, including names, payment details, and license keys are processed exclusively by LemonSqueezy, a third-party provider used for license management and payment processing.

Additionally, Msty allows customers to:

  • Connect their own AI language models (LLMs) hosted on third-party platforms.
  • Integrate external tools via MCP (Modular Control Protocol).

In such cases, Msty acts as a facilitator and does not process or store data flowing between the customer and these third-party services. It is the customer’s responsibility to vet and secure any third-party integrations they use.

2. Nature of Processing

Msty:

  • Facilitates interactions with connected models and tools via user-directed integrations.
  • Does not store, log, or analyze any data sent through those integrations.

3. Categories of Data Subjects

Data subjects may include:

  • Customers who purchase licenses through LemonSqueezy.
  • End users of customer applications, to the extent they interact with third-party tools connected by the customer via Msty.

Msty itself does not collect or process identifiable data from these subjects.

4. Type of Personal Data

Msty does not handle personal data directly. The following data may be handled solely by LemonSqueezy:

  • Customer names
  • Email addresses
  • Payment information
  • License key data

Any personal data transferred via third-party LLMs or tools connected through Msty are not processed or retained by Msty.

5. Processor Obligations

Msty shall:

  • Avoid any retention of customer or end-user data.
  • Ensure secure transmission between systems using industry-standard encryption.
  • Not engage in profiling, tracking, or secondary processing of any data transmitted via user-initiated integrations.
  • Use LemonSqueezy as its only sub-processor for billing and licensing information.

6. Use of Sub-Processors

Msty uses only:

No other sub-processors are engaged by Msty in the delivery of its services at this time.

7. Third-Party Integrations and Customer Responsibility

Msty allows customers to connect:

  • External AI models (e.g., OpenAI, Anthropic, Azure)
  • Tools and APIs via MCP (Modular Control Protocol)

The customer is solely responsible for:

  • Vetting third-party tools and model providers
  • Ensuring compliance with privacy laws in their use
  • Handling any personal data passed through those systems

Msty does not monitor, store, or log any of the data exchanged with those third parties.

8. Data Subject Rights

Since Msty does not store or control personal data, requests related to data subject rights (access, deletion, correction, etc.) must be directed to:

  • LemonSqueezy for license/billing information
  • Third-party integrations for any data handled during user interactions

9. Data Security

Msty implements:

  • HTTPS/TLS encryption for all data in transit
  • User data isolation - data is only stored on user's local machine

10. Termination

Upon termination of services:

  • Msty retains no personal data.
  • Licensing and transaction records remain with LemonSqueezy in accordance with their data retention policies.

11. Governing Law

This Agreement is governed by and construed in accordance with the laws of Delaware, USA.

12. Contact

For questions regarding this DPA, please contact: Email: [email protected]